GDPR: Get SAR Ready for Results Season

An exam results season without actual exams could create challenges for schools when it comes to appeals, says Craig Stilwell of Judicium, who offers some advice.

We all know it will be another very different exam results season this summer.

Schools around the country have been asked to determine teacher-assessed grades, or TAGs, for their GCSE and A level students, using a range of methods, including mock exams, class tests and coursework.

This August shouldn’t see a repeat of the angst caused by last year’s quickly abandoned algorithms, but the unique nature of this year’s approach could still create some challenges for school leaders and their teams who will be on the front line of appeals.

Guidance from the Joint Council for Qualifications (JCQ) says that although centres will have done robust internal checks and a quality assurance exercise to ensure the grades that they submit to awarding organisations are correct “ there is always a small possibility that a procedural or administrative error is identified,” adding “If, after results day, you have identified an error...students in these circumstances will have a right of appeal against the grade change.”

That first appeal will go through their school or college and this can then be taken further to Ofqual, if required, with a priority appeal deadline of Monday, 23 August and Friday, 17 September for non-priority appeals.

Ofqual has confirmed that the appeals process will involve pupils initially asking schools to check for errors before asking exam boards to consider whether the original grades were a “reasonable exercise of academic judgement”.

Such situations are a test for a school’s responsibilities under the GDPR (UK) regulations and they need to be prepared for the possibility of Subject Access Requests (SAR) from parents or students.

So, where do schools stand as they prepare for August? Here are my answers to some key questions:

If we receive a Subject Access Request (SAR) from a parent, do we have to respond?

There may be discretion on the time limit for responding but in short, yes you will need to respond to each request.

We are worried that we might have an influx of students and parents making SARs. Will this be the case?

Not necessarily. Students do have a right to access the data that a school holds about them. It is likely that where students and/or their parents are unhappy with the grades they have been awarded that they may seek to request more detail about the decision-making process. This will normally be handles as part of the appeals process rather than as a SAR.

We have already received request about grading prior to results being published. Do we need to respond?

There is an exemption to the normal time limit for a SAR if the request is made prior to the publication of exam results. The definition of exam results does extend to assessment of a candidate’s performance, as is the case in this scenario. This exemption allows you to apply longer response times to responding to a request. These are (whichever is earlier):

• Within five months of receiving the request; or
• Within 40 days of announcing the exam results.

Once we have submitted the evidence to the exam board, can we just delete it from our systems?

Don’t delete this data. Disposing of it as a method to try and limit subject access requests is likely to be met with concern by the requester and the Information Commissioner’s Office (ICO). If you delete data earlier than is set out within your retention procedure, this could be challenged by the ICO who could take enforcement action. This could also amount to a personal data breach as an unlawful destruction of personal data. The exam boards will also expect you to retain this data for inspection in case of appeals.

Craig Stilwell is Head of Data Services at Judicium Education, a professional services company working with more than 1,700 schools across England. Judicium Education advises on health and safety, HR, legal services, clerking, governance and data protection. www.judiciumeducation.co.uk

As part of Judicium’s GDPR service, we offer support on dealing with SARs on behalf of clients. If you would like more information of how we can support you, please see details of the service here. We are available for support 52 weeksof the year so are able to help with SARs even over the summer.

For more information on Judicium's Subject Access Request Training on offer, please see details below. 

https://www.judiciumeducation.co.uk/elearning/introduction-to-sar-and-foi-requests

https://www.judiciumeducation.co.uk/elearning/subject-access-requests-in-depth

If you’d like to learn more about Judicium’s services, please feel free to contact Georgina de Costa on Georgina.decosta@judicium.com or 07399 185 443