Data Protection Act 2018

PART 4 U.K. Education data

Educational records U.K.

13 U.K. In this Part of this Schedule “educational record” means a record to which paragraph 14, 15 or 16 applies.

14 (1) This paragraph applies to a record of information which— U.K.

(a) is processed by or on behalf of the proprietor of, or a teacher at, a school in England and Wales specified in sub-paragraph (3),

(b) relates to an individual who is or has been a pupil at the school, and

(c) originated from, or was supplied by or on behalf of, any of the persons specified in sub-paragraph (4).

(2) But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.

(3) The schools referred to in sub-paragraph (1)(a) are—

(a) a school maintained by a local authority;

(b) an Academy school;

(c) an alternative provision Academy;

(d) an independent school that is not an Academy school or an alternative provision Academy;

(e) a non-maintained special school.

(4) The persons referred to in sub-paragraph (1)(c) are—

(a) an employee of the local authority which maintains the school;

(b) in the case of—

(i) a voluntary aided, foundation or foundation special school (within the meaning of the School Standards and Framework Act 1998),

(ii) an Academy school,

(iii) an alternative provision Academy,

(iv) an independent school that is not an Academy school or an alternative provision Academy, or

(v) a non-maintained special school,

a teacher or other employee at the school (including an educational psychologist engaged by the proprietor under a contract for services);

(c) the pupil to whom the record relates;

(d) a parent, as defined by section 576(1) of the Education Act 1996, of that pupil.

(5) In this paragraph—

• “independent school” has the meaning given by section 463 of the Education Act 1996;

• “local authority” has the same meaning as in that Act (see sections 579(1) and 581 of that Act);

• “non-maintained special school” has the meaning given by section 337A of that Act;

• “proprietor” has the meaning given by section 579(1) of that Act.

15 (1) This paragraph applies to a record of information which is processed— U.K.

(a) by an education authority in Scotland, and

(b) for the purpose of the relevant function of the authority.

(2) But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.

(3) For the purposes of this paragraph, information processed by an education authority is processed for the purpose of the relevant function of the authority if the processing relates to the discharge of that function in respect of a person—

(a) who is or has been a pupil in a school provided by the authority, or

(b) who receives, or has received, further education provided by the authority.

(4) In this paragraph “the relevant function” means, in relation to each education authority, its function under section 1 of the Education (Scotland) Act 1980 and section 7(1) of the Self-Governing Schools etc. (Scotland) Act 1989.

16 (1) This paragraph applies to a record of information which— U.K.

(a) is processed by or on behalf of the Board of Governors, proprietor or trustees of, or a teacher at, a school in Northern Ireland specified in sub-paragraph (3),

(b) relates to an individual who is or has been a pupil at the school, and

(c) originated from, or was supplied by or on behalf of, any of the persons specified in sub-paragraph (4).

(2) But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.

(3) The schools referred to in sub-paragraph (1)(a) are—

(a) a grant-aided school;

(b) an independent school.

(4) The persons referred to in sub-paragraph (1)(c) are—

(a) a teacher at the school;

(b) an employee of the Education Authority, other than a teacher at the school;

(c) an employee of the Council for Catholic Maintained Schools, other than a teacher at the school;

(d) the pupil to whom the record relates;

(e) a parent, as defined by Article 2(2) of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)).

(5) In this paragraph, “grant-aided school”, “independent school”, “proprietor” and “trustees” have the same meaning as in the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)).

Other definitions U.K.

17 (1) In this Part of this Schedule— U.K.

• “education authority” and “further education” have the same meaning as in the Education (Scotland) Act 1980;

• “education data” means personal data consisting of information which—

  (a)

  constitutes an educational record, but

  (b)

  is not data concerning health;

• “Principal Reporter” means the Principal Reporter appointed under the Children's Hearings (Scotland) Act 2011 (asp 1), or an officer of the Scottish Children's Reporter Administration to whom there is delegated under paragraph 10(1) of Schedule 3 to that Act any function of the Principal Reporter;

• “pupil” means—

  (a)

  in relation to a school in England and Wales, a registered pupil within the meaning of the Education Act 1996,

  (b)

  in relation to a school in Scotland, a pupil within the meaning of the Education (Scotland) Act 1980, and

  (c)

  in relation to a school in Northern Ireland, a registered pupil within the meaning of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3));

• “school”—

  (a)

  in relation to England and Wales, has the same meaning as in the Education Act 1996,

  (b)

  in relation to Scotland, has the same meaning as in the Education (Scotland) Act 1980, and

  (c)

  in relation to Northern Ireland, has the same meaning as in the Education and Libraries (Northern Ireland) Order 1986;

• “teacher” includes—

  (a)

  in Great Britain, head teacher, and

  (b)

  in Northern Ireland, the principal of a school.

(2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to education data if the application of Article 15 of the GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.

Exemption from the listed GDPR provisions: data processed by a court U.K.

18 (1) The listed GDPR provisions do not apply to education data if— U.K.

(a) it is processed by a court,

(b) it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and

(c) in accordance with those rules, the data may be withheld by the court in whole or in part from the data subject.

(2) Those rules are—

(a) the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);

(b) the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));

(c) the Family Proceedings Rules (Northern Ireland) 1996 (S.R. (N.I.) 1996 No. 322);

(d) the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);

(e) the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));

(f) the Sheriff Court Adoption Rules 2009;

(g) the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));

(h) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).

Exemption from Article 15 of the GDPR: serious harm U.K.

19 U.K. Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to education data to the extent that the serious harm test is met with respect to the data.

Restriction of Article 15 of the GDPR: prior opinion of Principal Reporter U.K.

20 (1) This paragraph applies where— U.K.

(a) a question arises as to whether a controller who is an education authority is obliged by Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) to disclose education data, and

(b) the controller believes that the data—

(i) originated from or was supplied by or on behalf of the Principal Reporter acting in pursuance of the Principal Reporter's statutory duties, and

(ii) is not data which the data subject is entitled to receive from the Principal Reporter.

(2) The controller must inform the Principal Reporter of the fact that the question has arisen before the end of the period of 14 days beginning when the question arises.

(3) Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.