SARvalanche risk: FORT/HIGH
As a keen skier, the Outsourced DPO is familiar with the avalanche risk rating system designed to inform skiers of the varying risk of an avalanche at various locations on the mountain. Currently, it seems that the potential for an avalanche of subject access requests (SARs) is high, in particular from people whose employment may be terminated at the end of the Government furlough scheme as well as from people awarded predicted grades in public examinations or university courses.
According to reports from the BBC up to 9 million people representing 25% of the UK’s workforce is on furlough leave. Whether they will all be required back in the workplace once the lockdown eases and the world economy stutters back to life remains to be seen but it seems likely those who are surplus to requirements will want to know how and why they were selected for furloughing and then selected for redundancy. Even if the scope of the SARs is narrow, that may be a lot of requests to field and respond to and it might be as well for data protection and governance teams to risk assess their ability to respond and to ensure they have procedures in place that will efficiently locate records and prepare them for disclosure.
Another specific area of concern to the Outsourced DPO is in the education arena. The cancellation of the GCSE and A-level exams in England, Wales and Northern Ireland means that thousands of young people will have their grades awarded on the basis of teachers’ predictions, previous exam results, coursework, essays, homework and professional judgement. From what the Outsourced DPO understands, a school’s previous performance will also be taken into account meaning that in general terms, the number of people achieving each grade is likely to form a similar pattern to the actual results from the last few years. Whilst this high-level consistency might be good for employers and down-stream academic institutions, there may be many individual students who are not satisfied with the grades they are awarded. A-level results are to be published on 13th August with GCSE results published on the 20th and for many people, their future hangs in the balance and out of their control.
It seems likely therefore that schools will be subject to subject access requests from students wanting to know how their predicted grades were determined. The most interesting aspect of this from a data protection perspective is the extent to which the disclosure exemption covering exam scripts and exam marks could be relied upon by schools and colleges. The Data Protection Act defines what “examination” means and how the exemption can be applied. It is fairly narrowly construed and does not provide much cover for education institutions in the circumstances of grades being awarded without examinations.
It doesn’t seem unreasonable to anticipate a surge of SARs following the publication of results as students race to figure out their options and next steps and in some cases, grapple with being disappointed with their grades derived through an administrative assessment process rather than a country-wide academic test.
Our advice is to prepare for an avalanche of SARs and hope that it doesn’t arrive.
Data Protection People operates a subject access request bureau service. For more information contact [email protected]