2.0 Handling Requests for Information

The following legislation provides individuals with rights to access information:

The Freedom of Information Act 2000 (FOI) applies to all schools which are public bodies and gives the public access to recorded information held by the school, subject to certain exemptions.
The Environmental Information Regulations 2004 (EIR) enable people to access environmental information held by public authorities, including schools, such as information about land development, pollution levels, energy production or waste management.
The Data Protection Act 1998 (DPA) applies to all schools as data controllers holding personal information about pupils and employees. Personal data is defined as any information, in any format, which directly or indirectly identifies any living individual(s).
The Education (Pupil information) (England) Regulations 2005 (Pupil Information Regulations) gives parents of pupils at maintained schools the right to access their children’s educational records

One request might ask for several different pieces of information and so more than one piece of legislation may apply to a single request. This can affect, for example, the request response deadlines and which exemptions might apply. It is essential to establish which legislation applies, as soon as the request is received.

A request does not have to refer to the relevant legislation in order for it to be a valid request and legal definitions may be very different to your school's interpretation of these terms. Therefore it is essential that a senior person in school takes responsibility for determining obligations and achieving legal compliance.

[2.1] Freedom of Information

Under the Freedom of Information Act (FOIA), any person has a legal right to ask for access to recorded information held by the school. They are entitled to be told whether the school holds the information, and to receive a copy, subject to certain exemptions.

It is important to note that it is an offence to willfully conceal, damage or destroy information in order to avoid responding to an enquiry, so it is important that no records that are the subject of an enquiry are amended or destroyed.

Requests under FOI can be addressed to anyone in the school; so all staff must be aware of the process for dealing with requests. In order for a FOI request to be ‘valid’, requests must be made in writing, (including email and social media platforms), and should include the enquirers name and correspondence address, and state what information they require. They do not have to mention the Act, nor do they have to say why they want the information.

There is a duty to respond to all requests, telling the enquirer whether or not the information is held, and supplying any information that is held at the time of the request, except where exemptions apply. There is no need to collect new data in specific response to a FOI enquiry. Upon receipt of a valid request, your school has 20 working (school) days to respond.

A list of exemptions can be found in the National Archives guide (found under Useful Documents).

Note that the FOIA does not give people access to their own personal data - if a member of the public wants to see the information which a public authority holds about them, they should make a subject access request under the Data Protection Act 1998, as outlined in our guide to Subject Access (see Useful Documents). It is important to note that an individual does not have a right of access to the personal information of anyone else unless they are a legally appointed guardian or that other person has given consent.

The ICO offers guidance on the information which schools have to publish, and has created a model publication scheme, intended to help smaller schools in particular to comply with this.

The starting point of the Act is that information should be made available in order to promote transparency and accountability.

For schools this means you should:

Adopt and maintain a publication scheme - which publicises what information your school already makes available. (see model scheme);
Set up a process to deal with information requests (see flowchart);
Set up a records management programme - policies and procedures to manage the information your school holds. (See 5.0 Records Management);
Ensure all requests are dealt with within 20 working (school) days

All documents mentioned can be found below under Useful Documents.

[2.2] Environmental Information Regulations

Schools are legally obliged to:

Make environmental information available proactively;
Respond to members of the public who request environmental information;

'Recorded information' includes printed documents, computer files, letters, emails, photographs, and sound or video recordings.

These regulations apply only to the environmental information held by public authorities. Access to personal information or other non environmental information should be handled under the relevant legislation.

The ICO has published a detailed guide to the Environmental Information Regulations which can be found under useful Documents below, this is a step by step guide to handling a request for information subject to EIR.

When the school receives a request for information, it should consider whether the requested information is environmental and should be dealt with under the Regulations. In most cases this will be fairly clear, for example, information about land development, pollution levels, energy production, and waste management.

[2.3] Subject Access Requests

The right of subject access is created by section 7 of the Data Protection Act. It is most often used by individuals who want to see a copy of the information an organisation holds about them. However, the right of access goes further than this, and an individual who makes a written request and pays a fee (if required) is entitled to be:

told whether any personal data is being processed;
given a description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people;
given a copy of the information comprising the data; and given details of the source of the data (where this is available).

Under the right of subject access, an individual is entitled only to their own personal data, but not to information relating to other people (unless they are acting on behalf of that person). Subject access provides a right to the information held about an individual, rather than a right to see the documents that include that information. Various exemptions from the right of subject access apply in certain circumstances or to specific types of personal data; It is important to note that examination scripts are exempt under subject access and should not be disclosed to applicants (Schedule 7, Section 8(1)).

Please see the ICO website for more information on DP exemptions [New Window]

In order for a request to be valid it must be made in writing, the school must be certain as to the identity of the requestor and if applicable the appropriate fee provided. The maximum you can charge for such requests is £10 however this is at the discretion of the individual school. The school will then have a timescale of 40 calendar days in which to respond. Please note that if you require further information from the requestor (to validate their identity or clarify their request) then the 40 Calendar Days do not start until you have received that further information.

If a parent is making a request under Subject Access on behalf of their child you should be satisfied that they have a legitimate right to this information i.e. parental responsibility. If the child has capacity to make his or her own request, or understand the consequences of disclosure, usually at age 12, consent should be sought from them as they may object to the disclosure.

[2.4] Pupil Information Regulations

The right to access pupil information is in effect, the same under both regulation 5 of the Pupil Information Regulations (PIR) and section 7 of the DPA.

Most of the recorded information you hold about a pupil will fall under their ‘educational record’. Categories of information which will typically not be included are for example, notes made by teachers for their own use or information provided by the parent of another pupil. This type of information would fall under the Subject Access umbrella however you may wish to exercise your discretion where possible to avoid working to two separate timescales and legislations from a customer service perspective.

The fundamental difference is that the PIR give parents a right of access to their child’s information whereas under Subject Access Procedure they are doing so on behalf of their child; therefore under PIR, pupils cannot prevent a parent from accessing their educational record. You should not disclose the educational record however, if the information contained within could not lawfully be disclosed to the pupil under DPA or if the pupil would have no right to access the information due to an exemption.

You have 15 school days in which to comply with such requests. You can charge what it costs to supply a copy of the information however it is free should the parent wish to view the educational record instead. Further information on charges can be found on page 51 of the Subject Access Code of Practice. If the request is for other information excluding the educational record then the maximum charge is £10 (as per Subject Access procedure). Under GDPR the option to charge for Subject Access Requests will be abolished so it is advised that you do not include this in your school’s information governance policies.