SAR and Exam Results

[hpanj]

Hi

 

I've seen a few emails about SARs regarding this years exam results.

 

Most of the advice is about being aware that students and parents might ask about the process teachers used to reach their decisions, but before results day this information can be withheld for a longer period of time (i.e. the 1 month deadline doesn't apply).

 

I was wondering if anyone had thought about the issue that may arise on results day where many students could be asking each of their teachers what grade their teacher awarded, why it was different to the one they finally received and what process they went through. Each of these verbal requests would be classified as a SAR?

 

How could we manage this....?

 

Thanks

[GrumbleDook]

No, you are not imagining this and there is some concern that schools will be inundated with both SARs from individuals and FOI requests to find out how the process was set up.

Once there is clearer information from

Ofqual around challenges, then your DPOs will be able to help you put together some support on this.

Yes, it could mean more work but some simple steps should allow you to prepare for anything you have to do.

[garbage46]

I have also been considering how to respond to any SAR relating to centre assessment grades.

IF we need to disclose information about CAG's then it might be best to have official CAG request forms ready.... but

 

My gut feeling is that the grades and ranking submitted by the school should not be shared. If we are ever in a position where teachers will be asked go through the same process, say in Summer 2021, then the integrity of the process will be compromised. If teachers and heads of centre know that the grades they submit will or could be made public or disclosed to parents and students then they'll just inflate grades and point fingers at exam boards and the standardisation process when lower grades are awarded etc etc.

 

I have started to draft a statement for non-disclosure. I have used the Section 36 expemtion for one FOI request previously, but not for a SAR.... but in the reasonable opinion of a qualified person (me) the same rules should apply to FOI and SAR in this case. see attached:

CAG Draft.pdf

Edited June 22, 2020 by garbage46

[hpanj]

Thanks for the responses. Interesting draft statement - if this is allowed I think would solve the issue. I hope there is more guidance that comes out soon.

[CarolineDPO]

Hi,

 

The thought of dealing with a bundle of SARs in August/September for the exam grades is ridiculous.

 

When the exam certificates are handed out on results day in the schools they should be accompanied by the Ofqual letter that details the process for appeals. Surely this should remove most of the SAR requests?

 

I agree, how on earth can professionals be expected to be transparent and free to give opinion on individual grades if they know that this detail could be released to the student under a SAR?

 

All we need is some bad press coverage 'egging' on students to slap in a SAR!

 

I am pretty sure that the rankings are excempt form release - anyone any clearer on this?

 

Caroline

[garbage46]

Fingers crossed for some level of agreement, the exemptionrule I have used in the draft is for Freedom of Information requests but as a request to see CAGs and rankings would be a Subject Access Request with different exemptions that do not really fit -

 

the best fit would be a stretch at some type of mental health / stress related harm for teachers or the one about "management forecasts", which could fit, if pushed hard enough...

 

This exemption can apply if you process personal data for the purposes of management forecasting or management planning in relation to a business or other activity.

But the exemption only applies to the extent that compliance with the above provisions would be likely to prejudice the conduct of the business or activity.

 

Disclosing CAGs and ranking would prejudice any future activities of a similar nature.

 

What we need is for an organisation like ASCL to push for a non-disclosure rule/exemption or else it's going to generate a lot of work and a lot of difficult conversations that we do not want to have.

[GrumbleDook]

At the risk of contradicting ASCL, unless the guidance comes from ICO, DfE and/or Ofqual you need to be careful.

 

I’m still trying to unpick this as guidance on the exemption applies up until results day, but if you have had FOI requests about the process and have slapped a S36 exemption on it (Professional Opinion) then that would need to be reviewed for subsequent requests post results day, as some of the stuff covered by that FOI exemption would now be issued under the SAR.

 

It is a vicious circle!!!

[garbage46]

Indeed. What I was trying to say is that we could do with a large organisation, like ASCL, to work with and convince the DfE, Ofqual et al that we should keep CAG and ranking confidential. Current guidance is just replying on existing exmeption rule for exam scripts. I believe this is something completely different, but let's wait and see

[EduDataPro]

Has anyone seen any updated guidance on this subject? I've seen this release from the 'Exams Office'. Makes interesting reading, they aren't quite right around SARs, e.g. SARs can be informal and don't always include all the data you hold on an individual.

 

https://www.theexamsoffice.org/wp-content/uploads/2020/07/Article-12_Sharing-student-data_grades-and-rankings_updated-7-July-FINAL.pdf

[blueday]

That's really useful, thanks. This bit is interesting:

"One issue which the Head of Centre and DPO will need to consider is the release of rankings where there is a small cohort. For example, within a cohort of two students, if one student is informed of their ranking, they will deduce the ranking of the other student. The Head of Centre and DPO will need to take advice on the course of action to take if this situation arises."

So would that mean in the case of a special school with few students, they don't have to release info on ranking?

