FOI - Covid numbers in Year Group

[pete]

We've had a FOI request (how many students in Year Group X have got Covid) from a parent.

 

My feeling is giving a number on a year group basis could lead to disclosure of medical data (through guesswork, anecdotal observation of absence and gossip readily available to parents/students) about students.

 

I've checked with ICO and (understandably) they're gone through potential exemptions but it's not on them to tell us what to do.

 

An overall figure (infections across whole school) is less likely to be problematic, but that's not what they've asked for.

 

Thoughts?

[paulkerton]

We've had a FOI request (how many students in Year Group X have got Covid) from a parent.

Thoughts?

 

My first thought is, do you hold that information and if so - why? Why would where someone caught it from matter as long as you know they have it?

[Ditto]

I think it would be difficult to reject the request for the reasons suggested. Ultimately, I think the head and DPO have to make the decision. They should be aware it could lead to an ICO complaint and at that point ICO will have to be more assertive with the stance.

[Ditto]

My first thought is, do you hold that information and if so - why? Why would where someone caught it from matter as long as you know they have it?

I took it as the request was 'from the parent', not that the pupil caught it 'from the parent'.

[elsiegee40]

Dependent on the size of the year group this could be very revealing from a DPA point of view.

 

Do you record who is off sick with Covid, or just who is off sick? Anecdotal knowledge doesn’t count. Schools aren’t doing Track and Trace themselves now.

 

What date do they want this for? The data could be different every day.

[pete]

So:

 

The request is from a parent of a student in a particular year group. They're asking how many pupils in that year group have contracted Covid. Their wording was ambigious, but pending clarification would be interpreted as "recently" vs "how many since the start of the pandemic".

 

The school records who is absent with COVID (Fred Bloggs, 7B. Isolating due to COVID / waiting on PCR result. Start date X, Return date Y). This is in addition to marking a student absent due to illness in the MIS.

 

Given the relatively long absence, this ensures work is sent home over the isolation period and any missing work (that should be supplied by teachers) is chased up.

[paulkerton]

I took it as the request was 'from the parent', not that the pupil caught it 'from the parent'.

 

D'oh. I read it as "how many have caught it from a parent". Ha. Well, that ones a tough one... Registration codes aren't that simple to pull out (Code X included anyone who isolated without having it) and I don't know what the protections should be on TNT information...

 

The request is from a parent of a student in a particular year group. They're asking how many pupils in that year group have contracted Covid. Their wording was ambigious, but pending clarification would be interpreted as "recently" vs "how many since the start of the pandemic".

 

Filter the column for year group. Remove name duplicates. 60/120 have had Covid whilst school was open since 23/03/2020. You can't include those who had it between March-July 2020 and January-March 2021. I would make that clear in my return.

Edited September 29, 2021 by paulkerton

[StevieM]

If the request was worded as in the OP, i.e. 'How many students in Year X have got Covid', I would interpret that as being present tense, i.e. 'How many students have got Covid right now?' As this figure would be constantly changing, it would be difficult to give a true figure. Even if you issued a figure based on the date of the request, you have 28 days in which to respond, by which time the information would be out of date.

[pete]

Speaking with the (outsourced) DPO, they agree that the information requested is for such a small data set that it could be used to determine who has Covid, especially given the implication is current cases.

 

As such, we're refusing the request.

[Ditto]

Speaking with the (outsourced) DPO, they agree that the information requested is for such a small data set that it could be used to determine who has Covid, especially given the implication is current cases.

 

As such, we're refusing the request.

 

I think that's a good outcome. I'm not sure any public benefit can come from the request, but if the parent decides to go down the complaint route with ICO, you have your DPO to argue the case.

[enjay]

Speaking with the (outsourced) DPO

 

Interesting though this discussion has been, that right there is your answer. Ask your DPO. The DPO advises on compliance, the attendance officer provides the numbers. This shouldn't have touched the IT Manager's desk at all.

[pete]

The short version is that I also wear a data protection hat and you lot are a decent sounding board for the more unusual queries while I wait for the DPO to respond.

 

This is the first refusal we've had to issue that wasn't "sorry, we don't hold that data".

[enjay]

The short version is that I also wear a data protection hat and you lot are a decent sounding board for the more unusual queries while I wait for the DPO to respond.

 

In fairness, I do as well (despite me being the one who said it shouldn't hit our desks!) although my DP hat is more about breach management and spotting when people need to think about GDPR than deciding on whether or not to respond to an FOI.