Subject Access request exemptions

[blueday]

Does anyone have experience of responding to a SAR from a parent on behalf of their child whereby some of the information relates to conversations with the pupil about their home life which, if revealed to the parent could be deemed harmful to the child? The DP Act seems to say that the decision around withholding this data has to be made by the health professionals involved (and presumably the police, if involved) and not the controller themselves. I'm wondering how this can be handled sensitively, and also what wording would be used to explain why data has been withheld. What happens when the child is over 13 and can request it for themselves, but you just know the parent is behind it?

 

Also, just because an email says 'For addressee eyes only' or 'Confidential', presumably that is not enough reason to withhold all the contents?

[mb2k01]

If the child is over 13 and is able to make their own logical decisions, then the parent can't exactly act on their behalf - the child needs to agree to the request. If they deny, then the parent can't use SAR as a way of obtaining the information.

 

If information exists somewhere which presents a safeguarding concern if revealed to the parent, then that shouldn't be revealed (whether under Data Protection Act or not)

 

If you suspect someone is being forced to make a SAR, and there are other safeguarding concerns too, then I would be inclined to refuse based on that.... worst case scenario is the parent reporting you to the ICO, but you would then just state the risks and safeguarding concerns you took in to account, and they would almost certainly agree.

[Ditto]

Just posted this in another thread, but it's even more relevant here https://ico.org.uk/your-data-matters/schools/pupils-info/

[blueday]

Well, after half an hour on the phone to the ICO, I'm none the wiser really. They kept guiding me away from using the serious harm exemption, which is surprising as it's directly referenced in that link.

[GrumbleDook]

Well, after half an hour on the phone to the ICO, I'm none the wiser really. They kept guiding me away from using the serious harm exemption, which is surprising as it's directly referenced in that link.

 

Serious harm is a difficult one to use at times, partly because it has very specific use within cases and partly because it is very accusational against others involved with that child. If that is going to be used, you shuold really be in contact with social services anyway, and a multi-agency decision might be needed.