[AdamV]

I have some thoughts on this topic following similar discussions internally. Disclaimer: "I am not a lawyer" (but I have dealt with lots of DPA/GDPR matters over the years)

1) I agree that some clearer guidance would be welcome, but what I have seen from OfQual says that without new legislation (which is unlikely in the timescales we face), there can be no special exemption from GDPR for CAGs and Ranks

2) The exemptions that did/do exist are being shoehorned into existing rules about exam scripts which, even if valid, evaporate on results day

3) SARs do not have to be in a special format or use specific wording or a particular form. Realistically, they can be made verbally, although requesting them in writing is usually reasonable as it covers both parties in making sure they are accountable. On results day, if you say that a SAR must be made in writing, expect an email from the student's smartphone about 30 seconds later. They should come from the data subject (ie not parents), or be very clear that they are being submitted under the direction of and with the consent of, the data subject.

4) The ICO requires a data controller to respond to a SAR "as quickly as possible". The 1 month limit is the latest possible. Realistically, if a student asks a member of SLT who is sat in front of a laptop with access to your MIS what their CAG was, then arguably "as quickly as possible" could be interpreted as "right now" after a few clicks of the mouse.

5) A data subject can explicitly and selctively waive their right to privacy. A group of students could all send a biolerplate email stating that they are happy for their CAG and rank to be shared with others, which means the defence of "I can't tell you your rank because it would reveal someone else's too" won't last five minutes. If you have larger groups, this defence won't really wash anyway. If you have small groups, it is easier for the student's to organise themselves to do this (they could even do this just with the others they know received the same CAG as them).

6) Asking for evidence of what processes were used would be FOI, not SAR.

7) Section 36 exemption might apply to some parts of an FOI request, but not others. And a section 36 exemption must be agreed at a pretty high level before you even think of relyin on it (eg Chair of Governors, from memory). By "some parts" I mean, for example, it would likely not exempt you from having to reveal emails sent between staff and/or SLT about what process they should use, what evidence should be included or excluded etc. If you decided not to consider Mock results at all, or a particular assessment, that would become public information. If you decided to just take Mock results and add an arbitrary inflation (eg +1 grade) to them, that would come out. If you selected students with specific characteristics to be treated differently (eg to give them more advantage), that would be fair game. How you decided which students to enter or withdraw, especially those in the "wrong" year group taking an exam early, or a resit, would be open to scrutiny (with redaction of personal information of course). After sharing what the process was supposed to be, you could be expected to demonstrate that this was followed in all cases (or the cases relevant to the FOI request being made, which might be in relation to one subject or qualification type). Emails or minutes of meetings or emails about individuals or groups of students would likely be exempt, as that is the sort of "ability to speak freely and openly" that the exemption aims to protect.

I can see this will all be stressfull for some teachers and leaders, knowing that in some cases students and their parents will be disappointed with a grade which was assigned by the centre, or even where the assessed grade has bene moderated downwards (if only they had been ranked higher than , they would have gone down instead). But when the internal process has been designed as fairly as possible, and followed with integrity to be fair, unbiased and led by evidence, I'm not really sure why we would want to hide any of this.

[GrumbleDook]

I have some thoughts on this topic following similar discussions internally. Disclaimer: "I am not a lawyer" (but I have dealt with lots of DPA/GDPR matters over the years)

Comprehensive response and review. I will answer these in line to make it easier to see.

1) I agree that some clearer guidance would be welcome, but what I have seen from OfQual says that without new legislation (which is unlikely in the timescales we face), there can be no special exemption from GDPR for CAGs and Ranks

Reviewing the Ofqual guidance so far it has been clear that the exemption goes on results day and the backlog of requests will then start (it is interesting that the 40 days past results day limit is longer than the limit for a new SAR of 1 month) ... as the resit of exams in autumn will *not* take into account the CAGs and so they will no longer be considered scripts ... apart from Art and Technology courses. I'm still waiting for clarification about if Art and Technology courses still need the exemption applied. We will have to wait and see.

2) The exemptions that did/do exist are being shoehorned into existing rules about exam scripts which, even if valid, evaporate on results day

See above.

3) SARs do not have to be in a special format or use specific wording or a particular form. Realistically, they can be made verbally, although requesting them in writing is usually reasonable as it covers both parties in making sure they are accountable. On results day, if you say that a SAR must be made in writing, expect an email from the student's smartphone about 30 seconds later. They should come from the data subject (ie not parents), or be very clear that they are being submitted under the direction of and with the consent of, the data subject.

Yes, people need to be careful about this, but those making requests need to be aware that they may be asked for clarifications and if the organisation puts in structure to help with that clarification (in the interest of accuracy and efficiency) then it is a reasonable approach. Demanding the information from the person trying to hand out the grades whilst others are also waiting for their grades will be problematic and if the school has been clear that if they have any questions they can go and speak to a member of staff, then they are doing what they can to help the students. A simple form to collect the student's details and verify who they are is not a bad idea, and that can be managed about someone else.

