GDPR and exam results: What do schools need to know?

New guidance from the Information Commissioner’s Office about the impact of data protection rules on access to exam results has prompted a series of news stories about the rights of pupils.

Here’s what schools (and their pupils) need to know.

 

1. The ICO guidance

According to the ICO, pupils have a right to request from exam boards their mark, comments written by the examiner and the minutes of any examination appeals panels.

The guidance has prompted concerns about the implications for exam boards.

Geoff Barton, general secretary of the Association of School and College Leaders, told the Telegraph it would “likely lead to an exponential increase in requests”.

“We exist in this high-stakes examination culture, so every mark matters,” he said.

 

2. The rights of pupils haven’t changed under GDPR

According to AQA, pupils already had the right to request this information under past data protection law before GDPR came into force in May.

OCR welcomed the clarification from the ICO, but also pointed out that students “were able to access this data under previous data protection legislation”.

 

3. GDPR does NOT let pupils see their marked exam papers

The ICO guidance makes clear that GDPR does not give pupils the right to copies of their answers to exam questions, which are exempt under the regulations.

The only way to access marked exam scripts is via post-exam services run by the exam boards. Three of the four – AQA, OCR and WJEC – charge for papers, while Pearson makes them available online for free.

Ofqual announced earlier this year that all exam boards will have to provide “quick access” to marked papers by 2020. It is not yet known whether the boards will charge for this service.

 

4. GDPR access requests take too long to help with marking reviews

Exam boards warned today that pupils should not rely on their rights under GDPR to help them decide whether to ask for a review of marking.

Pupils only get a limited window in which to request a review, and subject access requests take up to 30 days to process.

“It would be misleading to suggest that GDPR provides a quicker or more effective way for someone to decide whether to request a review of results,” an AQA spokesperson said. “That’s not the case – by far the best thing for them to do is to speak to their school or college.”

 

5. Some data is already held by schools

Statement of marks provided to schools by exam boards already include qualification grades, as well as raw and weighted marks for each paper a pupil has sat.