Cat’s out of the bag - student requesting parent blocked from accessing their data

[Achandler]

Ahh the wonders of law, one piece is definied well and restricted another gets out a huge paint roller and covers everything left right and center and thus creates inconsistancy.

 

Maybe the regulations need reviewing vient he amoutn of data schools collect on pupils nowadays, but obivosuly that would be years and years away.

[GrumbleDook]

@GrumbleDook - That was really unclear, sorry!

 

You might not like the "safeguarding trumps GDPR" thing, but that is the sort of level of advice schools actually need now. We understand things need to be balanced, but this is day to day operation stuff in schools, and the staff applying the rules are not experts or solicitors.

 

For this particular issue, I would say there are of course nuances to it. If the child has said no access for a parent, then that applies to *some* data - eg. that parent couldn't make an SAR on behalf of that child, but they would still be entitled to access to their child's educational record, and the child does not have a right to block access to that unless there has been a court order put in place.

 

Regarding your example in the second post, schools cannot make that decision to block access by themselves as far as I can tell? The Education (Pupil Information) (England) Regulations 2005 does not appear to make provision for that, so it would require some form of court order would it not?

 

And this is where the nuance comes in.

 

I do not know the issues with this specific case, and to some extent we are talking hypotheticals here, but where a child has a non-resident parent and where there is a possible threat (not yet taken to court but police involved) access to data about the pupil could result in information about gaining access to that child which could result in coercion and jeopardise a police case. An instruction would not have come from the courts on this matter but from the child as there is a risk of harm or distress.

 

If the child and resident parent are fleeing from the other parent due to domestic abuse, then the non-resident could use information in the educational to find the child and other parent.

 

If there is a risk of a non-resident parent taking the child overseas for an arranged marriage and information int eh educational record shows items that may help them (educational record showing high academic achievement may be requested by the other family to show suitability).

 

And there will be a myriad of other minor scenarios that relate to the protection and welfare of the child that are covered under other acts of law.

 

So, the balance test comes in ... and it is not that safeguarding trumps GDPR ... GDPR says you follow all the appropriate laws ... and the law says you do the balance test looking at risk of harm to individual agains the request of another.

[GrumbleDook]

Ahh the wonders of law, one piece is definied well and restricted another gets out a huge paint roller and covers everything left right and center and thus creates inconsistancy.

 

Maybe the regulations need reviewing vient he amoutn of data schools collect on pupils nowadays, but obivosuly that would be years and years away.

 

There are lots of examples where laws appear to contradict one another which is why we have a range of tests that can be used to assess where the core requirements lie. They do try to update all relevant and linked acts to refer to or amend those acts when new legislation comes in ... but sometimes the intracacies are a tad insane ... and as much as we might joke about lawyers getting paid silly money, this is the reason why.

[enjay]

The question has to be asked as what exactly an Education Record is, as every school records different things and differently. There is the obvious things that all shared, such as exam results etc but for example cahsless catering and the food a child has bought, could a student request a parent doesn't see that? Not all schools have systems that record it, so is it covered.

 

Exactly my thoughts too. As I understand it, "educational record" is a Defined Thing and doesn't mean "everything a school knows about a child". Your examples of exam results versus meal history are good examples of that.

[enjay]

This is exactly the situation our friend Brian Maloney has been sending FoI requests about (remember this?)

 

Non resident parents have the same rights as resident parents to see a student’s education record. A student cannot use GDPR to prevent parents from seeing it.

 

Not entirely. Mr Maloney was all about schools not treating non-resident parents differently, which is different here - in this instance, the student is driving the request for the parents to be treated differently.

[Areku]

help I'm stuck in this rabbit hole!

 

 

but the council are adamant "in this case" we are to side with the student.

 

the legal team at the council, are now involved not just the data protection team.

Edited July 20, 2018 by Areku

[djrscally]

help I'm stuck in this rabbit hole!

 

 

but the council are adamant "in this case" we are to side with the student.

 

the legal team at the council, are now involved not just the data protection team.

 

I would err with them for now (I.E. don't send anything to the non-resident parent till you've made a firm decision either way); a delayed copy of an educational record is less of a problem to my mind than sending information that there really is a good reason to withhold.

 

In your position, I would be asking the data protection team / legal team for a detailed explanation of the reasoning behind their decision and explain why I don't think they're right, since ultimately I think it's you who is legally responsible here rather than them it's important you understand and agree with the decision. Talk it through and it'll probably get cleared up. It might just be that they have some information that clarifies it that they assume you are aware of but haven't mentioned directly.

[enjay]

I agree with @djrscally you should put information sharing on hold for now. You can send information later but you can't unsend what's already gone.

 

You may have already done this, but I would get a clear ruling on whose head is on the block if this goes wrong too - are you legal team telling you what to do or merely advising?

[Areku]

we out source our dpo etc to the council, so what they tell us, we usually do.

and yes, we took the same view, until we had clear action/advice nothing has been issued.

[GrumbleDook]

There is a catch all you have here ... The right to restrict processing can be raised by the student to say that until this is sorted, don't share and that is a perfectly valid thing to follow.

[Areku]

So, it looks like everything is starting to clear, Yes, both laws are correct (have now sort legal advice too), but it really does depend on a case by case basis, its not a blanket rule to cover all. but now our council, and our legal team are all on the same page.

[djrscally]

So, it looks like everything is starting to clear, Yes, both laws are correct (have now sort legal advice too), but it really does depend on a case by case basis, its not a blanket rule to cover all. but now our council, and our legal team are all on the same page.

 

So which way did they come down in the end?