4) The ICO requires a data controller to respond to a SAR "as quickly as possible". The 1 month limit is the latest possible. Realistically, if a student asks a member of SLT who is sat in front of a laptop with access to your MIS what their CAG was, then arguably "as quickly as possible" could be interpreted as "right now" after a few clicks of the mouse.

Not quite. when we think of "as quickly as possible", we have to consider the disruption to the normal business of a school. even if they have everything to hand, if releasing the CAG at that point could then need a lot of other discussions and so it is perfectly reasonable to take into account the needs of others, as long as you stay within the time frame.

5) A data subject can explicitly and selectively waive their right to privacy. A group of students could all send a boilerplate email stating that they are happy for their CAG and rank to be shared with others, which means the defence of "I can't tell you your rank because it would reveal someone else's too" won't last five minutes. If you have larger groups, this defence won't really wash anyway. If you have small groups, it is easier for the student's to organise themselves to do this (they could even do this just with the others they know received the same CAG as them).

Not quite. Yes, they can collectively grant authority to someone to get the information on their behalf, but that does not mean that the school has to give the results to anyone and everyone. The right is for the data subject, or their authorised representative, to have access ... if the school is told to give access to everyone in the class, that is not to say everyone in the class *wants* access to the information, or there may be other factors that have to be considered that the student may not be aware of. That's not to say that they can't build it all themselves and work out the gaps.

6) Asking for evidence of what processes were used would be FOI, not SAR.

I'm waiting for a clarification on whether an exemption under section 36 might cover this (as you mention below), and I've already had one trust discuss whether they will wait to publish it at a later date once any appeals (Centre appeals) are dealt with ... so they are exempt under Section 22.

7) Section 36 exemption might apply to some parts of an FOI request, but not others. And a section 36 exemption must be agreed at a pretty high level before you even think of relying on it (eg Chair of Governors, from memory). By "some parts" I mean, for example, it would likely not exempt you from having to reveal emails sent between staff and/or SLT about what process they should use, what evidence should be included or excluded etc. If you decided not to consider Mock results at all, or a particular assessment, that would become public information. If you decided to just take Mock results and add an arbitrary inflation (eg +1 grade) to them, that would come out. If you selected students with specific characteristics to be treated differently (eg to give them more advantage), that would be fair game. How you decided which students to enter or withdraw, especially those in the "wrong" year group taking an exam early, or a resit, would be open to scrutiny (with redaction of personal information of course). After sharing what the process was supposed to be, you could be expected to demonstrate that this was followed in all cases (or the cases relevant to the FOI request being made, which might be in relation to one subject or qualification type). Emails or minutes of meetings or emails about individuals or groups of students would likely be exempt, as that is the sort of "ability to speak freely and openly" that the exemption aims to protect.

I can see this will all be stressfull for some teachers and leaders, knowing that in some cases students and their parents will be disappointed with a grade which was assigned by the centre, or even where the assessed grade has bene moderated downwards (if only they had been ranked higher than , they would have gone down instead). But when the internal process has been designed as fairly as possible, and followed with integrity to be fair, unbiased and led by evidence, I'm not really sure why we would want to hide any of this.

Whilst it may have been laid out in the fairest possible way, that doesn't mean it won't be open to it being used as part of legal challenge against the school and against individual staff. To some extent, I would like to see how DfE and Ofqual cover this via a Public Interest Test.

[AdamV]

Not quite. Yes, they can collectively grant authority to someone to get the information on their behalf, but that does not mean that the school has to give the results to anyone and everyone. The right is for the data subject, or their authorised representative, to have access ... if the school is told to give access to everyone in the class, that is not to say everyone in the class *wants* access to the information, or there may be other factors that have to be considered that the student may not be aware of. That's not to say that they can't build it all themselves and work out the gaps.

My point here is this:

Student A says "I would like to know what rank you gave me"

School responds "Because so few of you take that subject / received that grade, we can't give you that data without implicitly telling you what ranks were given to other students"

Students A, B and C all say (for example in a letter co-signed by them all) "We waive our right to privacy about our rankings in this subject, and would each like to see our rankings even though we know that would mean we would figure out each other's ranks".

 

I think where this will come up most often is in discussions about Autumn resits (putting aside the rarer case of the pushy parent who might want to bring a legal case). Being honest with a student about their chances of a better grade will inevitably lead to them needing to know did they get mnoderated down because they were the bottom rank of the grade above, with a good chance to do better, or did they get their assessed grade, unadjusted, with little chance of it being improved. (Note also the lack of jeopardy in taking the exam in Autumn as they can keep the better of the two results).

 

I am also concerned that when organisations show any resistance to releasing data under a SAR, things tend to go downhill fast, and the scope gets increased by the data subject - "Now I want all the data you have about me including all emails where you might have discussed my grades, and all spreadsheets which have my name in them, and everything from the MIS system since I joined the school".