Data Subject Access Request (DSAR) in an independent school

Nick Hobden (Partner and Head of Employment) has recently assisted an independent faith school in relation to a number of personal data requests, including a Data Subject Access Request (DSAR) and request to cease processing of personal data, made by the parents of one of their ex-learners.

Through the team’s experience in the Education sector and DSARs we were able to assist the school throughout the process which included advice on the remit of the school’s searches for personal data, how it should be organised and redaction of other people’s personal data.

The team initially advised on the fact that the request had been made on behalf of the ex-learner who had capacity to understand their own personal data rights.  To avoid breaching the individual’s personal data, the team worked with the school to draft an initial response which outlined the above and requested proof of authority from the ex-learner that their parents could act on their behalf and receive their personal data.  In the light of the longevity of the ex-learner being with the school and the initial review of personal data, which produced a huge volume of documents (involving  over 230 email inboxes), a request was made to narrow the scope of the DSAR.

The school received a positive proof of authority, but the scope of the DSAR remained very wide.  Working with the school, the team drafted a further letter that documented the above and stated that the school would need a further two months to comply with the DSAR and request to cease processing of the ex-learners personal data.

Once the school had collated all of the documentation that contained the ex-learner’s personal data, they narrowed down the information into sections and, with a view to saving on costs, redacted the documents which came to roughly seven lever arch files.  The team conducted a very light touch approach in reviewing some of the documentation to ensure it was redacted and organised in an appropriate manner.

During the DSAR, the ex-learner’s parents lodged a complaint threatening legal claims against the school. Douglas Skilton, partner in our Dispute Resolution team, advised on the complaint issues and helped with the preparation of a suitable response. It was important to ensure that the response addressed not only the threated legal claims, but that it was consistent with and supported the correspondence which had been prepared in relation to the DSAR.

Once the document review was complete, the team assisted with drafting of a covering letter which outlined the DSAR and the school’s cessation of processing the ex-learner’s personal data (albeit with exemptions).

By working together, the firm and the school were able to complete what was a very administratively demanding DSAR and complaint in time and at an agreed cost.  We are pleased to say the matter did not need to be referred to the ICO.