We cover the “basics” of Subject Access Requests (SARs) in our training including what a SAR is, how to recognise one, and how to respond. But sometimes we are asked more in depth questions regarding SARs so we have put together this guide to include the answers.
More detail can be found in the ICO’s own guidance found here: Right of access | ICO
And if you have any specific questions regarding SARs, we would be happy to answer them and add those answers to our guide as well!
Enjoy!
Answered November ’21.
When preparing data for a Subject Access Request, it is important to remember that there are a number of exemptions that could apply to the data. This list is by no means exhaustive but it includes the exemptions we think are most likely to apply to data requested of a school. Any, all, or none of these exemptions may apply to your data when requested and, if you are unsure, please speak to us as DPO:
So any data that falls under one of those exemptions would be redacted and not included. You should always record what exemptions you are relying on for each data and why. You should also explain to the data subject which exemptions you have applied and why. However, it may be that giving that information prejudices the use of the exemption so there are some instances where you may have to tell the data subject that you can’t tell them exactly what has been redacted, why, and under which exemption. You also have to be able to defend your decision if they challenge it and/or complain to the ICO.
Remember, our role is to help you apply the legislation correctly and we will provide you with advice and guidance as to how to do that. Please ask!
Answered November ’21.
The short answer is that yes, you can. You can extend the time to respond by a further two months giving you a total of 3 months to respond to the request. There are a number of conditions for this but the one that is most likely to be relevant for you is if the request is “complex”.
You should calculate the extension as three months from the original start date, ie the day you receive the request, fee or other requested information.
If you decide that it is necessary to extend the time limit by two months, you must let the individual know within one month of receiving their request and explain why. It is important to note that you don’t have to ask them if you can extend it, the decision is yours to make as the data controller. However, an open dialogue with the data subject about this will help the process go smoothly and hopefully keep the situation from ending in animosity or a formal complaint. It also may be appropriate to provide some of the data by the initial deadline with the more complex data to come later.
Here is further information about complex requests taken from the ICO guidance –
When can we refuse to comply with a request? | ICO
When is a request complex?
Whether a request is complex depends upon the specific circumstances of each case. What may be complex for one controller may not be for another – the size and resources of an organisation are likely to be relevant factors. Therefore, you need to take into account your specific circumstances and the particular request when determining whether the request is complex.
The following are examples of factors that may, in some circumstances, add to the complexity of a request. However, you need to be able to demonstrate why the request is complex in the particular circumstances.
It is important to be realistic in your judgement of the request as ‘complex’. Just because a request involves a large quantity of data, that doesn’t mean it is necessarily ‘complex’ and justifies an extension. Remember, if in doubt, come and speak to us as your DPO and we can advise.
Answered September ’21.
This is a common misconception and the answer, in short, is ‘no’! A subject access request is about data subjects exercising their right of access. The right of access does involve producing a copy of the individual’s personal data but that doesn’t mean giving them copies of their name every time it appears in your data systems for example. To explain:
You don’t have to necessarily print out or electronically provide every single email that an individual’s name has appeared in. It is only emails that are ABOUT them which isn’t necessarily the same thing. Here is the ICO’s guidance about emails – How do we find and retrieve the relevant information? | ICO
A couple of key points –
The ICO includes this example in their guidance:
So, if you search your email system and find thousands of emails with the individual’s name/email address in, you could separate out into different categories:
Doing it this way should speed up the process and reduce the need to go through every email as well as the need to provide copies of every single email.
Remember, if in doubt, speak to your DPO and they can advise.
Answered October ’23.
The short answer is that no, you do not have to provide original (or even direct copies of original) documents as part of a subject access request.
Under the UK GDPR, an individual is entitled to their personal data only. That doesn’t necessarily include all documents that their name or staff/student code appear on (many will not be their personal data) and it is also not the case that the school has to produce original documents that contain their personal data. The ICO’s guidance states “The right of access enables individuals to obtain their personal data rather than giving them a right to see copies of documents containing their personal data” – How should we supply information to the requester? | ICO
This does mean that, where appropriate, you could retrieve data from a system and copy it into a summary document in order to provide it to the data subject. That said, it is often still appropriate to give copies of original documents (with relevant redactions applied) to a data subject, but it isn’t essential.
Answered December ’20.
Regarding redacting teacher names for the SAR. The overall guidance regarding the Right of Access which covers Subject Access Rights is as follows:
The specific areas we want in this case includes the guidance on Education Data:
In this guidance, it states, for example: “Parents can only submit a SAR for information about their child if the child is not competent to act on their own behalf or has given their consent.” This then links to further guidance (How do we recognise a subject access request (SAR)? | ICO) which clarifies how to make the decision around competency.
The guidance also states “if an educational record contains personal data relating to someone other than the requester (such as a family member), you must consider the rules about third-party data before disclosing it to the requester. However, you should not normally withhold information that identifies a teacher.”
On a side note, you also shouldn’t provide information that has been “supplied in a report or given as evidence to the court in the case of proceedings” or if “certain specific statutory rules apply to those [court] proceedings that allow the withholding of the data from the individual it relates to.” And you also shouldn’t provide information if you feel that disclosure could cause serious harm (“cause serious harm to the physical or mental health of any individual”).
The final piece of guidance which is of use in this case is this:
What should we do if the request involves information about other individuals? | ICO
In here, it states the following about an education worker: “it is reasonable to disclose information about them without their consent, as long as the disclosure meets the appropriate ‘test’.”
The test being the following in the case of most of the education establishments we work with:
“For education workers, it meets the ‘education data test’ if the other individual is a teacher or other employee at a voluntary aided, foundation or foundation special school, an Academy school, an alternate provision Academy, an independent school or a non-maintained special school in England or Wales, and the information relates to, or was supplied by, the other individual in their capacity as an employee of an education authority.”
So it is unlikely that teacher names would be redacted from a SAR about a student except in exceptional circumstances.
Answered January ’21.
We have discussed this particular issue with the ICO. They have stated:
“Data protection law gives a right to individuals to access their own data, so the school cannot put additional conditions on releasing the person’s own data. If the school is concerned about harm to third parties due to that being released then that may be grounds to withhold it.”
As a school then, you cannot tell the data subject what they can or can’t do with the data. If you are concerned about harm then you should redact teacher names. The ICO go on to say:
“The school needs to assess if it is reasonable to supply third party [i.e. teacher] data, taking into account that there is a presumption of reasonableness for teachers. They can ask the individual about their intentions with the data in order to make that assessment, and in some cases it is relevant to ask the third party for consent.”
Your options then are to speak to the data subject about their intentions and, if you feel there is a risk, redact the names further. It might be that this redaction isn’t needed on all documents as there are only some you would be concerned about being published. Will certain documents be detrimental to the teacher if they are posted with their name included? If so, redact those specifically.
Please contact us if you do have further questions at DPO@schoolpro.uk.
SchoolPro TLC Ltd (2022)
SchoolPro TLC is not responsible for the content of external websites.
For a confidential conversation about the needs of your school or organisation, please contact SchoolPro TLC using the links below. Based in Gloucestershire, available anywhere in the UK!
SchoolPro TLC Limited was formed by school and education leaders with over 60 years of experience across all stages of education and in a variety of contexts. The company founders have worked to improve educational provision as both senior leaders and school governors.
Monday – Friday : 8am – 6pm
© 2024 SchoolPro TLC – All Rights Reserved
