SAR and a users work documents

[EeboBebo]

A old teacher has requested all the documents in their Onedrive area as part an SAR so do we have to provide these legally? I thought documents created remained part of the property of the school?

 

Thanks

[Rob_D]

As I understand it, a Subject Access Request would cover any documents containing personal information for the subject of the request held/owned by the school. Users OneDrive docs could certainly fall under the scope of a SAR, but documents would only need to be disclosed if they contained PII for the subject.

Your DPO would be best placed to answer these questions.

[pete]

SAR would cover anything about them (copy of a CV, PDF payslips, etc, PDF copy of a letter/email about them, for example), but that's it.

 

Things created in the course of employment in exchange for payment are owned by the employer.

 

If those things contain information about the ex-employee, they can request a copy of that information.

 

Check with your DPO for guidance (and your SLT about any potential landmines in the school <> ex-employee relationship).

[Rob_D]

Things created in the course of employment in exchange for payment are owned by the employer.

What does ownership have to do with it? As I understand it, the SAR covers specific types of information held by the org. The fact the org owns the data/documents be a reason for potential inclusion?

 

If there's a business/DP/GDPR requirement you can redact non-relevant parts of documents.

[psydii]

You are correct, they do not have carte-blanche rights to access their old documents under any law. Teachers taking a copy of the resources they created while employed is not uncommon, but an SAR is not the vehicle for this.

 

If we are being pedantic, the metadata about which files they have created and edited and at what time is technically their data and so can be in scope for an SAR. However the documents themselves are not, unless they themselves contain PII such as Line Management notes, Letters/Communications (directed to them specifically) from HR/their Line Management, Payroll etc. Materials sent to / used by / created by them but not *about* the subject or not containing any personal information about the subject are not covered by an SAR.

 

So a variation of the output of a script like this: https://stackoverflow.com/questions/35232628/powershell-script-to-view-all-onedrive-files-and-who-has-access-to-them would cover the "all files" from their OneDrive request. You would of course need to check the files names themselves did not contain any other Data Subject's PII. Combined with an eDiscovery scoped to their OneDrive you should be able to pick up everything they are entitled to have.

[enjay]

Teachers taking a copy of the resources they created while employed is not uncommon, but an SAR is not the vehicle for this.

 

Agreed, you expect teachers to take resources with them (and indeed, you expect new staff to bring resources with them), but an SAR is not the appropriate method as SARs only cover documents containing personal information, not a PowerPoint for a Year 7 lesson on bacteria. Normally staff copy documents before they leave or would just email IT afterwards if they left quickly or from illness/maternity leave. The fact this person has gone down the legal route makes me wonder what else is behind this, so definitely get SLT input.

[TechMonkey]

How ex a teacher are we talking? Just left? Can they not still access their stuff? Before Easter? Why do you still have their documents? In between those (or even if you have not deleted their documents), as others have said, treat them as anyone else putting a SAR in. There is obviously an issue there that has made them resort to a SAR so you need to follow procedure to a Tee.

[enjay]

Before Easter? Why do you still have their documents?

 

I can't speak for the OP, but we keep staff accounts for 12 months before deleting, because when the new teacher comes to us and says "I'm looking for some files which I think are in Fred's folder", it is easier to copy from live folders than restore from backups.

[pete]

What does ownership have to do with it? As I understand it, the SAR covers specific types of information held by the org. The fact the org owns the data/documents be a reason for potential inclusion?

 

As others have hinted in-thread, dafter ex-employees may abuse the SAR process in an attempt to get copies of documents they forgot to take a copy of before leaving.

 

Instead of, y'know - just asking for a copy of their lesson plans like a normal person.

 

That may not be the case here (it could just be a poorly scoped SAR or I've made assumptions from the OP), but a request for OneDrive without email as well (for example) makes me think the request is odd:

 

"Hi, this is a request for data about me created or modified between date X and date Y" is what I'd expect - it covers all potential locations.

 

vs

 

"Hi, this is a request for all data in my old OneDrive folder" - potentially misses out other areas pertinent data may exist.

Edited August 9, 2023 by pete