GDPR and pupil meeting notes.

[rpain]

Hi,

 

I'm interested to find out whether under GDPR whether a parent would be entitled to access to documents such as parent meeting notes and references from previous schools which are stored in our MIS? I expect that safeguarding documents wouldn't be allowed for obvious reasons.

 

Thanks,

Richard

[elsiegee40]

@GrumbleDook

[Bigbird7]

Yes, any personal information you hold where an individual is identified is requestable by a parent, no matter the source. Safeguarding records are not automatically discounted but you must go through a redaction process to remove anything that identifies another individual and anything that could cause harm by passing it on.

[AndyCrow]

Hi. Its probably worth checking under what lawful basis those notes are being stored and that they are being kept in line with the school's retention policy.

[rpain]

Thank you both - that's been enormously helpful.

[rpain]

OK - and for a slightly more unusual situation. We have a member of staff with a child at the school. Would they have the automatic right to view documents stored in the MIS on their child or would an official data access request need to be made? Even for counselling notes (would these notes be counted as safeguarding if no discussions in the sessions cause safeguarding concerns)?

 

Thanks again.

[elsiegee40]

Parents who are also members if staff need to separate their roles. What they are entitled to see as part of their work is not what they’re entitled to see as a parent.

 

Parents do not have the automatic right to view EVERYTHING in the student record on request.

 

You need to review the legal basis on which it is is held, risk assess what is released, redact any mentions of other names.

 

Counselling notes may well be confidential in the medical sense and that needs to be checked legally. What’s said between patient and doctor stays there and even parents don’t get access.

[localzuk]

Yes, any personal information you hold where an individual is identified is requestable by a parent, no matter the source. Safeguarding records are not automatically discounted but you must go through a redaction process to remove anything that identifies another individual and anything that could cause harm by passing it on.

That is not true. It depends on the age of the child, the type of school (academies are different to LEA schools) and there are some things parents do not have the right to request. The law basically talks about the right to access a child's "educational record", but that doesn't mean "everything the school has about the child". Whereas, a child has the right to do a SAR to get more than that.

[enjay]

Parents who are also members if staff need to separate their roles. What they are entitled to see as part of their work is not what they’re entitled to see as a parent.

 

Agreed. I've seen this issue before, and indeed seen a staff member receive a formal warning as a result.

 

As a good rule-of-thumb, staff members who are parents should ask themselves "would we share this information with any parent?". Low-level behaviour records for example. You would phone home if a child had been fighting, but you wouldn't call a parent if their child had forgotten their planner.

[Bigbird7]

That is not true. It depends on the age of the child, the type of school (academies are different to LEA schools) and there are some things parents do not have the right to request. The law basically talks about the right to access a child's "educational record", but that doesn't mean "everything the school has about the child". Whereas, a child has the right to do a SAR to get more than that.

 

Anybody with PR can put n a SAR for their child no matter their age. Who you should respond to depends upon the competency of the child (usually deemed to be over 12) but should be treated on a case by case basis. If you are confident the child understands their rights then the response should be to the child, however the child may give their consent or if it is evidently in the best interests of the child then the response is to the parent.

[localzuk]

Anybody with PR can put n a SAR for their child no matter their age.

 

This is also not quite true. From the ICO site (https://ico.org.uk/your-data-matters/schools/pupils-info/):

 

"Pupils attending any type of school have a right of access under the Data Protection Act 1998 to their own information. This is known as the right of subject access. When a child cannot act for themselves or the child gives permission, parents will be able to access this information on their behalf."

 

If a child is of an age where they are competent (usually 12 or over as you say), then they would have to give their parent permission to perform a Subject Access Request. This is not the same thing as a parent getting access to a child's educational record, as that record is a subset of the information held about a child.

Without that permission, a school can rightly refuse to fulfil a SAR for a child over 12.

[enjay]

[/font][/color]If a child is of an age where they are competent (usually 12 or over as you say), then they would have to give their parent permission to perform a Subject Access Request.

 

We had that. The parent was not happy when we said we need the child's consent! In this instance, the child gave the consent which saved the next argument.

 

I can also think of a child here who has countermanded their parents' consent for use of their photo.

[forkies]

OK - and for a slightly more unusual situation. We have a member of staff with a child at the school. Would they have the automatic right to view documents stored in the MIS on their child or would an official data access request need to be made? Even for counselling notes (would these notes be counted as safeguarding if no discussions in the sessions cause safeguarding concerns)?

 

Thanks again.

 

I am close friends with a counsellor and I have to say that counselling notes should NOT be stored in a place general staff can access such as attached as linked documents on the MIS system. They should be in a restricted file, referenced by a client number or code and the list of client codes vs real names stored in a separate restricted file. I would raise this as a concern.

[rpain]

I don’t believe counselling notes are stored here.

[GrumbleDook]

Ok, a couple of interesting things to cover on this.

 

1 - There is a difference between an Educational Record and information on a pupil ... the applies to maintained schools though. Alsp pupil meeting notes are unlikely to be within here.

 

2 - Any information you have been provided is yours to use under your policies and procedures. The data shared to you from the previous school is based on a relationship that used to be termed Controllers in Common, i.e. you have a reason for sharing it to the other school (legal obligation / public task) but they are the controller once they have it.

 

3 - Having said that, common sense is needed too. IF you have data provided by the other school and you are concerned then call them. Tell them that they sent over X & Y and according to your policy you share that un-redacted ... if they shared in error, then that is their breach to worry about and you have a reason not to share yourself, but if they didn't then go ahead.

 

4 - Be mindful of issues that may be ongoing. At this point, go and chat to those wonderful, your legal services (remember ... IANAL!)

 

5 - The age thing is interesting. The best I can say here is to check https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/#13 for the latest guidance and remember it is a 2 stage process ... is the child mature/knowledgable enough to understand their rights ... and if they are, have you asked if the parents can make the request on their behalf. I have a particular position on the difficulties with the former, but it is down to a case-by-case process ... making sure you record results. IF the child refuses then the school should consider other means to get key information out.

[FishCustard]

IF the child refuses then the school should consider other means to get key information out.

 

What might you suggest in the case that a child withholds consent?

[GrumbleDook]

What might you suggest in the case that a child withholds consent?

It is not consent ... they are not allowing a 3rd party to act on their behalf to make a SAR. It may seem like a fine line, but it is an important one.

 

There may be areas that need discussing under duty of care, progress within lessons, and so on ... all areas where the school has decided there is a lawful basis for sharing information with parents.

[FishCustard]

It is not consent ... they are not allowing a 3rd party to act on their behalf to make a SAR. It may seem like a fine line, but it is an important one.

 

There may be areas that need discussing under duty of care, progress within lessons, and so on ... all areas where the school has decided there is a lawful basis for sharing information with parents.

 

Sorry, yes, I wasn't clear there. I meant consent to make the SAR, not consent as in "lawful purpose" consent.