If you want to find out what information the local authority holds on your child including what has been said to social services about your child or what has been discussed in meetings or via email, you can make what is called a Subject Access Request to your local council under section 7 of the Data Protection Act. The authority must act on the SAR within one month of receiving it.
GDPR
The GDPR provides the following rights for individuals:
The right to be informed
The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling.Organisations have to provide individuals with information about the purposes of data processing, the recipients or categories of recipient receiving shared personal data; the retention period for storing the personal data or criteria for determining how long it will be stored; the existence of their right to request rectification, erasure or restriction or to object to such processing; the right to lodge a complaint with the ICO or another supervisory authority; information about the source of the data, where it was not obtained directly from the individual; the existence of automated decision-making (including profiling)
An individual can make a subject access request verbally or in writing. It can also be made to any part of the organisation (including by social media) and does not have to be to a specific person or contact point. A request does not have to include the phrase ‘subject access request’ or Article 15 of the GDPR, as long as it is clear that the individual is asking for their own personal data. Standard forms can make it easier for the individual to include all the details the organisation might need, but a subject access request is valid if it is submitted by any means, so the organisation must make it clear that it is not compulsory and must not try to use this as a way of extending the one month time limit for responding.
In most cases the organisation cannot charge a fee to comply with a subject access request. If the organisation processes a large amount of information about an individual it can ask them for more information to clarify their request but it should only ask for information that it reasonably needs to find the personal data covered by the request.
Even if a child is too young to understand the implications of subject access rights, it is still the right of the child rather than of anyone else such as a parent or guardian. So it is the child who has a right of access to the information held about them, even though in the case of young children these rights are likely to be exercised by those with parental responsibility for them. Before responding to a subject access request for information held about a child, the organisation should consider whether the child is mature enough to understand their rights. If it is confident that the child can understand their rights, then it should usually respond directly to the child. It may, however, allow the parent to exercise the child’s rights on their behalf if the child authorises this, or if it is evident that this is in the best interests of the child.
Subject Access Requests are different from Freedom of Information requests. The SAR relates to personal data. The authority must be able to distinguish which category, irrespective of what the requester has called it. Sometimes the authority will separate the request into two, one for personal data under DPA and the other for non-personal information made under FOI, because information released under FOI is available to the world at large. The Data Protection Act 1998 does not permit authorities to exclude information in response to a SAR merely because it is difficult to access.
There are special rules which apply where providing subject access to information about social services and related activities would be likely to prejudice the carrying out of social work by causing serious harm to the physical or mental health or condition of the requester or any other person.
There is a further exemption from subject access to social work records which applies in cases where a SAR is made by a third party who has a right to make the request on behalf of the individual, such as the parent of a child or someone appointed to manage the affairs of an individual who lacks capacity. In these circumstances, personal data is exempt from subject access if the individual (for example the child) has indicated that they do not want it to be disclosed to that third party.
Information from a School
Read what the Information Commissioner’s Office [ICO] says about information from a school here.