GDPR and FOI Request Query

[trekmad]

Hi All,

 

Interesting query for you data protection gurus. One parent contacts a school by email to complain about the actions of some of it's other students. The parents of those students are made aware of their child's behaviour. The matter is settled and the original parent who raised the complaint is happy with the outcome. Now one of the other parents has demanded to see the email sent by the original parent under freedom of information.

 

Do we have to supply a copy of the original complaint as this has not been generated by us but is now stored on our email system?

 

Many thanks

 

Trekmad

[TechMonkey]

I am not an expert but unless the child is named explicitly in the email it would not have to be supplied, though I may be getting SAR mixed into the equation. Even if you do have to supply it you would redact the senders information, in my view all header information, as well as the sign off and any other names, such as other children named.

[paulkerton]

There is an exemption in the DPA which specifically allows you to refuse a disclosure if it reveals the identify of another individual, so its about assessing the content and whether that email sent by the original parent contains enough information to identify them.

 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/right-of-access/information-about-other-individuals/

[bald_pig]

One for @GrumbleDook I'd say!

 

On my limited understanding, this wouldn't be a valid FOI request, but depending on the age of the student, the parent could make a SAR for the child, which I believe should include the email.

[paulkerton]

@GrumbleDook

SOUND THE HORN!

[AndyCrow]

There would be a good argument not to disclose the letter on the following basis.

https://globaldatahub.taylorwessing.com/article/sars-under-gdpr-ico-guidance-and-uk-exemptions

 

"The DPA18 states that you may only disclose the information about the third party where they have consented to the disclosure or where it is reasonable to disclose the information without their consent. DPA18 sets out that what needs to be taken into account when assessing whether or not it is reasonable to disclose third party information includes:

 

• The type of information you would disclose.
  
• Any duty of confidentiality you owe to the other individual.
  
• Any steps you have taken to seek consent from the other individual.
  
• Whether the other individual is capable of giving consent. And
  
• Any express refusal of consent by the other individual.
  

Essentially the decision involves balancing the competing rights of the individuals involved. Case law (which remains relevant under the new regime) suggests that the controller has a wide margin of assessment and a wide discretion as to which factors to treat as relevant. In a 'tie-breaker' situation, presumption will fall in favour of non-disclosure but this view is not replicated in the ICO guidance."

[trekmad]

Thanks All.

[elsiegee40]

If you did disclose, ALL names and identifying information would need to be redacted other than the name of the child whose parents have submitted the request.

 

You may find there is little left.

[jmak]

If you did disclose, ALL names and identifying information would need to be redacted other than the name of the child whose parents have submitted the request.

 

You may find there is little left.

Replying partly to test my understanding.

 

I'd assume this doesn't just include PII, but also anything about the complaint, such as type, time and place of incident, which could lead to identification of other people involved.

[elsiegee40]

Replying partly to test my understanding.

 

I'd assume this doesn't just include PII, but also anything about the complaint, such as type, time and place of incident, which could lead to identification of other people involved.

 

It’s a really tricky one, but if the information could lead to someone being identified (eg a bullying incident) then yes.

 

A member of the public complaining might be identifiable as it was their garden that was flattened by rampaging year 9s.

 

There’s a fine line.

[GrumbleDook]

@AndyCrow has hit the nail on the head for this. FOI does not mean you have to release personal data. There are reasons why information is treated in confidence and we should educate families better about this.

[GrumbleDook]

It’s a really tricky one, but if the information could lead to someone being identified (eg a bullying incident) then yes.

 

A member of the public complaining might be identifiable as it was their garden that was flattened by rampaging year 9s.

 

There’s a fine line.

 

To some extent, it was slightly easier in the days of numerical Information Labels (IL0, IL1, etc.) as you could explain that multiple data items of IL2 could generate data items that became IL3 or more. People could understand that cumulative nature. They may not have been able to work out what level something was at originally, but they could understand the additive nature.