Quick-Guide: students and information rights

This Quick-Guide provides information on the law and practice of a young person's right to obtain their school file and other information.

This quick guide covers:

  1. What relevant information rights are there for excluded young people?
  2. When can young people request their own information?
  3. What are the time limits for complying with a request?
  4. Can a school charge a fee for complying with a request?
  5. What information are young people entitled to?
  6. What recourse do families have when a school fails to comply with their duties?

1. What relevant information rights are there for excluded young people?

There is also a process for obtaining non-personal information held by a public body An organisation that performs a public function with public funds. Includes schools (includes academies and free-schools, but not independent or private schools), CAMHS, the local authority and the police. , known as a freedom of information The process for obtaining information about a school or other body that is not personal to any individual. request (“FOI”).

Subject Access

The statutory process for obtaining information that an organisation holds about a data subject is known as a subject access request The legal process for obtaining information about yourself or a person you are representing that is held by a school or other body. (“SAR”). It might also be referred to as the ‘right of access’. It is the process for obtaining information in which the person requesting the information can be identified.

Schools keep a file for every student. This file, correspondence relating to that student and any multimedia data, such as school CCTV, is personal information which can be requested through an SAR.

SAR is the most generally applicable right of access. SARs can be made to every school and any other organisation that "processes" personal data. Processing data refers to a range of activities including creating files of data, storing data, sharing data and reviewing data.

The right of subject access is included in the Data Protection Act 2018 at section 45 ("DPA") and in the General Data Protection Regulations at Artcile 15(3)  (“GDPR”).

Maintained schools – right to the school file

Maintained schools have a separate duty to share personal information which is contained in the Education (Pupil Information) (England) Regulations 2005 at regulation 5(2). This right is less comprehensive than the right of subject access under the Data Protection Act because a “school file” does not necessarily include all personal information held by a school. For example, it might not include relevant correspondence between teachers or CCTV. 

This duty is not shared by academies, free schools or independent schools.

Freedom of Information

Section 1 of the Freedom of Information Act contains the right for any person to request information from a public body An organisation that performs a public function with public funds. Includes schools (includes academies and free-schools, but not independent or private schools), CAMHS, the local authority and the police. that is not personal to an individual. This includes statistics or unpublished policies. Only public bodies and some private bodies that are funded to perform a public function are bound by the Freedom of Information Act. In practice, this means that mantained schools, academies and government funded free-schools are bound by FOI. However, independent schools are not.

The “Panel Pack”

Once a school has excluded someone, they should compile the evidence they want to rely on to support that decision and provide it to the school’s governors. The governors then have a responsibility under paragraph 61 of the Exclusions Guidance Statutory guidance to schools, governors and local authorities on the law and process for excluding, and reviewing exclusions. The 2017 edition of the guidance is the current version.  to circulate that information at least 5 school days before they meet to hear the exclusion. This is sometimes referred to as the “ panel pack A bundle of documents compiled by the headteacher to support their case for exclusion. It will be provided to the governors and the family ahead of the review meeting. ”. There is no specific right for the family to have any information included in this pack and it is no duty for the school to provide anything if they don't want to provide evidence in support of their decision to exclude.

2. When can children request their own information?

Children nominally have the same right of access to their records as an adult does. A child can therefore make a request for themselves. The ICO’s guidance explains that a request cannot be denied simply because the person making it is a child. However, it can be denied if the data-controller An organisation that holds information about a person. In relation to school files, the school holding the file is the data-controller is not satisfied that the child has the “competence” to understand their own data rights.

As a general rule of thumb, the ICO points to the rules in Scotland which state that a child aged under 12 is not competent to access their own information, and those aged 12 and over are.

Anyone can make a Freedom of Information Act request regardless of age.

3. What are the time limits for complying with a request?

Subject Access

The time limit for data controllers to provide information is known as the “relevant period”. It is set out in s.54 of the Data Protection Act 2018 as being 1 month. It begins to run when the request for information is received by the data-controller An organisation that holds information about a person. In relation to school files, the school holding the file is the data-controller . Within this period, data controllers still have to provide information “without undue delay”, so they cannot use the whole month if the request is straightforward enough to be satisfied sooner.

Article 12(3) GDPR allows data controllers to extend the one-month time limit to three months where “necessary”, taking into account the complexity of the request and the number of requests. If the data controller wants to exercise this option, they must give notice to the data-subject An individual about whom information is held by an organisation. Schools keep records about a student's education. This makes the student the data-subject.  within the initial one-month time limit.

The ICO has given some guidance on this matter, explaining that the threshold needed for extending the time limit sets a high bar. The ICO says in their guidance that it is unlikely that this is unlikely to be satisfied if:

  • it is manifestly unfounded or excessive;
  • an exemption applies; or
  • the data-controller An organisation that holds information about a person. In relation to school files, the school holding the file is the data-controller is delaying to request proof of identity before considering the request.

In practice, this will likely mean that unless the student has an exceptionally complex record requiring extensive compiling and redaction, there shouldn’t be a reason for the school to extend the time needed.

