If you are still unhappy If the authority does not act on any complaints you have about the data held, you may raise an action in the Sheriff Court. You may also complain to the Information Commissioner who is the official charged with ensuring compliance with the legislation www.ico.gov.uk The Act provides for compensation to be claimed in respect of any breach of its provisions. Compensation can be awarded for "damage and distress". Unfortunately, this form of words requires that some physical or financial damage be established before there can be any compensation for distress (upset). Very few cases will succeed on this basis.
Other Legislation This note has focused on rights provided under the Data Protection Act. Other laws may also provide rights of access to educational records. The Freedom of Information (Scotland) Act 2000 gives a general right of access to data held by public authorities. This excludes access to data about individuals but might be useful if you are seeking information about the manner in which an authority has investigated a complaint about a child's education. Also relevant are the Pupils' Educational Records (Scotland) Regulations 2003 which give parents a right of access to their child's educational records. The definition of an educational record under the Regulations is significantly more restrictive than the right of access to personal data under the Data Protection Act. This leaflet was created by the Govan Law Centre. Our sincere thanks go to Professor Ian Lloyd of the University of Southampton, who is the author.
The Data Protection Act 1998 and Educational Records
Education Law Unit Govan Law Centre 18-20 Orkney Street Glasgow G51 2BZ t 0141 445 1955 f 0141 445 3934 e firstname.lastname@example.org
www.edlaw.org.uk Govan Law Centre is an independent community controlled organisation which exists to tackle unmet legal needs within the Greater Govan area and other areas of social disadvantage as determined by the Govan Law Centre Trust. It is a Scottish charity SC030193. Its legal work is undertaken by the independent legal practice of Dailly & Co. Solicitors.
The Data Protection Act 1998 and Educational Records The Data Protection Act gives a range of rights in respect of educational records. Essentially individuals (data subjects) have a right to obtain a copy of any data, to require that any errors are corrected and, in very limited circumstances, to receive compensation.
How is an access request made? In the case of state schools, any records will be held on behalf of the local authority and a request for access should be made to the authority. Independent schools and colleges and universities should be contacted directly. Some authorities provide a subject access form on their website.
Scope of the legislation The Act applies when data relating to an individual is held either on computer or in paper format as part of a structured filing system. The contents of a filing cabinet organised in alphabetical order could be covered although there is some uncertainty as to what level of structure is required to come within the legislation. It is probably reasonable to assume that most educational data is now held on computer, perhaps in the form of a word processed document.
Who can apply for access to data? In general, the individual to whom the data relates to is the only person entitled to ask for a copy (or to authorise someone else to act on their behalf). Different rules apply where the data subject is not capable of understanding the nature or impact of the request. In this case, a parent or guardian may make the request on behalf of the subject. There is no specific age limit laid down in the Act but as a general rule in Scotland, children aged 12 are presumed to have the requisite level of understanding and parents or guardians will not have a right of access without the child's consent. Matters may be different if a child has some degree of mental incapacity and each case will have to be considered on its own merits.
In making a request you need to provide enough information to allow the authority to satisfy themselves that you are entitled to make the request. If a parent is making a request on behalf of a child the request may start
compiled by an independent professional such as a doctor. If data is withheld in reliance on an exception, this fact may not be readily apparent and it is sensible to add a sentence to the access request along the lines "if any data is withheld in reliance on a statutory exception, will you please inform me of this fact and of the ground you are relying on?" Data must be supplied within 40 days from the date a completed request is received. A request is complete when the authority has enough information to satisfy themselves as to the identity of the person making the request and their entitlement to receive the data.
"I am Ally Lennon, father of Samuel Lennon (date of birth 22 September 2005] who resides with me at this address. I am writing on Samuel's behalf to request access under the Data Protection Act 1998 to all data held in connection with his education at Townhead Primary School from August 2010 to the present date and previously at Lowland Nursery School. 1 understand that you may charge a fee prior to disclosing the data . If this is the case, will you please inform me of the amount required?" Although it is not strictly required, it may avoid subsequent delays if you enclose information, perhaps a copy of a passport or driving licence and the child's birth certificate to confirm identity and the entitlement to receive the data. The Act provides a number of exceptions which authorities may rely on to refuse to disclose information. One of the main grounds in this area will be that the data identifies a third party. It might be, for example, that a report indicates that a child had been assaulted by another named pupil. In some cases it may be that removal of the third party's name from the record will suffice but in other cases matters may be more complex. A particular example might be where a record has been
What happens when I recieve the data? Individuals are entitled to challenge data on a number of grounds. The main ones are that: Information is inaccurate or misleading Information is out of date Information is not relevant to education If you feel that any of these grounds applies, you can request that the data be corrected or deleted. If data is corrected, the authority must (in so far as they reasonably can) inform any other person who has received the data of the fact that the data was inaccurate. If any opinions or judgments are recorded which appear to be based on the inaccurate data, you may request that these be amended to reflect the true situation.
data protection rights re educational records