Freedom of Information request

[enjay]

Probably true, so what do you suggest? By that measure, we couldn't set out-of-office messages saying "I'm on holiday, if your email relates to an SAR, please email sar@ instead", which leaves us what? Require all staff to check their emails weekly?

[pcstru]

Probably true, so what do you suggest? By that measure, we couldn't set out-of-office messages saying "I'm on holiday, if your email relates to an SAR, please email sar@ instead", which leaves us what? Require all staff to check their emails weekly?

Personally, I would suggest just trying to be reasonable. Staff should be aware that if they do receive a request, who they need to pass it on to. If you have a communications policy, that might well recommend or require staff to set an appropriate "out of office" notification. Your FOI policy & published information can certainly guide people as to how they can make a request (but it cannot demand). All of that could be helpful if a complaint were made.

 

Someone making a request by sending it to a cleaner who they know does not speak English via email which is never checked, isn't going to be rewarded by having an organisation hung out to dry. Their complaint is likely to result in the request simply landing with the correct person and the organisation then being allowed a fair chance to respond to it.

[Hunter]

I would suggest contacting the senior management before handing over any Data to do with schooling. I would not respond directly to the email myself but as others have responded above, place some figures on your school site. Most importantly go up the managerial chain to cover yourself and the school.

[enjay]

I would suggest contacting the senior management before handing over any Data to do with schooling. I would not respond directly to the email myself but as others have responded above, place some figures on your school site. Most importantly go up the managerial chain to cover yourself and the school.

 

I've only received a handful of FOI requests, and each time I checked with the HT before responding - aside any a$$ covering, it also saved me some work as HT said to refuse one of them.

[Hunter]

I've only received a handful of FOI requests, and each time I checked with the HT before responding - aside any a$$ covering, it also saved me some work as HT said to refuse one of them.

 

'if in doubt, ask the boss'

[howartp]

My understanding from the GDPR docs/guides I’ve read somewhere was that the contact details for all SAR requests HAD TO be published in your shiny new GDPR privacy policy?

 

If so, set that to a mailing list that includes enough key individuals to ensure (with reasonable certainty) that someone will be working at the time it’s received?

[crispybits]

It's not quite that simple howartp, GDPR also states that a SAR can be made to anyone at any time and by any (reasonable) method. I don't know if it could be enforced or not but a parent bumping into a teacher on holiday in Spain at the start of the summer holidays and asking for some information on their child would technically count as a SAR being raised. OK that's an extreme example and probably not one the ICO would strictly enforce, but a parent emailing a teacher on the first day of the summer holidays would definitely count, regardless if that's not the email address you specify on your SAR policy/website.

[elsiegee40]

It's not quite that simple howartp, GDPR also states that a SAR can be made to anyone at any time and by any (reasonable) method.

And that’s where the law is stupid. And I think some people are getting too hung up on it.

 

You cannot expect a 3 day turn round when people are entitled to have holiday and be off sick without being required to do work. The law doesn’t say everyone must work 365 days a year.

 

I think, legally, an out of office saying “this email will not be checked until dd/mm/yy , please contact the school office info(at)school.sch.uk” would be seen as a reasonable redirect for such requests as long as the redirect is monitored every day.

 

Not having that out of office would be negligent

Edited October 27, 2017 by elsiegee40

[enjay]

by any (reasonable) method ... a parent bumping into a teacher on holiday in Spain at the start of the summer holidays ... would technically count as a SAR being raised

 

You and I have very different definitions of reasonable!

[mavhc]

It's as if the whole thing was cobbled together with no thought about how it would be possible to implement

[DrCheese]

Indeed. Subject Access Requests too, which could be "interesting" if someone were to email a term-time-only admin person during the summer break. We might already have failed before we even know about the request! It has been suggested we could put a "subject access request policy" on our website saying all requests must be sent to a particular email address - unsure whether that would actually cover us, though. Does anyone here know that?

 

Training course I went on for GDPR (Groupcalls aimed at schools) said realistically, the ICO wouldn't kick up a fuss if a request was sent on the 1st of August and nothing was done about it until the school returned, as it would be considered unreasonable to expect the school to pull in all the needed staff from holidays and so on (Not to mention unions going nuts). The requester could kick up a fuss but nothing much would come of it.

[sparkeh]

So we have had this FoI request now and are preparing to answer it.

 

Just checking. A lot of the info is already in the public domain so is is acceptable to say something like "Number of pupils on roll: information available on LA website here: http://xxx" "Number of male teachers: available from school website here: http://xxx" etc

[crispybits]

As far as I know (and of course I am not a lawyer) signposting to already published information is fine as long as it's relatively straightforward to access (as in give them the links directly to the relevant pages rather than the school website homepage maybe... it achieves the goal of making them work for their supper without being really obstructive...)

[sparkeh]

So just looking at the ICO guidance on what a valid request is and it must:

• include an address for correspondence. This need not be the person’s residential or work address – it can be any address at which you can write to them, including a postal address or email address;
  

The request has no such thing as far as I can see, apart from a noreply@ address and a link to submit your responses.

So, if I can't get a response from that email, what do you do as its not a valid request?

I think its reasonable not to follow unknown links in emails from people unknown to the school?

[sparkeh]

Just spoken to ICO and they are aware of this request and are investigating. Their advice is to reply to email address provided stating that we need a valid address to correspond with (and see if we get a response) and that we will not be following the link in the email due to security concerns.

 

HTH

[Banjo]

So we have had this FoI request now and are preparing to answer it.

