Introduction

This Quarterly Education Law Update looks at the decision of the First-tier Tribunal in Martin Ogazi v Information Commissioner [2021].

Background

As a result of the Covid-19 pandemic, GCSE grades issued in the summer of 2020 were assessed by schools, rather than by external examination bodies. The pupil who was the subject of this decision was awarded a grade for GCSE economics by his School. His father was not happy with the grade.

Following correspondence from the pupil’s father in August 2020, the School provided him with three reports; an April report which included the pupil’s trial exam grade; a November report which included a trial exam date and a predicted grade; and a June report which included a trial exam grade and a current grade.

In September 2020, the pupil’s father wrote to the School with a request for copies of the same information for the other pupils in his son’s year who studied GCSE economics. The pupil’s father also sought confirmation of the final grade given to each of the other pupils.

The School provided the pupil’s father was an anonymised version of the requested information, with names redacted and with the information presented in a randomised format. The School refused to provide the information in the format that was requested by the father because it contended that to do so would breach GDPR.

The pupil’s father sent further correspondence to the School arguing that it should not have randomised the data. He made the case that he needed the results in the same format as they were provided for his son so that he could determine whether there was consistency in the grades that were awarded.

Information Commisioner

In October 2020, the pupil’s father made a complaint to the Information Commissioner. The Information Commissioner decided that:

• The information the pupil’s father had request about other pupils was personal data. Although the father had not asked for the names of the students, the Information Commissioner accepted that non-randomised information could allow identification of some of the individuals, particularly low or high achievers.

• There was a legitimate interest in ensuring that the School determined the students’ final grades consistently and in line with the guidance set out by Ofqual. The unusual circumstances and controversy around the awarding of GCSE grades in 2020 also indicated a legitimate interest in the information requested.

• However, disclosure of the information was not necessary. The School had provided as much information as possible in order to meet the legitimate interests identified, while protecting the personal data of the students involved. The Information Commissioner was satisfied that there were less intrusive means of achieving the legitimate aims identified; and that these aims had been met by disclosure of an anonymised version of the data.

Appeal

The pupil’s father lodged an appeal on 10 March 2021 and the appeal was heard by the First-tier Tribunal on 13 August 2021. The pupil’s father argued that the Information Commissioner was wrong to decide that the test of necessity was not met. He disputed various claims made by the School to the Information Commissioner. In particular, he argued that it was not his intention to know the identity of the other students, only the grades to establish whether there was consistency. He also argued that it would benefit the whole class to find out if there were anomalies in the grades which had come about because of the way the subject was taught and the significant disruption in teaching due to Covid-19.

The First-tier tribunal looked at four issues:

• Was the information requested personal data?

The tribunal made several findings in this regard. Firstly, the tribunal accepted that the parent’s intention in requesting the data was not to identify individual students. Secondly, notwithstanding the parent’s intention, the tribunal agreed with the Information Commissioner that disclosure of non-randomised information in the format requested by the parent could allow identification of some of the students. It said this was particularly the case for the lower and higher achievers in the class, where a set of particularly high or low grades could be linked more easily with an individual student who is known to be a high or low achiever. Thirdly, trial exam grades, predicted grades and actual grades were clearly personal academic information which many students will wish to keep private. In the circumstances, the tribunal decided that the information requested was personal data, because it is personal information that could be linked to individuals.

• Was the party seeking disclosure of the data pursuing a legitimate interest or interests?

The tribunal accepted that the parent had a legitimate interest in making the request in question. It accepted that he wanted to see the data to identify whether there were any inconsistencies; and use this for the purposes of an appeal about his son’s exam grade. The tribunal accepted that there was a legitimate interest in ensuring that the School determined the students’ final grades consistently and in line with the guidance set out by Ofqual, particularly in light of the unusual circumstances around the awarding of GCSE grades in 2020.

• Was the processing involved necessary for the purposes of those interests?

The tribunal noted that the initial rankings were moderated based on a range of factors and were then reviewed before being finalised. The tribunal accepted that the data requested by the parent would not provide an accurate way of assessing inconsistencies in final grading, because it did not show all the matters taken into account. The tribunal went on to say that disclosure was not reasonably necessary for the purpose of establishing alleged inconsistencies because it would provide an incomplete picture and only further those interests in a limited way.

• Was the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

As the test of necessity was not met, strictly speaking, the tribunal did not have to consider the balance between the parent’s right to the relevant information and the rights of other pupils. However, the panel did look at this issue for the sake of completeness. The tribunal noted that personal data relating to children is given specific protection under the GDPR and said that this meant that the privacy interests of the other students should be given additional weight in the balancing exercise. The tribunal noted that individual students may not wish their assessment grades, predictions and final grades to be known publicly; that they would have an expectation that this would not happen; and that disclosure could potentially cause distress to these students (particularly if they were low achievers and/or vulnerable). Ultimately, the tribunal concluded that disclosure of the information requested by the appellant under Freedom of Information would be unwarranted because of the prejudice to the privacy rights of the other pupils involved.

Conclusion

Whilst this decision relates to a school in England, it is likely to be of interest to schools in Northern Ireland. It illustrates that there is scope for schools to decline requests for information which involve personal data of other pupils. This can be so even where the individual requesting the data asks for it in an anonymised form, particularly if there is a real risk that other pupils might be identified by piecing the requested information together with other available information.