Cat’s out of the bag - student requesting parent blocked from accessing their data

[Areku]

So I've had a request from a student to block a parent from accessing their data.

having checked the students age and if the student understands the consequences of the request, I've had to abide by the students decision.

(also ran it though the council, who agreed).

 

Now i wait to see if any other students get the same idea.

 

(although in this case there was legitimate reason for the student)

 

**edit** only one parent, not both so CP is still covered

Edited July 19, 2018 by Areku

[djrscally]

Nope. The law says a parent has the right to see the Education records of their child (or any other child for whom they have parental responsibility). Regardless of the GDPR, the answer is no.

 

EDIT: Unless the kid is informing you a court has ordered the parent not have access in which case yes, but without a court order no.

[Hiccup121]

As far as I know, safeguarding and parental requests to view data top trump GDPR when it comes to viewing their own children's data.

[Areku]

ok should have added, its only one parent, not both, CP isnt an issue.

[jcollings]

https://ico.org.uk/your-data-matters/schools/pupils-info/

 

This makes interesting reading.

[djrscally]

To elaborate on my previous answer, it's guided by this section in the guidance from the DofE on Parental Responsibility:

 

For example: a non-resident parent who has limited contact with their children, contacts the school to find out how well they did in their exams. Neither the children nor the resident parent wishes to share that information and informs the school of this. The school refuses to release the information on the basis that the children are sufficiently mature to have control over their personal information. The school has therefore breached education law by failing to provide information to which the non-resident parent is entitled.

 

tl;dr Data Protection legislation does not enable kids to cut their parents off from access to their school records. Only a court order does that.

 

EDIT: and to further expound, the Data Protection Act 2018 amends the regulations that are behind the above guidance only to replace references to the DPA 1998 with the GDPR, so I see not reason why the above guidance should not still stand.

Edited July 19, 2018 by djrscally

[Areku]

Interesting, ill raise it with our local councils data protection team, as they are the ones who said to block access.

[djrscally]

Interesting, ill raise it with our local councils data protection team, as they are the ones who said to block access.

 

See slight edit above; I checked the DPA 2018 and it makes no qualitative amendment to the regulations that are behind the above guidance.

 

I would be interested to see the council's response!

[elsiegee40]

This is exactly the situation our friend Brian Maloney has been sending FoI requests about (remember this?)

 

Non resident parents have the same rights as resident parents to see a student’s education record. A student cannot use GDPR to prevent parents from seeing it.

[Areku]

I've had a reply from the council, i specifically ask them about the students school record, that the parent is a non resident, and queried the non resident parental responsibility.

And they have replied with the same thing, because of the students age, (over 13) then it is his/her right to block the parent.

 

It would seem my local council has a different opinion..

[David44]

Forgetting about the legal aspect for a moment, how did you achieve this at a technical level? What system does the school use to display student information to parents? How did you make sure that the parent doesn't receive texts or emails from the school?

 

Did you just remove parental responsibility from the parents record?

[localzuk]

I think your council is reading the law wrong here - they don't appear to be taking into account the school's duties under the Education Act. Maybe they think GDPR overrules that act?

[atcoates]

I think your council is reading the law wrong here - they don't appear to be taking into account the school's duties under the Education Act. Maybe they think GDPR overrules that act?

It is quite worrying reading all the GDPR related threads and the conflicting information that's going around.

[Areku]

Forgetting about the legal aspect for a moment, how did you achieve this at a technical level? What system does the school use to display student information to parents? How did you make sure that the parent doesn't receive texts or emails from the school?

 

Did you just remove parental responsibility from the parents record?

 

No, schools MIS record is left as is, we use another system to publish to parents, for now the link between the parent and student has been disabled.

 

this rabbit hole is getting worse >.<

[localzuk]

It is quite worrying reading all the GDPR related threads and the conflicting information that's going around.

At least solicitors will be getting plenty of business soon hey...

[atcoates]

At least solicitors will be getting plenty of business soon hey...

Another time I find myself in the wrong business!!!

[elsiegee40]

I've had a reply from the council, i specifically ask them about the students school record, that the parent is a non resident, and queried the non resident parental responsibility.

And they have replied with the same thing, because of the students age, (over 13) then it is his/her right to block the parent.

 

It would seem my local council has a different opinion..

@GrumbleDook will know about non resident parents and the education act. Let’s hope he’s not too busy to see the tag

[djrscally]

I've had a reply from the council, i specifically ask them about the students school record, that the parent is a non resident, and queried the non resident parental responsibility.

And they have replied with the same thing, because of the students age, (over 13) then it is his/her right to block the parent.

 

It would seem my local council has a different opinion..

They're wrong. This one isn't really even a maybe in my mind. Did you send them the guidance file that I linked? It's pretty clear about this exact situation.

 

EDIT: doubling down because I've already had this exact situation and told them no

 

 

Double Edit: The GDPR says the right to object is only applicable to processing carried out under bases (e) and (f) of Article 6 of the GDPR (the bit that defines when processing is lawful). Supplying an education record to a parent is a legal obligation (under the Education (Pupil Information) Regulations 2005), which is base © of Article 6, so the right to object under the GDPR is just not applicable in this situation. Saying that the kids age is relevant in deciding the issue implies they think you're relying on consent to carry out the processing (I.E. send the info to the other parent), but you're not - you're fulfilling a legal obligation.

