Guidance on requests for access to information held and rectifying personal data held
The data protection acts impose certain key responsibilities on data controllers (schools/ETBs) in relation to giving individuals access to the data which is held about them. The right of access applies to a person’s own personal data.
Any individual about whom a school/ETB holds personal data may make an access request under the Data Protection Acts. This would include employees (or former employees) and students (or former students). There is no “age of majority” in the Data Protection Acts and much of the personal data which schools/ETBs hold may relate to minors. Accordingly, schools/ETBs must be aware of what steps to take when an access request is made by a child or by a parent/guardian. For further guidance, see the section “Parental Access Requests” Where a student is under 18 years old, they are entitled to receive their data pursuant to an access request, regardless of whether their parent/guardian consents; however, Schools must be mindful where the data could be distressing or upsetting to a
student: For further information, see “There is no Age of Consent for Access Requests”
Where a solicitor makes an access request on behalf of an individual, it is advisable that legal advice should be sought as soon as possible. However, once the school/ETB is satisfied that the solicitor is acting on behalf of the data subject (by the solicitor furnishing a signed consent from the data subject), there is no legal requirement for the school to seek legal advice in the context of complying with a request.
It would be important in such a case that the school/ETB as data controller is satisfied that the person is genuinely acting on behalf of the person whose data is being requested. In the case of a solicitor’s letter requesting documents on behalf of an individual, (if it has not already been furnished with the request), the school should request a signed consent form in which the individual gives the solicitor consent to ask for the materials on their behalf. A prudent school should satisfy itself that the person asking for the information is one of those entitled to receive it and caution should be exercised in releasing information where there is any doubt on the issue of identification. Schools should seek advice where any doubt may arise.
IMPORTANT NOTICE
Schools/ETBs must appreciate that the Data Protection Acts are important, and must always be considered together with all other relevant law which applies to Schools/ETBs. For example, Section 9 (g) of the Education Act, 1998 provides that parents of a student under the age of 18 years have the right to access information in the prescribed manner relating to the progress of the student in his or her education. This is entirely separate from and different to an “access request”. It is dealt with under an entirely separate piece of legislation: the Education Act 1998. The definition of a parent in the Education Act 1998 includes “foster parent, a guardian appointed under the Guardianship of Children Acts, 1964 to 1997, or other person acting in loco parentis who has a child in their care subject to any statutory power or order of a court and, in the case of a child who has been adopted under the Adoption Acts, 1952 to 1998, or, where the child has been adopted outside the State, means the adopter or adopters or the surviving adopter”. Schools are reminded of their obligation to communicate and correspond with all parents/guardians in a fair and equitable manner irrespective of their marital/family/civil status. For further guidance, see the section “Parental Access Requests”
Note 1: An access request does not need to specifically refer to the Data Protection Acts in order to be valid.
Note 2: See also “What should you do if a request is made under FOI?”
A data access request can be made in person, by email, by letter. There is no charge from 25th May 2018 for a data access request.