Tom Middlehurst, head of policy and public affairs, reflects on an earlier conversation with Wrigleys Solicitors about data, students’ requests for their grades, and what schools should be doing now grades are submitted.
As teachers and curriculum leaders finalise students’ centre assessment grades and rankings over the coming week, and make the final submissions to the exam boards (an overly-arduous task in some boards’ cases), it may feel as though the work on this summer’s grading is drawing to a close. However, in the few weeks between now and the usual end of term, schools must be considering the possibility of a significant data exercise following results day in Autumn.
Following our online webinar with Chris Billington, head of education at Wrigleys Solicitors, many school leaders have commented how they underestimated the data challenge they may face this summer. You can watch the full presentation by Chris, but here are a few reminders, as well as key actions to take in June and July.
Confidentiality
Until results are published in August, both CAGs and rank order must be kept confidential. If any member of staff discloses either of these to students or parents, it could be considered exam malpractice and violation of the teacher standards.
It is likely that, in the coming weeks as final submissions are made, students may be curious to find out the grade their teacher has given them. School leaders must remind all staff of their professional duties and the need to keep this data strictly confidential.
Even after the publication of results in August, both the CAG and rank should be considered confidential. Any data access requests should be handled by the school’s data protection officer. Individual staff should continue to not respond and refer all enquires to the designated person.
How teachers should respond to a student asking for their grade
This is the question SSAT has been asked most since this process started. As Chris clarified in his update any data access request from a student, whether intentional or not, is valid and must legally be responded to.
This means that, if a student asks – either verbally or in writing – for their grade or rank order you must respond to this as a school. A student or parent does not have to use any particular language, fill in a particular form, or even use the words ‘access request’. So, if a student asks the question: “Ms / Sir: what grade are you giving me?” this should be considered an access request. Any teacher that is asked this question must refer it to your school’s Data Protection Officer, who should get back to the student within the legal timeframe.
This may present a real dilemma for schools, as students may ask this and be satisfied by being told it’s confidential, and not realise that they have made a data access request. However, to ignore these, brush them under the carpet or failure to respond to them, puts you under breach of data regulations, and potentially open to significant fines.
What’s the timeline for responses?
The good news for schools is that requests of this kind, that come now and in the coming weeks, gives you something of a breathing-space. Due to the confidentiality mentioned above, you are not allowed to respond until results are published. This delay actually gives you a delay of five months, giving you more time to respond to a school.
Whereas a request (as above, whether made consciously or not) on or after August results’ days must be responded to in the usual time frame of one month. As some staff may not be working in August, this could present a greater challenge for schools than requests made before August.
What do you have to provide?
There’s no simple answer to this question as what you need to offer depends on the exact wording of the written or verbal request.
It’s most likely that students will request their CAG and rank order, and how this decision was reached. If so, you will need to provide the submitted CAG for the student, their rank number within the grade (without naming other students), and any stored documentation that pertains to this. That includes saved and deleted emails between teachers about the CAG process and any guidance issued to staff about how to go about grading.
Since 2018 it has been a legal obligation on all schools as data controllers to track and log emails that pertain to student’s data, and so any emails relating to students’ grades should be easily accessible through your CRM system or alternative.
Do you have to do it?
Quite simply, yes – it’s the law. There are, rightly, severe penalties on data controllers including schools who do not comply with data regulations, in order to protect everyone’s privacy.
What’s the difference between a FOI and a data subject access request?
Again, there’s no formal language that needs to be used for any student or parent to make either a freedom of information request or a data access request.
What it is will depend on the nature of the query. A FOI will ask for information that does not identify individuals, whereas an access request relates to the specific data on the individual. A request could incorporate both.
How should schools prepare in the coming weeks?
As a first step, are all teachers and all staff aware of what constitutes a data access request, and is there a clear process for logging this / referring to your data protection officer? Remind all staff that a simple question from a student or parent is a data subject request, whether the subject knows it or not, and must be treated as such.
Consider getting a pack ready to sent out as part of a response to both FOIs and DSARs; this should include any guidance given to teachers about how to assess students, government guidance, and any other guidance that was used.
Make sure your data privacy notice is up to date and ensure it is being enacted.
Checklist for senior leaders
- All staff understand that until August, and beyond unless requested as below, CAGs and rank orders are confidential; and divulging them to students or parents is exam malpractice
- All staff understand that any written or verbal request for a CAG, whether conscious or not, is a data access request, and must be reported and followed up
- There is an easy system for tracking all access requests and FOIs / easy referral to your school’s data protection officer
- An acknowledgement is sent to requests made before results day stating a response will come within five months
- Your data privacy statement is up to date
- All emails, documents, etc (including deleted emails) relating to either CAG or rank order are tracked and easily accessible if needed, and in line with your privacy statement
- Pack is prepared for general FOIs and specific access requests
- Necessary staff including the data protection officer are in place to work in August after results days
- Any requests that come in on or after results day are responded to within a month
- Any requests that came in before results day are responded to within 5 months of the request.
