SAR Exemptions: How to Apply Them

This exemption to the right of access applies to the vast majority of responses you provide to pupils or parents, as well as elements of responses to staff requests. At its core, its purpose is to protect the personal data of other individuals who happen to be contained in the same document or data set as the data subject to whom the request relates.

Redact the personal data of all data subjects whose data is not being requested in the SAR.

Remember that even if the personal data of a third party is referenced in shorthand, such as “M. Lindsay” or “MRL”, this could still constitute a data breach. Ask yourself whether the receiving individual would still be able to identify the third-party subject using the shorthand only. If it’s likely, you should also redact that shorthand.

Education data, health data and social care data are subject to an assumption of reasonableness for health workers, social workers and education workers, as detailed in Schedule 2, Part 3, paragraph 17 DPA 2018. This means you should not redact the personal data of current or former staff from your responses (subject to the serious harm test below). The same principle applies to the personal data of health professionals contributing to a health record in their capacity as a health professional involved in the diagnosis, care or treatment of the data subject.

This exemption is designed to protect individuals from suffering serious harm due to their involvement in a pupil’s education. It allows an organisation to withhold the data in response to a request, and also puts the organisation under no obligation to confirm if it even holds the data.

The “serious harm test” is met with respect to education data if disclosure would be likely to cause serious harm to the physical or mental health of the data subject or another individual.

Organisations should not use this exemption in a blanket fashion. The “serious harm test” should be considered for each individual data subject that you are considering for redaction.

This is one exemption where extra care should be given to your rationale document, and you should document how you reached the decision. Simply having an argumentative parent is unlikely to suffice; you should consider:

• The past and current relationship between the recipient of the SAR and the data subject to which you are applying the “serious harm test”.
• Any threats or history of violence between the data subjects.
• The effect of the disclosure on other data subjects, such as pupils and other family members.
• Anything else that seems relevant to your organisation’s setting.

This exemption allows you to withhold any personal data consisting of information as to whether the data subject is or has been the subject of, or may be at risk of, child abuse. It’s a common-sense exemption in place to protect the safeguarding of pupils. The legislation highlights that “child abuse” includes physical injury (other than accidental injury) to, and physical and emotional neglect, ill-treatment and sexual abuse of, an individual aged under 18.

This exemption only applies to a SAR received when:

• the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject; or
• the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.

If possible, segregate the child abuse data from any other documents that are eligible for disclosure. For data sets where this is not possible, apply redactions to the data. If you are unable to provide any data in response to the request, you should still respond as below.

This exemption is relatively common-sense to apply but can attract complaints from requesters. Be confident in your safeguarding processes and reach out to your DSL if necessary. Try to avoid getting into protracted arguments with requesters, and ensure they are directed to the ICO’s complaint process.

There is an exemption from the right of access relating to information about the outcome of academic, professional or other examinations, but it only applies to the information recorded by candidates. This means candidates do not have the right to copies of their answers to the exam questions.

The information recorded by the person marking the exam is not exempt. However, if an individual makes a SAR for this information before the results are announced, special rules apply to how long you have to comply with the request.

When receiving a request for exam papers, you should redact the answers from the paper but leave the comments and markings unredacted. The disclosure should be provided within either:

• five months of receiving the request; or
• 40 days of announcing the exam results, if this is earlier.

It’s essential that you confirm with your exams lead when the exam results will be announced. You can then calculate whether the 40-day window after that date falls sooner than the 5-month anniversary of the request being made. Once you have confirmed your timescale for replying, note it in a calendar so that it’s not missed.

If the request includes other forms of personal data, you should still disclose these within the one-month timeframe. Use the same reference number for both disclosures — even though you have had to delay the disclosure of the exam data, both disclosures are in response to the same request.

Personal data held in confidential references (both made and received) are exempt from disclosure. This applies when the references relate to:

• education, training or employment of an individual;
• placement of an individual as a volunteer;
• appointment of an individual to office; or
• provision of any service by an individual.

During the collation process, your organisation should segregate all references made or received in respect of the data subject making the request.

It is important to note that this exemption only applies to references given in confidence. You should make it clear to individuals, and to those providing references, whether you will treat references confidentially or adopt a policy of openness. Do this through the privacy information you provide, such as your policy and privacy notices.

This exemption allows organisations to withhold data that consists of information:

• to which a claim to legal professional privilege could be maintained in legal proceedings; or
• in respect of which a professional legal adviser owes a duty of confidentiality to their client.

This exemption essentially protects two types of confidential discussion when they involve a legal advisor. “Litigation privilege” applies to confidential conversations between a client, their legal advisor, or even a third party, but only when proceedings are being considered or are already underway. “Legal advice privilege” is more specific and only covers confidential discussions directly between a client and their legal advisor when the client is seeking or receiving legal advice.

Any data you hold which consists of advice or discussions with your solicitors or other legal advisers does not need to be disclosed just because it includes personal data of the individual making the request.

If you are unsure whether the data is covered by legal professional privilege, discuss this with your compliance lead or external legal advisors as necessary.

Personal data that is a record of your intentions in negotiations with an individual is exempt from the right of access. This only applies to the extent that providing the data would be likely to prejudice the negotiations. It is likely to apply to some staff data.

Assess whether the document or data set includes anything that would harm your position in negotiations with the requester. This could include pay reviews or settlement discussions.

It’s relatively rare for staff members or other individuals to be entering into negotiations with your organisation, but the situation may still arise. When applying this exemption, focus not on the reason for the negotiation but on the potential effect of the disclosure. The exemption does not set out any limits regarding the timing of negotiations, nor does it say you can only withhold information where negotiations are still ongoing. You may therefore be able to apply the exemption after negotiations have ended, but only if you can justify why disclosure would be likely to prejudice negotiations — most relevant where you can demonstrate that disclosure would prejudice your position in future negotiations.

An exemption applies to personal data that you process for management forecasting or management planning about a business or other activity. Disclosure of this data is exempt from the right of access if responding to the SAR would be likely to prejudice the conduct of the business or activity.

During the collation process, you may notice that the requester is referred to within data sets and documents setting out management planning or forecasting decisions which have not yet been shared with the wider workforce — for example, due to a restructure, merger or other similar process. The requester’s personal data within these sources is exempt from disclosure. Whilst redaction may be the most suitable way forward, there could be other information in the data set that allows the requester to identify when they or other staff are being referred to. In this situation, the appropriate action would be to remove the documents from the disclosure bundle entirely.

This exemption is most likely to apply to data you hold regarding staff roles during a reshuffle, merger or redundancy process. Your organisation may have produced this data in anticipation of these activities but not yet announced them to the workforce. If you receive a SAR for staff members’ personal data included in these documents, you do not need to disclose it if doing so would prejudice the conduct of the business or activity, such as by causing staff unrest before the plans are announced.