SAR from USA

[enjay]

So, we've had our first SAR and it is a fiddly one (not that there is an easy SAR!) because the person lives in the USA. Do we need to do anything different in terms of how we send them the information due to it leaving the EEA?

[Steve21]

Not sure why it would make any difference really. It's being given to the subject who's requesting it (I'd assume electronically?), and I'm guessing they must have been/or are an EU resident in regards to being at your school in the first place?

 

It'd be different if it's going to an external company but if it's to the subject where they live currently shouldn't make any difference.

 

Steve

[enjay]

Also, parents are divorced. We are obtaining the student's permission to share information, do we also need the consent of the resident parent?

 

Also, also - the SAR includes copies of emails between ex-spouse/resident parent and the school. Do we need ex-spouse/resident parent's permission to include those emails in the SAR to the other parent?

[enjay]

Not sure why it would make any difference really. It's being given to the subject who's requesting it (I'd assume electronically?), and I'm guessing they must have been/or are an EU resident in regards to being at your school in the first place?

 

The request has come from the parent of one of our students. I don't know their nationality status. They are asking for their child's educational record as well as information relating to a specific incident.

[Edutech98]

You wouldn't normally require the consent of the resident parent providing there is not a court order in place that says so. You might request the non-resident parent to prove they have parental responsibility though (presuming its dad and not mum) and prove they are who they say they are.

 

If the emails include some one else's personal data that you can exempt these from the SAR. You can normally just annonymise the data to remove the other person's personal information but there would be little point in this case as the person would obviously know who the emails are to. Unless of course the resident parent agrees for the emails to be released

[Steve21]

Then it's not really a SAR request in that sense. SAR is for personal information being held on said person.

 

Parent's already have a right to educational records aside of SAR requests.

 

And in regards to the emails, if it's not linked to a students personal information it wouldn't be available via a SAR anyway unless something else is in that story?

 

Steve

[enjay]

You wouldn't normally require the consent of the resident parent providing there is not a court order in place that says so. You might request the non-resident parent to prove they have parental responsibility though (presuming its dad and not mum) and prove they are who they say they are.

 

We know they have parental responsibility (although I don't know if they have actually proved this). Identity has been confirmed as we have spoken to them on known telephone numbers and email address.

 

If the emails include some one else's personal data that you can exempt these from the SAR. You can normally just annonymise the data to remove the other person's personal information but there would be little point in this case as the person would obviously know who the emails are to.

 

The email address itself (and other information) would be redacted before sending.

[enjay]

Then it's not really a SAR request in that sense. SAR is for personal information being held on said person.

 

Why is it not an SAR? They are asking for personal information, just limiting what - i.e. they don't want to see all their French grades but do want to see information relating to how we handled a specific incident.

[Rob_D]

Why is it not an SAR? They are asking for personal information, just limiting what - i.e. they don't want to see all their French grades but do want to see information relating to how we handled a specific incident.

I think the point is that you can't make a SAR request for someone else (as far as I'm aware). The way I read the information presented here, it sounds like a parent is trying to make a SAR for their child.

[Steve21]

Because it depends on the situation with the type of school and parents etc, if for example it's a maintained school in england all parents have a legal right to the educational records anyway. Academies/Free schools are different and don't have to give anyone that information unless they want to.

 

But if the student is over 12~ it's not the parents data to request under SARs as it's the students right to do so (but again Educational records are different)

 

But with both cases, if an email from a parent is recorded on a parental contact of a student that isn't personal info to said student

 

Steve

[Edutech98]

A parent can make a SAR for their child if the child consents, or if the child does not yet have the capacity to understand...

 

https://ico.org.uk/your-data-matters/schools/pupils-info/

[enjay]

Person with parental responsibility is requesting a copy of the educational record and details of a particular incident. I don't know the full ins and outs of what we must/can/can't share, but Headteacher has asked us to comply so I'm working on the premise it is okay to share, even if as an Academy we don't have to. Broadly speaking, we want to accommodate the request but need to make sure we do so in a way which doesn't breach GDPR.

 

The child is over 12, so their consent is being obtained. Staff are already aware any of their emails/documents may be shared in this way, but we're not sure if we need the other parent's consent to share emails they have sent on the matter.

[Steve21]

My point I was trying to make is you're talking about two different bits there, how an incident is handled e.g. a bullying scenario and how teachers dealt with it isn't personal information (therefore not requestable via a SAR), it can't identify the person, it's not linked to their behaviour record blahblah.

 

But as I feel you really just want an answer regarding the email part, basically this is it:

 

https://ico.org.uk/media/for-organisations/documents/2014223/subject-access-code-of-practice.pdf

 

Page 37+ But the short version is "any" third-party information that can identify a person should aim to get consent from them, if you're disclosing this without consent, you need to look at the reason why and whether it could be anonymised (without people being able to work out who it was from the rest of it, so probably not in your case), based on that it's then down to you to make the decision whether it's allowed etc

 

Steve

[Ditto]

A parent can make a SAR for their child if the child consents, or if the child does not yet have the capacity to understand...

https://ico.org.uk/your-data-matters/schools/pupils-info/

 

Does anyone else find it a surprise the right for children at maintained schools is different for those at academy/free schools?

[enjay]

Does anyone else find it a surprise the right for children at maintained schools is different for those at academy/free schools?

 

Yes. I suspect it is a rule which made sense when the two flavours of school were "state maintained" or "independent" and hasn't been updated.