Emergency exam grading: prepare now for the information law risks
Schools should be mindful of the risk of disappointed pupils (or their parents) using free legal means to obtain information about how their grades were awarded, to try and find the basis for a challenge or complaint.
Pupils are not sitting public exams this year. Instead, teachers and schools are conducting longer-term pupil assessments, which will be used as the basis to award grades. The approach is unprecedented and will therefore likely be imperfect. It seems inevitable that some students (or, more pertinently, their parents) will be frustrated or disappointed with their results and seek to challenge them. There are two options for pupils to demand information from schools to use as a basis for challenging an exam grade (and both can be exercised quickly and free of charge):
(1) subject access requests under the GDPR (“SARs”); and
(2) formal requests made under the Freedom of Information Act 2000 (“FOIA requests”).
Some students (or parents on their behalf) are likely to make SARs. SARs will usually have to be complied with and, in theory, entitle individuals to see all documents containing their “personal data”. This is a broad concept: any information from which a living person can be identified. It is likely that at least some information recorded in the grading process will need to be disclosed in response.
If you are considered a “public authority” (for example, maintained schools or further/higher education institutions), students can validly make a FOIA request. The scope of a FOIA request can be very broad: any information which the requester thinks you might hold (i.e. regardless of whether the information contains the requester’s personal data).
What should we do?
Instead of trying to comply with individual SARs and FOI requests on an ad hoc basis, we recommend planning a strategy to deal with multiple requests in succession. Key points to consider include:
— When can parents make SARs/FOI requests on their children’s behalf?
— How should we search for relevant information?
— Can we refuse to comply at all?
— How much work do regulators expect us to do in response to SARs/FOIA requests?
— When is our deadline for response and can we extend it?
— Are there any exemptions under applicable law which might help us? For SARs, there is an exam script exemption but it is only of limited use.
How can we help?
We understand that your priorities and resources might be stretched right now. Our data privacy specialist, Lucas Atkin, has therefore produced a short guidance document which explains how you can handle multiple SARs and FOI requests, helping you to plan your strategy and aiming to guide you through the process. We are delighted to make this document available for £995 (exclusive of VAT). Alternately, Lucas is happy to provide assistance on an individual case basis as usual.