To ask the Secretary of State for Education, what the criteria is for refusing current and former school pupils subject access requests for personal confidential data in the National Pupil Database; and what steps she is taking to ensure that criteria complies with the General Data Protection Regulation.
Answered on
26 October 2017
Under section 7 of the Data Protection Act (DPA), an individual has the right to ask an organisation to provide them with personal confidential information they hold which identifies them and, in certain circumstances, a parent can make such a request on behalf of a child.
A subject access request for personal confidential information may be refused if it falls within a statutory exemption. The Research, History and Statistics exemption (section 33(4) of the DPA), applies to personal data being processed for research, historical or statistical purposes. As the personal information that a pupil or parent has requested is held on the NPD for these purposes, it is exempt from release to the pupil or parent.
The Department is undertaking a programme of work in preparation for General Data Protection Regulation coming into effect in May 2018. This will include a review of the policies and processes associated with Subject Access Requests.