Maintained schools – right to the school file

Under the Education (Pupil Information) (England) Regulations 2005, maintained schools A school that is funded by and under the control of the local authority A borough, county or city council that has responsibility for providing education to children in their area. . and all special schools must provide pupil files within 15 school days. There is no exception or extension available.

Freedom of Information

An FOI must also be responded to as soon as possible, and in any event within the maximum number of days allowed under the Freedom of Information Act. For most organisations the deadline is 20 working days from the date of request. Under the Freedom of Information (Time for Compliance with Request) Regulations 2004, Regulation 3, the time limit for schools, is 20 school days or 60 working days, whichever is sooner.

4. Can a school charge a fee for complying with a request?

Subject Access

Under Article 12(4) GDPR, an organisation cannot charge for complying with an SAR as long as it is the first request to that organisation, and it is not excessively complex.

The ICO's guidance explains that the data-controller An organisation that holds information about a person. In relation to school files, the school holding the file is the data-controller will be able to charge a fee if:

  • [the request] is manifestly unfounded or excessive; or
  • an individual requests further copies of their data following a request.

In practice, there are very few situations in which you should be charged a fee for a properly made SAR, particularly for a school file which should be simply retrievable. It may be more difficult for schools to compile relevant correspondence for you, but it should still be very rare for a fee to be requested.

Maintained schools – right to the school file

The right under the Education (Pupil Information) (England) Regulations 2005 must be fulfilled without charge.

Freedom of Information

Under section 13(1) – (3) of the Freedom of Information Act costs can be applied to respond to an FOI where fulfilling the request would cost more than the “appropriate limit” to provide the information. For schools that limit is £450. Any request that costs less than £450 to fulfill must be fulfilled without charge.

5. What information is a data subject entitled to?

Subject Access

Under the Regulation 15(3) GDPR, the information a person is entitled to is “a copy of the personal data undergoing processing”. The only exception is in Regulation 15(4) which stipulates that this will not include any information that would breach another person’s right to privacy.

This means that the data subject has the right to all personal information, save for that which might include the personal information of another person. Schools should normally provide disclosure but with redactions where other children are mentioned.

Personal information is information which relates to an “identified individual”. This is a very broad definition which will pick up most documents and correspondence that relate to a person, as long as on a common sense reading of that document, it is about that person.

This will include emails and letters about a child even where they were sent internally between staff or externally to agencies. It also includes CCTV although, where the School cannot provide it without breaching the data rights of other visible children, they may decline to do so.

Maintained schools – right to the school file

Under the right in the Education (Pupil Information) (England) Regulations 2005 the documents provided are no more or less than what is in the “school file”. This can be limited because correspondence, notes about additional support and records of day to day interactions with the young person may not routinely make it to the school file.

Freedom of Information

Section 1 Freedom of Information Act contains the right for any person to request information from a public body An organisation that performs a public function with public funds. Includes schools (includes academies and free-schools, but not independent or private schools), CAMHS, the local authority and the police. .

This right is limited by 24 exceptions set out at sections 21-44 of the Freedom of Information Act.

The exceptions most relevant for excluded young people are:

  • Information restricted for law enforcement purposes (s.31);
  • Information that is intended for future publication anyway (s.22);
  • Information that can already be accessed by means other than FOI (s.21);
  • Information restricted for health and safety reasons (s.38);
  • Personal information (s.40).

The reality is that most relevant information should be obtainable. For example, statistics about the use of exclusions between different groups to identify trends, or obtaining internal guidance to staff about how to address SEND or other relevant situations, should be disclosable without falling into any of the exemptions.

6. What recourse do families have when schools fail to satisfy a request?

Subject Access and Freedom of Information

If a family is not satisfied with a response because it is late, constitutes a refusal to provide records or the records are incomplete then the ICO will consider a complaint made about a data controller.

The ICO will expect you to have first made your complaint directly to the organisation and given them time to reply. If they have replied, the ICO will expect you to provide the reply in support of the complaint.

The ICO aims to process 90% of complaints within 6 months. A June 2019 Freedom of Information request showed that the ICO completes work on a complaint regarding Data Protection issues in an average of 68 days.

The ICO is not an enforcement body and, even where wrongdoing is found, may not take any action to provide the individual with redress. In their own words the ICO explains that:

Our role is not to investigate or adjudicate on every individual complaint. It is up to us to decide whether or not we should take further action. If you are seeking personal redress or compensation for the way an organisation has dealt with your personal information, you will need to pursue this independently through the courts or with an industry's own ombudsman or regulatory body.

The “Panel Pack”

If you do not receive a panel pack A bundle of documents compiled by the headteacher to support their case for exclusion. It will be provided to the governors and the family ahead of the review meeting. , or receive an incomplete panel pack A bundle of documents compiled by the headteacher to support their case for exclusion. It will be provided to the governors and the family ahead of the review meeting. , you do not have a right to have more information added. However, you can add your own evidence and submit documents to the governors, which is covered in the Step-by-Step Guide: Preparing Written Arguments for the School’s Governors.

In addition, you can ask the governors to seek additional evidence, or to discard arguments made by the school that are not supported by any of the evidence they have submitted.