The Data Protection Act 1998 (the Act) regulates the holding and processing of personal data, that is information relating to living individuals, which is held either on computer or in some cases in manual form.

The Act gives legally enforceable rights to individuals (data subjects) and places obligations on those who control the manner and the purpose of the processing of personal data (data controllers). Data controllers must notify the Commissioner of the details of their processing (details of which are published by the Commissioner in the register of notifications).

Data controllers must also comply with eight data protection principles, which together form a framework for the proper handling of personal data.

The Information Commissioner's Office regularly receives enquiries about the data protection implications of schools disclosing their students' examination results to the local media for publication. This Advice Sheet explains the impact of the Data Protection Act 1998 on this use of personal data, and provides guidance on how such disclosures can be made within the remit of the Act.

Notification

Most schools will have notified the details of their processing using one of the standard notification templates designed by the Commissioner. These contain details of all the typical purposes for which schools process personal data, and standard descriptions of the types of data held and disclosures. The template has been amended to include the media as a disclosure of data.

Basis for Processing

The Act requires that there should always be a legitimate basis for the processing of personal data. The Commissioner accepts that the publication of examination results takes places on the basis of a condition described in paragraph 6 of Schedule 2 of the Act namely where "the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason or prejudice to the rights or freedoms or legitimate interests of the data
subject".

Information to be provided to the pupils and parents

The Act also makes it clear that in order for the processing of personal data, including its collection, to be fair, it is necessary to ensure that those to whom the data relate are aware of the purposes for which their data may be used or disclosed. While it is likely that many pupils and parents will be aware that examination results may be published, this is not always the case. To satisfy this requirement therefore, schools should ensure that pupils and their parents are made aware that examination results may be published.

It may also be necessary to explain the form in which publication will take place. Some pupils, for instance, might object to their results being published if they know that results are published in grade order rather than, say, alphabetically.

The Right to object

Although the Commissioner does not think that pupils or their parents must give their consent to the publication of examination results, he knows from experience that in a small number of cases publication can cause distress. When informing pupils or their parents that examination results are published, schools should therefore advise them of the right to object to publication.

Pupils or Parents?

The rights, which the Data Projection Act gives data subjects, are not affected by their ages. The Commissioner generally advises that as long as young people are able to understand their rights then it is they and not their parents or guardians who should be informed of uses and disclosures of data and who have the right to object to processing. In most cases, therefore, it is sufficient to provide the information described above to pupils.

In a small number of cases, it may be that pupils are not capable of understanding their rights or of understanding the consequences of publication. In these cases, schools should provide the relevant information to parents or guardians.