Exam Boards - Data Processor vs Data Controller.

[psydii]

I'd been working on the assumption that from a school's point of view they are Data Processors - and so there should be a contractual agreement for the Data Processing.

 

But they are also (obviously) data controllers once students hand over their exam scripts for marking, and to EBs the school's are Data Processors in receipt of the student data (their results).

 

 

To paraphrase the exam board stance: As an awarding organisation recognised by Ofqual, exam boards have certain statutory obligations in respect of their functions; as such, it is the data controller rather than the data processor of personal data it holds. Therefore, they are not required to set down all of our processing and privacy activities.

Yet it is the school (a data controller) who choses the exam board and chooses to share the data with boards for the purposes of student taking the examinations directed by the school. Does this makes the school the controller and the exam board the processor, at least until the students hand their scripts over to be marked?

 

Are we both controllers and processors? Has anyone seen guidance / data sharing agreements that clears this up?

 

Have I missed something obvious?

[Bigbird7]

I was pondering on exactly this yesterday and came to the same conclusion that the school is the controller as they are the ones who instigate the processing. It could be argued that you and the exam boards are joint controllers.

 

I don’t get the statement that as a controller they don’t have to document their activities, they clearly don’t understand the requirements!