 

Just checking. A lot of the info is already in the public domain so is is acceptable to say something like "Number of pupils on roll: information available on LA website here: http://xxx" "Number of male teachers: available from school website here: http://xxx" etc

 

I've tend to use this for FOI's like Q2 "This information is currently in the public domain - https://www.gov.uk/government/organisations/department-for-education/about/statistics"

 

Where I don't have what they are after "The council has no electronic or hard copy of the information requested" > and if part b of the question is why we don't collect that information then > "The council has no electronic or hard copy of the information requested"

 

I also tend to screenshot (photo) the responses and submit them as a .pdf rather than in any Excel template provided by the requestor, ensuring that it is clear and legible.

 

6. What do you do to obtain details of all parents?

• There is no policy in place to obtain a missing parents details
  
• Request details of all parents in registration form
  
• Ask the registered parent(s), verbally or in writing.
  
• Ask parents to fill in a data collection sheet each year.
  
• Request a copy of the child's birth certificate
  
• Wait for the “absent” parent to contact the school
  
• o Keep an "Absent Parent Register" (missing parents can receive information if they provide SAEs)
  

 

My response to Q6 would be "The school has no electronic or hard copy of the information requested" if it wasn't written down in a policy document.

Edited November 9, 2017 by Banjo

[mavhc]

I also tend to screenshot (photo) the responses and submit them as a .pdf rather than in any Excel template provided by the requestor, ensuring that it is clear and legible.

 

Interesting way to troll them

[JJonas]

I was curious about who sent your foi request so...

 

Whois lookup on the domain gave me a registrants name

 

Google search on name + foi led to numerous foi requests and the name of a charity supporting divorced fathers

 

that led me to the groups Facebook page and ultimately to what I believe to be the registrants personal Facebook

 

#thatwasfun #notastalker #honest

Edited November 9, 2017 by JJonas

[sparkeh]

Just an update - I emailed the noreply@ address and got an auto response telling me to use the website contained in the email.

Therefore I can safely class this as not being a valid request.

[Banjo]

Interesting way to troll them

 

We get about 1 a day to deal with. Most are just too lazy to look the information up themselves thats already been published, others are journalists spamming everyone for a response so they can put a % into their next article.

[enjay]

We get about 1 a day to deal with.

 

Really? I don't even get 1 per year! So either we're less high profile than you, or our reception staff aren't forwarding on emails they should be. That said, the particular request which prompted this thread shouldn't be sent to IT anyway, so maybe we did get it and it was forwarded to someone else.

[pete]

We get a couple a month via email, mostly journalists or advocacy groups looking for data to support their argument.

 

We have foia@ and dataprotection@ email addresses that are copied to a distribution group. We also have transport rules that check the main enquiries@ mailbox for things that look like FOIA requests and CC's them to same distribution group (finance director, IT, school administrator).

 

NB: if you do the above, your LA probably has something about the FOIA in their default email footer - make sure you exclude that specific wording in your rule.

[enjay]

We also have transport rules that check the main enquiries@ mailbox for things that look like FOIA requests and CC's them to same distribution group (finance director, IT, school administrator).

 

Interesting idea. What words/phrases trigger the transport rule?

[pete]

Interesting idea. What words/phrases trigger the transport rule?

 

Any of the following phrases from external senders:

 

environmental information regulations

FOI request

FOIA request

Freedom of Information

Freedom of Information Act

Subject Access Request

 

unless any of the following phrases are in the email:

 

"The information contained in this email may be subject to public disclosure under the Freedom of Information Act 2000"

"[email protected]"

 

(which is in a *lot* of corporate / LA email signatures).

 

The signal/noise ratio is pretty good and it catches requests from anyone considerate enough to explicitly point out it's a FOIA request in the subject or message body.

[JATSO]

Had this FOI request today:

 

I am researching the costs associated with safeguarding students in line with the Department for Education's "Keeping Children Safe In Education" guidance and the Home Office's "Prevent" legislation. I hope that you will be able to help by providing the following information:

 

1. Which web filtering product does the school use? (e.g. Smoothwall Secure Web Gateway, Smoothwall UTM, RM Safetynet, Lightspeed Web Filter, etc.)

 

2. Is your web filtering system purchased directly by the school or provided by the LEA?

 

3. Does your web filtering system run on a server on the school's premises, or is it hosted off-site? (In the cloud, at the LEA's data centre, etc.)

 

4. What is the total duration of your web filtering contract? (e.g. 1 year, 3 years, etc.)

 

5. What is the total amount paid by the school for the web filtering system over your whole contract period? (i.e. If you had answered question 4 as "3 years" and pay £1000 per year, the answer to this question would be £3000.)

 

6. Do the costs quoted in question 5, include anything besides web filtering? (e.g. that cost may also include the internet connection itself, or other services, in addition to the actual filtering product.)

 

7. If your filtering system is hosted on the school's premises, do the costs quoted in question 5 include the hardware that the filtering software runs on? (When an existing filtering contract is renewed, schools can often choose not to replace the existing hardware. In that case, the answer would be "no.")

 

8. What speed of internet connection does the school have?

 

9. How many students does the school have?

 

10. How many staff does the school have?

 

11. What year did your current filtering contract begin? (this helps me evaluate how the costs have changed over time for long contracts).

 

Thank you very much for your time.

 

Yours faithfully,

 

The website used to send the request was:

https://www.whatdotheyknow.com/

 

Electra the author of the request has sent this to 440 schools, when I look at who has replied some have and some haven't the only one that bothers me is Number 5, I thought the costs should be between the school and the supplier not every tom dick and harry.