SAR and The Education (Pupil Information) (England) Regulations 2005

[MrBitey]

Hi all,

 

I'm getting my head around a SAR workflow/procedure for our school and I'm interested in the difference in time we will have to get information together under GDPR and the The Education (Pupil Information) (England) Regulations 2005.

Under GDPR it is one month. Under the The Education (Pupil Information) (England) Regulations 2005 it is stated that "the governing body shall make a pupil’s educational record available for inspection by the parent, free of charge, within fifteen school days of receipt of the parent’s written request for access to that record."

 

Now I guess the information we would need to get together for a SAR includes stuff which is not part of the child's educational record (ie info about payments, lateness, behaviour etc). Do GDPR supersede this or should we hand over the Educational record stuff first and the rest after? Maybe we should stipulate two different timescales for different types of info? Just go with 15 days for everying unless it's an extra complicated request?

 

What do you think?

 

MrB

[pubgrub277]

as an example, If someone makes a request but doesn't explicitly say its FOI for instance, I think you're not obliged to respond etc.

 

I would apply the time scale relevant to the request being made ie if the parent requests details sighting SAR as the reason 30 days applies. If they sight The Education (Pupil Information) (England) Regulations 2005 the 15 days applies.

 

Unless I'm missing soemthing?

[jdoyle]

as an example, If someone makes a request but doesn't explicitly say its FOI for instance, I think you're not obliged to respond etc.

 

I would apply the time scale relevant to the request being made ie if the parent requests details sighting SAR as the reason 30 days applies. If they sight The Education (Pupil Information) (England) Regulations 2005 the 15 days applies.

 

 

FoI/subject access doesn't need to be mentioned when making a request. The person requesting may even cite the wrong legislation. The onus is on the receiving organisation to handle the written (letter,email,social media, fax) request appropriately.

 

Page 60 onwards may be of interest re DPA and Educational Records

https://ico.org.uk/media/for-organisations/documents/2014223/subject-access-code-of-practice.pdf

[MrBitey]

Thanks - that's a really useful document... This answers my question: 'If a SAR is made for information containing, in whole or in part, a

pupil’s ‘educational record’, a response must be provided within 15 school days.'

[enjay]

What is their "educational record"? If we run the person data output report (or whatever it is called) in SIMS, would that cover it?

[MrBitey]

Well the same document states this:

"The statutory definition of ‘educational record’ differs between England and Wales, Scotland and Northern Ireland. Broadly speaking, however, the expression has a wide meaning and includes most information about current and past pupils that is processed by or on behalf of a school. However, information kept by a teacher solely for their own use does not form part of the educational record. It is likely that most of the personal information a school holds about a particular pupil will form part of the pupil’s educational record."

So sounds like pretty much all the info we have recorded on our 'official' systems and forms. So SIMS, any Pupil Progress data, IEPs etc...

[enjay]

Well the same document states this:

"The statutory definition of ‘educational record’ differs between England and Wales, Scotland and Northern Ireland. Broadly speaking, however, the expression has a wide meaning and includes most information about current and past pupils that is processed by or on behalf of a school. However, information kept by a teacher solely for their own use does not form part of the educational record. It is likely that most of the personal information a school holds about a particular pupil will form part of the pupil’s educational record."

So sounds like pretty much all the info we have recorded on our 'official' systems and forms. So SIMS, any Pupil Progress data, IEPs etc...

 

So, we need everything in SIMS and the linked documents within 15 days, but any files in a teacher's Google Drive or Mail in 30 days. Yes?

[GrumbleDook]

We are waiting to see if the DP Bill updates EPIER at all to be in line and consistent.

 

Remember the use of the phrase 15 school days ... you operate to whichever is the shorter. In the school hols, should a SAR come in then you are not counting days under EPIER, but you are under GDPR.

 

I’m hoping some common sense will prevail here.