Parents and guardians with parental responsibility often use SAR’s as way to obtain the educational record of their children.  There appears to be two reasons why this may be the case. Firstly, no charge can be made for a SAR, which makes it more cost effective than making an application under The Education (Pupil Information) (England) Regulations 2005.

Secondly, the 2005 regulations only apply to local authority schools, so the parents, guardians or carers of children who attend Independent schools, academies and free schools will use SAR’s to access the educational records of their children.  

It is important to remember when dealing with SAR’s for the data of children and young people that under the GDPR children and young people have exactly the same rights and protections as adults in relation to their personal data. The personal data that a school holds on a child or young person is the personal data of the child or young person and consequently, if they are competent to take charge of their own data rights, they will be able to exercise those rights for themselves and you should ask them what they wish to do. 

Competent children and young people may want their parents to assist them or exercise their data rights on their behalf or they may wish to do so themselves. A competent child or young person should be given the choice to tell you what they want to do.   If they are not old enough to take charge of their own data rights however, a parent or guardian, with parental responsibility, can exercise their data rights for them until such time as they are considered to be competent to do so for themselves or in circumstances where it is evident that it is in the best interests of the child for the parents to exercise their data rights for them. 

So when you receive a SAR, made by the parent or guardian, for the data of the child you need to ask whether you consider the child or young person is able to take charge of his or her data rights? There is no statutory age at which a child is considered to be old enough to exercise their own data rights in England and Wales.  Every child is different and an informed and common sense approach is necessary. Consider the understanding of the child or young person in light of their age and ability to understand alongside the nature of the data requested.  Some types of data requested may be more complex to understand than other types of data. The nature and complexity of the data requested will be an important factor to consider in terms of whether the child or young person has the maturity understanding and consequent ability to understand the data requested and exercise their rights in respect of that data.    

If you want to learn more about the data rights of children in relation to SAR’S or any other of the UK GDPR data rights take a look at the ICO Guidnace 'What Righs Do Children Have'.