 

Yeah, they're wrong.

Edited July 19, 2018 by djrscally

[GrumbleDook]

The OP has said that there is a legitimate reason for this request and it has been upheld, and this is a perfect example of a school taking into account situations, making decisions, getting them checked and sticking to them.

 

It would be done on a case by case basis and it would have to be justified. Just because the school has said yes in this one instance it *does not* mean they will say yes for others.

 

That said, when I posed this to one of the Data Protection groups the following came back pretty sharp from a member in Leics.

 

"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/489901/Parental_Responsibility_Advice_for_School_January_2016.pdf

Page 8 of the document linked above suggests other legislation overrides the wishes of your student:-

Under The Education (Pupil Information) (England) Regulations 2005, schools are required to provide access to, or copies of a child’s educational record to parents upon request. Therefore, if the school were to abide by the request of the natural parent they would be in breach of their obligations under education law.

To note: under the principles of the Data Protection Act 1998 (the DPA 1998), children and young adults can assume control over their personal information and restrict access to it, should they be of sufficient age or maturity to exercise their will in this matter. However, this control is not extended to cover information which is held within a pupil’s educational record. Parents are entitled to request access to, or a copy of their child’s educational record, even if the child does not wish them to access it. This applies until the child reaches the age of 18. This is however, subject to information that the school could not lawfully disclose to the child him/herself under the DPA 1998 or in relation to which the child him/herself would have no right of access under that Act.3

For example: a non-resident parent who has limited contact with their children, contacts the school to find out how well they did in their exams. Neither the children nor the resident parent wishes to share that information and informs the school of this. The school refuses to release the information on the basis that the children are sufficiently mature to have control over their personal information. The school has therefore breached education law by failing to provide information to which the non-resident parent is entitled."

 

I cannot see anything specific from DPA2018 that would affect the 1998 intepretation, even on the right to object as there is a legal obligation to comply with the above act.

It might sound like fence sitting ... but it really is a case that you need to take into account other legislation and statutory guidance when these decisions are made.When in doubt, seek advice from your DPO and professional legal advice.

[GrumbleDook]

Yeah, they're wrong.

 

As just mentioned … they are … and they aren't.

 

And example would be where an incident has occurred where a non-resident parent has become a possible threat and information needs to be prevented from being sent to them. Under the requirements to pass on the educational record (a legal obligation) then the school should do so, but the protection of the child (also a legal obligation) would mean you don't. It is not that safeguarding trumps GDPR (I hate it when folk say that), it is just that a different legal obligation is held to be a higher priority on balance.

 

It is a balancing act and will be a minority of cases where the balance of actions falls towards the student's request.

[kevin_lane]

Wow confused.com lol

[djrscally]

As just mentioned … they are … and they aren't.

 

And example would be where an incident has occurred where a non-resident parent has become a possible threat and information needs to be prevented from being sent to them. Under the requirements to pass on the educational record (a legal obligation) then the school should do so, but the protection of the child (also a legal obligation) would mean you don't. It is not that safeguarding trumps GDPR (I hate it when folk say that), it is just that a different legal obligation is held to be a higher priority on balance.

 

It is a balancing act and will be a minority of cases where the balance of actions falls towards the student's request.

 

Yeah ok; I'm responding perhaps too narrowly in saying outright no - that answer is based on my reading of the situation that both School and Council are basing their decision to cut the parent off on the fact that the Student's age is >= 13 and the belief that the GDPR allows 13 year olds to dictate who can see their data:

 

And they have replied with the same thing, because of the students age, (over 13) then it is his/her right to block the parent.

 

That interpretation of the law is definitely wrong. There may be some other reasons (safeguarding naturally, but maybe some others) that do justify blocking the parent.

[localzuk]

@GrumbleDook - That was really unclear, sorry!

 

You might not like the "safeguarding trumps GDPR" thing, but that is the sort of level of advice schools actually need now. We understand things need to be balanced, but this is day to day operation stuff in schools, and the staff applying the rules are not experts or solicitors.

 

For this particular issue, I would say there are of course nuances to it. If the child has said no access for a parent, then that applies to *some* data - eg. that parent couldn't make an SAR on behalf of that child, but they would still be entitled to access to their child's educational record, and the child does not have a right to block access to that unless there has been a court order put in place.

 

Regarding your example in the second post, schools cannot make that decision to block access by themselves as far as I can tell? The Education (Pupil Information) (England) Regulations 2005 does not appear to make provision for that, so it would require some form of court order would it not?

[Achandler]

The question has to be asked as what exactly an Education Record is, as every school records different things and differently. There is the obvious things that all shared, such as exam results etc but for example cahsless catering and the food a child has bought, could a student request a parent doesn't see that? Not all schools have systems that record it, so is it covered.

 

I'm sure it is a nightmare to work out.

[djrscally]

The question has to be asked as what exactly an Education Record is, as every school records different things and differently. There is the obvious things that all shared, such as exam results etc but for example cahsless catering and the food a child has bought, could a student request a parent doesn't see that? Not all schools have systems that record it, so is it covered.

 

I'm sure it is a nightmare to work out.

 

The same regulation defines that phrase, and is pretty broad (I.E. it's basically every piece of information a school has about a student)

 

The Education (Pupil Information) (England) Regulations 2005