This is a summary taken from Judicium’s DPO ‘Sofa Session’ from the 27th of April with Senior Data Protection Consultant Marie Turner, LLB (Hons), L.P.C., PC.dp GDPR. This session was focused on: Parental Responsibility – what does it mean, who has it or how can it be acquired; How do family proceedings impact Parental Responsibility and what do we need to look out for on court orders; How do parental rights impact on data requests under UK GDPR and requests for education records under education law; and other considerations (such as safeguarding) when responding to requests.

What does Parental Responsibility mean? 

Parental Responsibility (PR) is defined under s3 of the Children Act 1989 as “all rights, duties, powers, responsibility and authority which, by law, a parent of a child has concerning the child and their property.”  

In effect it gives parents the responsibility to make important decisions such as whether their child should receive medical treatment, which school they should attend and what name they should be known by.

PR lasts until a child is 18 or until married.

Who has Parental Responsibility?

It may sound simple, but it’s not. The one person who you can be assured will have PR is the child’s biological mother.

Married fathers will also automatically have PR whether they marry the mother before or after the birth.

A married father will not lose PR if he divorces the child’s mother.

What about unmarried fathers? 

If the child is born on or after 1st December 2003 (which will apply to the children we are dealing with in school today) and the father is named on the birth certificate he will automatically have PR.

Unmarried fathers to children born before 1st December 2003 would not automatically have PR even if named on the birth certificate, but they may be able to acquire it.

Unmarried fathers can acquire PR by entering into a PR agreement with the mother of his child, by the court making a PR order, or by marrying the mother.

Essentially schools cannot presume that an unmarried father has PR.  It will be for him to prove he has PR by providing either a copy of the birth certificate, a parental responsibility agreement or a parental responsibility court order. If in doubt check with your DPO before providing data and they can advise you of the documentary evidence you may require.

What about same sex parents? 

With a female couple where a child is conceived via fertility treatment, and they are married or in a civil partnership, both parents will have PR. Both names will be added to the birth certificate and the child will not have a legal father.

Matters are more complicated where the couple are not married as the unmarried partner may need to apply to the court for parental responsibility.

With male couples, the couple will need to make an application to the court to remove PR from the surrogate. Another option is to apply for an Adoption Order which would remove PR from the surrogate in favour of the couple.

What about non-biological parents? 

• Adopting the child
• They are appointed as guardian of the child
• The court makes a child arrangement order stating that the child is to reside with the parent/s
• The court makes a special guardianship order
• The non-biological parent succeeds in making an application to the court for parental responsibility or enters into a parental responsibility agreement
• A care order, emergency care order or interim care order is made in respect of the child

NB: The person seeking data must prove they have parental responsibility by way of an agreement or court order. More than one person, and even several people, can hold and exercise PR for a child.  The PR of one party does not necessarily stop simply because another person is also given it. If in doubt, do not disclose without checking with your DPO first.

The 5 most relevant types of Court Orders for schools relating to PR

• • For example, a child arrangement order is made in favour of an older sibling. If the older sibling were to make a subject access request and provided a copy of the Child Arrangements Order, the school could be satisfied that the sibling also has PR and is therefore entitled to the data. However, it would be necessary to be sure that the order was still in force and to check with your DPO if in doubt.

• • Examples include prohibiting a parent from taking a child abroad on a permanent basis, preventing a course of medical treatments or preventing a parent from changing a child’s school.

• • An example is an order allowing one parent to agree to a pupil changing school against the wishes of the other parent.

These can be made until a child is 17 on application by any local authority. While a care order is in force the LA shall have PR for the child and the power to determine the extent to which a parent or guardian may meet their parental responsibility.

The court may make an order placing the child in care/or under supervisions if satisfied that the child concerned is suffering, or is likely to suffer significant harm and that the harm is attributable to the care given to the child or the child is beyond parental control.

A local authority can acquire PR for a child if the court makes a care order, emergency protection order or interim care order in respect of that child. 

The Local Authority will then share PR with anyone else who has PR for the child, but the Local Authority can overrule any decisions that they do not feel are in the child’s best interests.

An LA can apply for a specific issue order or a prohibited steps order.

A non-molestation order is aimed at preventing violence or threats of violence against a person or their child, or the intimidation, harassment of a person or their child in order to ensure the health, safety and well-being of a person and their children.

