Making a Subject Access Request
The Local Authority
If you want to find out what a school has said to the council about your child, or what has been said to social services about your child or what meetings have been held to discuss your child, you can make what is called a Subject Access Request to your local council under section 7 of the Data Protection Act. The authority must act on the SAR within one month of receiving it.
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling.
Organisations have to provide individuals with information about the purposes of data processing, the recipients or categories of recipient receiving shared personal data; the retention period for storing the personal data or criteria for determining how long it will be stored; the existence of their right to request rectification, erasure or restriction or to object to such processing; the right to lodge a complaint with the ICO or another supervisory authority; information about the source of the data, where it was not obtained directly from the individual; the existence of automated decision-making (including profiling)
An individual can make a subject access request verbally or in writing. It can also be made to any part of the organisation (including by social media) and does not have to be to a specific person or contact point. A request does not have to include the phrase 'subject access request' or Article 15 of the GDPR, as long as it is clear that the individual is asking for their own personal data. Standard forms can make it easier for the individual to include all the details the organisation might need, but a subject access request is valid if it is submitted by any means, so the organisation must make it clear that it is not compulsory and must not try to use this as a way of extending the one month time limit for responding.
In most cases the organisation cannot charge a fee to comply with a subject access request although "where the request is manifestly unfounded or excessive you may charge a “reasonable fee” for the administrative costs of complying with the request." If the organisation processes a large amount of information about an individual it can ask them for more information to clarify their request but it should only ask for information that it reasonably needs to find the personal data covered by the request.
Even if a child is too young to understand the implications of subject access rights, it is still the right of the child rather than of anyone else such as a parent or guardian. So it is the child who has a right of access to the information held about them, even though in the case of young children these rights are likely to be exercised by those with parental responsibility for them. Before responding to a subject access request for information held about a child, the organisation should consider whether the child is mature enough to understand their rights. If it is confident that the child can understand their rights, then it should usually respond directly to the child. It may, however, allow the parent to exercise the child’s rights on their behalf if the child authorises this, or if it is evident that this is in the best interests of the child.
Subject Access Requests are different from Freedom of Information requests. The SAR relates to personal data. The authority must be able to distinguish which category, irrespective of what the requester has called it. Sometimes the authority will separate the request into two, one for personal data under DPA and the other for non-personal information made under FOI, because information released under FOI is available to the world at large. The Data Protection Act 1998 does not permit authorities to exclude information in response to a SAR merely because it is difficult to access.
There are special rules which apply where providing subject access to information about social services and related activities would be likely to prejudice the carrying out of social work by causing serious harm to the physical or mental health or condition of the requester or any other person. These rules are set out in the The Data Protection (Subject Access Modification) (Social Work) (Amendment) Order 2011, and their effect is to exempt personal data processed for these purposes from subject access to the extent that its disclosure would be likely to cause such harm. There is a further exemption from subject access to social work records which applies in cases where a SAR is made by a third party who has a right to make the request on behalf of the individual, such as the parent of a child or someone appointed to manage the affairs of an individual who lacks capacity. In these circumstances, personal data is exempt from subject access if the individual (for example the child) has indicated that they do not want it to be disclosed to that third party.
Information from a School
Parents ONLY have a legal right to obtain their child's educational record from a MAINTAINED school, NOT from an academy. The educational record covers information that comes from a teacher or other employee of a local authority or school, the pupil or you as a parent, and is processed by or for the school’s governing body or teacher, except for information the teacher has solely for their own use. So it will cover information such as the records of the pupil’s academic achievements as well as correspondence from teachers, local education authority employees and educational psychologists engaged by the school’s governing body. ( More)
If the school is an academy, the family will have to go down a different route.
A pupil, or someone acting on their behalf, may make a SAR in respect of personal data held about the pupil by the school. If the school is in England or Wales the SAR should be dealt with by the school. The pupil's right of subject access under the DPA is separate from the parent's right of access to their child's "educational record."
"Educational record" has a wide meaning and includes most information about current and past pupils that is processed by or on behalf of a school. If a SAR is made for information containing, in whole or in part, a pupil’s "educational record", a response must be provided within 15 school days and the maximum amount that may be charged for dealing with the request depends upon the number of pages of information which are to be supplied. The Information Commissioner says that if the PUPIL asks for their OWN educational record, "it depends on the number of pages provided. For example, 1 to 19 pages will cost £1.20; 29 pages will cost £2, and so on, up to a maximum of 500+ pages which will cost £50. If the request is for other information excluding the educational record then the maximum charge is £10."