We hope everyone has enjoyed their half term. Good luck to all schools who are returning to a phased opening next week and if you require any advice and assistance on homeworking or handling data whilst transitioning back into the workplace, please do email or call us and we will be able to assist you.

In the meantime, we will send out regular updates and FAQs to assist you. This is starting with subject access requests and exam results. As exams this summer have been cancelled, progress will be determined by calculated grades. The calculated grade process will take into account a range of evidence including, for example, non-exam assessment and mock results.

Guidance has been provided by the Department for Education and Welsh Government in parallel with the qualification regulators Ofqual and Qualifications Wales. In light of this we have received a lot of varying questions surrounding data protection issues that may arise in the future, so we have compiled a list of FAQs below:

If we receive a Subject Access Request (SAR) from a parent or student, do we have to respond to them?
There may be discretion on the time limit for responding (see below) but in short, yes you will need to respond to each request.

We are worried that we will have an influx of students and parents making SARs. Will this be the case?
Not necessarily. Data subjects do have a right to access the data that a school holds about them. It is likely that where students and/or their parents are unhappy with the grades they have been awarded that they may seek to request more detail about the decision-making process.

How parents and students will be able to challenge grading is currently being finalised by Government and regulators but this could have an impact on how many SARs you are likely to receive. They are currently working on guidance detailing an appeals procedure which encourages individuals to raise any concerns about grading through the appeals process whilst ensuring the appeal criteria is strict to avoid an influx of appeals. This detail should be provided in the coming days/weeks. In addition, if a student does not feel their grade reflects their performance, they will have the opportunity to take an exam in the autumn.

We have already received requests about grading prior to results being published. Do we need to respond?
There is an exemption to the normal time limit for an SAR if the request is made prior to the publication of exam results. The definition of exam results does extend to assessment of a candidate’s performance, as is the case in this scenario. This exemption allows you to apply longer response times to responding to a request. These are (whichever is earlier):

• Within five months of receiving the request; or
• Within 40 days of announcing the exam results.

Note this exemption only applies to requests prior to publication, this does not extend to requests made after publication which should be dealt with in the normal way.

Due to the pandemic, we are running a skeleton crew and our staff are already over stretched. What do we do if we cannot answer the request in time?
The ICO have stated that they are willing to be as flexible as they can be with responding to data requests and are happy to allow further time should it be required. However, they are reluctant for organisations to rely on a delay if there is no good reason for the delay (each request should be taken based on its individual circumstances). Judicium can advise you in all situations relating to this.

Once we have submitted the evidence to the exam board, can we just delete it from our systems?
No, you should not delete this data. Disposing of it as a method to try and limit subject access requests is likely to be met with concern by the requester and the ICO. If you delete data earlier than is set out within your retention procedure, this could be challenged by the ICO who could take enforcement action. This could also amount to a personal data breach as an unlawful destruction of personal data.