The Order can be made against an “Associated person” to include spouses, ex-spouses, civil partners, ex-civil partners, cohabitees, and former cohabitees. It can also include various family members.

It is important to acknowledge that whilst it is incredibly important for schools to be aware of the content of such orders for safeguarding reasons, such an order will not necessarily impact upon Parental Responsibility.

• • For example, if an occupation order has been made against an absent father due to his violence towards his partner and his children, he would still have PR and be entitled to access his child’s data (subject to the usual exemptions).

How can a parent lose Parental Responsibility?

• For example, in respect of a birth mother and birth father who are married, the only way the couple would lose parental responsibility is if the child is made subject to an Adoption Order.

Are there any exceptions?

It is possible for the Court to remove Parental Responsibility from an unmarried father without a child being placed for adoption.

A mother can apply to court for an order to terminate a father’s parental responsibility.  However, it is only granted in a small number of cases where circumstances are exceptional. 

• For example, where there has been serious violence/sexual assault against the mother or the child.

How are requests for education records different?

Access to education records is a separate right and is not covered by Data Protection legislation. Unlike the right to access under the Data Protection legislation, this right does not extend to pupils.

Just to make life even more complicated those with “parental authority” can apply to the school to view an education record or receive a copy.

It is important to understand that there is a distinction between the concepts of Parental Responsibility and Parental Authority.

It is important that schools are aware that parents may be recognised differently under education law than under family law. 

The definition of “parent” in education law is much wider than any other field.

Section 576 of the Education Act 1996 states that a “parent” includes a child’s natural parents, anyone, or anyone caring for the child. 

In England & Wales the right only applies to all local authority schools and all special schools including those which are not maintained by the LA.  Independent schools, Academies and free schools are not obliged to respond to a request for access to a pupil’s education record.  However, academies have a responsibility to provide educational reports. The school must comply with a written request within 15 school days, not including school holidays.

Requests for Educational Records v Subject Access Requests under the GDPR

If the parent submits a SAR to the school for all their child’s personal data, it will need to disclose both the information contained in the education record and any other personal data the school holds.

If the request is for the education record, the school will only need to disclose the information contained in the record and will not be obliged to disclose any further personal data.

What happens when a request poses a safeguarding concern? 

Even if the school is satisfied that the person seeking data has PR, special care will still need to be taken in considering whether there are safeguarding reasons to withhold the information as part of the SAR.  If harm is likely to be caused, either physical or psychological, by the disclosure, it will be exempt from disclosure on the grounds of safeguarding.

Where parents are separated, schools should be mindful to protect the private data of each parent from any other and avoid inadvertent disclosure.  This is particularly important given that some parents will have been, or may be at risk of being, a victim of domestic violence.

Schools need to take the same care when providing information in a scenario where a child is in care, where foster parents’ details must not be disclosed to the biological family as part of safeguarding the child.

Key takeaways for schools concerning 'Parental Responsibility' and 'Parental Authority' 

• A person must have parental responsibility to apply for information under a SAR or provide consent in relation to the GDPR.
• It is for the person seeking access to data (other than educational records) to prove evidence to the school that they have parental responsibility.
• This evidence will usually be in the form of a birth certificate, a parental responsibility agreement or a court order.
• The complications come when a child is taken into care or there is a court order in place limiting the scope of parental responsibility or a court order comes to an end. NB: The school must ensure that they have copies of the most recent court orders and carry out necessary investigations to avoid a data breach.
• The school staff must treat all those with PR equally, unless a court order limits parent’s ability to make educational decisions, participate in school life or receive information about their children.
• A request for education records can be made by a person with parental authority.
• A SAR can only be made by a person with parental responsibility.
• Schools need to be particularly careful where they are aware of safeguarding issues or where a court order in place.
• Schools are entitled to take the appropriate time to seek advice and make further enquiries and should not feel pressured to release information. Their duty of care to the child and the mother are paramount.
• If in doubt, consult your DPO.

Helpful Information:

UK GDPR - https://uk-gdpr.org/

• P (Termination of Parental Responsibility) [1995] 3 FCR 753.
• CW v SG [2013] EWHC 854 (Fam)
• A v D [2013] EWHC 2963 (Fam)
• C v D & another [2018] EWHC

Judicium also offer a range of GDPR e-learning designed for schools. You can see current course availability here.