Data Subject Access Requests – a case study in the education sector

A Data Subject Access Request (DSAR) is often made in an education setting by a student  (data subject) or the parents of a data subject who want to access the student’s data. DSARs can be made for many reasons, for example accessing the data subject’s general education information, or more specifically in the contemplation of a claim against an education setting by a data subject or their parent. Requests for these purposes are often wide in scope and used by a claimant to capture information which may support a potential claim.

This case study demonstrates the amount of time, knowledge and resources required to deal thoroughly and accurately with a DSAR and in advising on, assisting with and responding to DSARs with and on behalf of clients.

Background

The Employment team at Thomson Snell & Passmore assisted a high performing Grammar School with Academy Trust status dealing with and responding to various DSARs submitted by parents of a student at the school, in connection with a claim in the First Tier Tribunal (Special Educational Needs and Disability Tribunal), following a series of complaints.

Over the course of the claim, the Employment team assisted the school with several DSARs relating to the claim. We assisted by advising on time limitations for responding to a DSAR, being one month from the date of receipt of the DSAR (and the possible circumstances where requests can be refused and/or the time limits extended), the nature of the DSAR and, after sifting through a vast number of documents provided to us by the School, carrying out redactions, to ensure that legally privileged information and data belonging to any other data subjects were not disclosed, therefore preventing unlawful processing of personal data belonging to other data subjects.

After  the claim against the school was withdrawn, the parents made a further  DSAR (‘the final DSAR’), requesting all emails, documents and other correspondence which contained the name of the student, including their initials, over a ten month period whilst the student was attending the school. Upon reviewing the request, we advised the school that it was a complicated request for several reasons. Firstly, a mammoth cross-referencing exercise needed to be undertaken to ensure that data which was disclosed during the course of litigation and the previous DSAR disclosures were not disclosed again within the final DSAR response (there were overlaps in time). Secondly, the request for the student’s initials to be used as a search term was refused, on the basis that the initials formed a commonly used word in the English language, which would have generated thousands of results. Thirdly, the nature of the request, uncovering every email, document and other correspondence containing the name of the student over a ten month period would mean disclosing a huge amount of data, especially considering there were other students at the school with the same first name and the search terms generated all of their data too.

Our role

Given the nature of the DSARs, in particular the final DSAR, the work involved in completing and responding to the request was enormous. Over the course of weeks, we assisted with the following:

• Considering the scope of the DSAR

A DSAR can include a request for all information held by an organisation about the data subject, however, the Information Commissioners Office (‘ICO’) prescribes that in some cases, not all information requested is disclosable

The ICO makes clear in its guidance that a DSAR may be refused altogether on the grounds that it is manifestly excessive, such as where so much of the request overlaps with an earlier request. Other grounds for refusal include where a request is manifestly unfounded. Examples of which include a request which appears malicious, where the data subject is using the request to harass an organisation or making the request with no real purpose other than to cause disruption. These principles were successfully applied to the final DSAR, where we advised the school and wrote to the parents to inform them that the request was both manifestly excessive (in that it overlapped with earlier requests that had been complied with  and the search terms requested would have generated thousands of results); and manifestly unfounded as the majority of data had already been disclosed during the course of litigation and previous DSAR disclosures

• Responding to the final DSAR

Our first task was to convert all documents provided by the school into PDF format, to enable us to upload to our redaction software. This took a significant amount of time due to school records often comprising of emails, spreadsheets, PowerPoint presentations and hand written notes.

The DSAR specified search terms to be searched against the school’s database which included the student’s name and initials. Whilst we did not use the student’s initials as a search term (informing the parents this was manifestly excessive), their name revealed results which included non-disclosable data such as references to other data subjects with the same first name.

We also manually cross-referenced the dates within the requested ten month period to ensure that any documents which overlapped with the former legal proceedings and previous DSARs were not included.

Once we had finalised our de-duplication and had a bundle of the relevant documentation, we then begun our redaction exercise; removing those pieces of data which were not to be disclosed as part of the DSAR response, either because they were legally privileged or because they contained other data subject’s information. This was done manually, by carefully and meticulously reviewing each document and applying redactions where necessary. We then carefully arranged the documents into chronological order and disclosed them to the parents, by the required deadline.

Going forward

Whilst all DSARs made to the school by the parents, with our assistance, were dealt with in accordance with ICO and Data Protection rules and timings, they were, in particular the final DSAR, hugely complex. It took several weeks of lawyer and support staff time to finalise the DSAR, which led to high costs for our client.

Our recent article on DSARs in the education setting, explains how our new, state of the art piece of secure artificial intelligence software, can cut these weeks down to days, by carrying out the processes automatically and reducing lawyer time. Therefore, and most importantly, significantly reducing legal costs in the process.

Whilst our new software is available and useful for all of our clients, whether in the education setting or otherwise, we are aware that within the education setting, there is often a huge amount of data stored for each student, and that data is often stored in several different ways, including hand-written notes. Our software is able to easily handle large quantities of data and can read and apply redactions to a huge range of document types, including hand-written documentation.

Our Employment team are specialists in education and dealing with DSARs. If you have a DSAR that needs responding to, or any questions, please do not hesitate to call us and we will guide and support you.