Making a Subject Access Request
The Local Authority
If you want to find out what a school has said to the council about your child, or what has been said to social services about your child or what meetings have been held to discuss your child, you can make what is called a Subject Access Request to your local council under section 7 of the Data Protection Act. Unless a SAR relates to one of a small number of special categories of information (including the "educational record" held by a school) the maximum fee which can be charged for dealing with the request is £10. The authority must respond to the SAR within 40 calendar days of receiving it.
Even if a child is too young to understand the implications of subject access rights, information about them is still their personal data and does not belong, eg, to a parent or guardian. So it is the child who has a right of access to the information held about them, even though in the case of young children these rights are likely to be exercised by those with parental responsibility for them. If the child is mature enough to understand his/her rights, the authority should respond to the child rather than to the parent.
Subject Access Requests are different from Freedom of Information requests. The SAR relates to personal data. The authority must be able to distinguish which category, irrespective of what the requester has called it. Sometimes the authority will separate the request into two, one for personal data under DPA and the other for non-personal information made under FOI, because information released under FOI is available to the world at large. The Data Protection Act 1998 does not permit authorities to exclude information in response to a SAR merely because it is difficult to access.
One of the easiest ways to make a SAR is to put the name of your council + "Subject Access Request" into an internet search engine. Read what the Information Commissioner says about SARs here
You may be able to complete the SAR online or download the template letter from the Information Commissioner
The authority may ask you for information it reasonably needs to comply with the request, not to narrow the scope of the request but to provide additional details to help locate the required information. The authority is allowed to ask for information about the context of in which information about them may have been processed and about the likely dates when processing occurred. You do not have to wait for your authority to ask before supplying this information and some people have found that volunteering this information at the outset greatly speeds up the processing of the SAR and pre-empts the possibility of the authority's omitting to search in the correct areas.
Authorities should have procedures in place to find and retrieve personal data which has been electronically archived or backed up, but this will be accessed much more easily if you provide any relevant location information to the authority when you first make the request. The purpose of subject access is to enable individuals to find out what information is held about them, to check the accuracy of that information and ensure that it is up to date, and where information is incorrect, to request correction of the information or compensation where inaccuracies have caused them damage or distress. Where the authority has deleted the information it can no longer be used to make decisions affecting the individual and any inaccuracies can have no effect as the information will not be accessed by anybody.
The contents of an email should not be regarded as deleted merely because the email in question has been moved to a user’s "Deleted items" folder. The right of subject access is not limited to the personal data to which it would be "reasonable" for the authority to provide access. Subject to certain exemptions, the authority must provide subject access to all personal data it holds, regardless of how difficult it is to find. The authority cannot refuse to comply with a SAR on the basis that it would involve disproportionate effort simply because it would be costly and time consuming to find the requested personal data held in archived emails.
The authority is only obliged to provide personal data in response to a SAR if it is a data controller in respect of that data. In the majority of cases, therefore, the authority does not have to supply personal data if it is stored on someone else’s computer systems rather than its own with the obvious exception being where that person is a data processor. The Information Commissioner says it is good practice to have a policy restricting the circumstances in which staff may hold information in private email accounts. Some organisations enable staff to access their systems remotely (eg via a secure website), but most are likely to prohibit the holding of personal data on equipment which the organisation does not control. Nevertheless, if the authority does permit staff to hold personal data on their own devices, they may be processing that data on the authority's behalf, in which case it would be within the scope of a SAR.
The DPA specifies that a SAR relates to the data held at the time the request was received. ICO says is not acceptable for the authority to amend or delete the data if the authority would not otherwise have done so and for organisations subject to the Freedom of Information Act (FOIA), it is an offence to make such an amendment with the intention of preventing its disclosure.
The authority cannot refuse to provide subject access to personal data about an individual simply because it obtained that data from a third party. The rules about third party data apply only to personal data which includes information about the individual who is the subject of the request and information about someone else. The authority may delete names or edit documents if the third party information does not form part of the requested information. The DPA does not define "disproportionate effort" but qualification to the right of subject access only applies in respect of "supplying" a copy of the relevant information in permanent form so the authority cannot refuse to deal with a SAR just because it thinks that locating the information in the first place would involve disproportionate effort. If challenged, the authority must be prepared to defend its decision to apply an exemption, to the Information Commissioner’s Office or a court.
There are special rules which apply where providing subject access to information about social services and related activities would be likely to prejudice the carrying out of social work by causing serious harm to the physical or mental health or condition of the requester or any other person. These rules are set out in the The Data Protection (Subject Access Modification) (Social Work) (Amendment) Order 2011, and their effect is to exempt personal data processed for these purposes from subject access to the extent that its disclosure would be likely to cause such harm. There is a further exemption from subject access to social work records which applies in cases where a SAR is made by a third party who has a right to make the request on behalf of the individual, such as the parent of a child or someone appointed to manage the affairs of an individual who lacks capacity. In these circumstances, personal data is exempt from subject access if the individual (for example the child) has indicated that they do not want it to be disclosed to that third party.
If at first you don't get all the data you believe is held by the organisation, you can send a follow up request. The Information Commissioner has a template letter here
Information from a School
Parents ONLY have a legal right to obtain their child's educational record from a MAINTAINED school, NOT from an academy. The educational record covers information that comes from a teacher or other employee of a local authority or school, the pupil or you as a parent, and is processed by or for the school’s governing body or teacher, except for information the teacher has solely for their own use. So it will cover information such as the records of the pupil’s academic achievements as well as correspondence from teachers, local education authority employees and educational psychologists engaged by the school’s governing body. ( More)
If the school is an academy, the family will have to go down a different route.
A pupil, or someone acting on their behalf, may make a SAR in respect of personal data held about the pupil by the school. If the school is in England or Wales the SAR should be dealt with by the school. The pupil's right of subject access under the DPA is separate from the parent's right of access to their child's "educational record."
"Educational record" has a wide meaning and includes most information about current and past pupils that is processed by or on behalf of a school. If a SAR is made for information containing, in whole or in part, a pupil’s "educational record", a response must be provided within 15 school days and the maximum amount that may be charged for dealing with the request depends upon the number of pages of information which are to be supplied. The Information Commissioner says that if the PUPIL asks for their OWN educational record, "it depends on the number of pages provided. For example, 1 to 19 pages will cost £1.20; 29 pages will cost £2, and so on, up to a maximum of 500+ pages which will cost £50. If the request is for other information excluding the educational record then the maximum charge is £10."