Sir William Borlase Grammar School: infringements of GDPR data processing principles

The request was refused by Sir William Borlase's Grammar School, Marlow.

Dear Sir William Borlase's Grammar School,

Since 2016 I have made repeated requests for factual information which fully meets the definition of “dataset” given in s.11(5) of the Freedom of Information Act:
In this Act “dataset” means information comprising a collection of information held in electronic form where all or most of the information in the collection—
(a)has been obtained or recorded for the purpose of providing a public authority with information in connection with the provision of a service by the authority or the carrying out of any other function of the authority,
(b)is factual information which—
(i)is not the product of analysis or interpretation other than calculation, and
(ii)is not an official statistic …

My purpose for requesting these datasets was aimed at understanding how personal data are collected and processed to produce the “standardised” scores used by Sir William Borlase's Grammar School to determine which children to admit. These requests were initially directed towards the test provider CEM. Since 2018 I have asked TBGS for this information. Both have refused. In recent court proceedings, counsel for TBGS clarified that TBGS is a private company set up to manage the secondary transfer test on behalf of Sir William Borlase's Grammar School and 12 other schools and questioned whether TBGS is subject to laws relating to transparency. Sir William Borlase's Grammar School is a state funded Academy school, responsible for determining its own admissions. Whilst CEM and TBGS may argue that they are not accountable Sir William Borlase's Grammar School is fully accountable to the public for actions they take on its behalf.

Article 4 of the General Data Protection Regulation (GDPR) contains the following definitions:
(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’) …
(4) ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements
(7) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data …

Sir William Borlase's Grammar School are the data controller, responsible for determining how this personal data is profiled.

Article 5 of GDPR contains the following Principles:
(1)(a) Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’).
(2) The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

This process is not transparent. After four and a half years of being refused the datasets needed to understand the profiling carried out on behalf of Sir William Borlase's Grammar School, I would like to request the following information.

1. Details of where you publish your publication scheme, which it is the duty of every public authority to publish. If not obvious, the date this was last revised.

2. Details of all the personal data which passes between Sir William Borlase's Grammar School, TBGS, the council, GLA and any other party in connection with 11+ tests. This may include but not be limited to; name, unique pupil number, date of birth, school, answer sheet, raw scores, standardised scores and number of attempted questions etc. (This request is not for the data itself but details of what personal data is shared between each of the parties involved.)

3. Details of how these data are processed. This must explain exactly how an individual raw score in each of the tests is combined with the child’s age to produce a standardised score. If this information is based on the data itself, for example the mean and standard deviation values of the raw test marks for a given cohort, this explanation must include the calculated values over the last three years (tests taken in 2018, 2019, 2020). As the data controller Sir William Borlase's Grammar School should be fully familiar with exactly how this personal information is being processed without the need to consult with your data processor.

4. How the “qualifying score” of 121 is determined by your data processor? Is this an objective measure consistent with past years or is it set at a level designed to qualify a given number or proportion of those who sit the test. If it is set to select a quota, what criteria are used to determine the pass mark?

5. A copy of the minutes of the full meeting of TBGS directors held on 27 September 2019. If no minutes were taken at that meeting, please explain why Sir William Borlase's Grammar School allow important decisions to be taken on its behalf with no official record being taken.

The law is clear. Accountability for compliance with GDPR sits with Sir William Borlase's Grammar School. This accountability is not something which can be absolved by outsourcing the processing to a series of private companies. GDPR was implemented into UK domestic law via the 2018 Data Protection Act which received royal assent in May 2018. Sir William Borlase's Grammar School are long overdue in complying with this law.

Although I have chosen to contact Sir William Borlase's Grammar School via a website designed to handle Freedom of Information, my request for information relates to the systemic contraventions of basic data processing principles for which Sir William Borlase's Grammar School are responsible. As such, unless I receive substantive responses to the above requests by 5pm on Friday 9 April, I shall refer this matter to the Information Commissioner who has the power to impose fines of up to €20 million for infringements which go against the very principles of GDPR, specifically those included in Article 5. I reserve the right to also treat this as a Freedom of Information request and refer any response I receive to the Information Commissioner under s.50 of the Freedom of Information Act in due course.

Yours faithfully,

James Coombs

enquiries, Sir William Borlase's Grammar School, Marlow

Dear Mr Coombs

Thank you for your email which has been forwarded on to the Business
Manager

On Sunday, 28 March 2021 at 19:54:52 UTC+1 James Coombs wrote:

Dear Sir William Borlase's Grammar School,

Since 2016 I have made repeated requests for factual information which
fully meets the definition of “dataset” given in s.11(5) of the Freedom
of Information Act:
In this Act “dataset” means information comprising a collection of
information held in electronic form where all or most of the information
in the collection—
(a)has been obtained or recorded for the purpose of providing a public
authority with information in connection with the provision of a service
by the authority or the carrying out of any other function of the
authority,
(b)is factual information which—
(i)is not the product of analysis or interpretation other than
calculation, and
(ii)is not an official statistic …

My purpose for requesting these datasets was aimed at understanding how
personal data are collected and processed to produce the “standardised”
scores used by Sir William Borlase's Grammar School to determine which
children to admit. These requests were initially directed towards the
test provider CEM. Since 2018 I have asked TBGS for this information.
Both have refused. In recent court proceedings, counsel for TBGS
clarified that TBGS is a private company set up to manage the secondary
transfer test on behalf of Sir William Borlase's Grammar School and 12
other schools and questioned whether TBGS is subject to laws relating to
transparency. Sir William Borlase's Grammar School is a state funded
Academy school, responsible for determining its own admissions. Whilst
CEM and TBGS may argue that they are not accountable Sir William
Borlase's Grammar School is fully accountable to the public for actions
they take on its behalf.

Article 4 of the General Data Protection Regulation (GDPR) contains the
following definitions:
(1) ‘personal data’ means any information relating to an identified or
identifiable natural person (‘data subject’) …
(4) ‘profiling’ means any form of automated processing of personal data
consisting of the use of personal data to evaluate certain personal
aspects relating to a natural person, in particular to analyse or
predict aspects concerning that natural person’s performance at work,
economic situation, health, personal preferences, interests,
reliability, behaviour, location or movements
(7) ‘controller’ means the natural or legal person, public authority,
agency or other body which, alone or jointly with others, determines the
purposes and means of the processing of personal data …

Sir William Borlase's Grammar School are the data controller,
responsible for determining how this personal data is profiled.

Article 5 of GDPR contains the following Principles:
(1)(a) Personal data shall be processed lawfully, fairly and in a
transparent manner in relation to the data subject (‘lawfulness,
fairness and transparency’).
(2) The controller shall be responsible for, and be able to demonstrate
compliance with, paragraph 1 (‘accountability’).

This process is not transparent. After four and a half years of being
refused the datasets needed to understand the profiling carried out on
behalf of Sir William Borlase's Grammar School, I would like to request
the following information.

1. Details of where you publish your publication scheme, which it is the
duty of every public authority to publish. If not obvious, the date this
was last revised.

2. Details of all the personal data which passes between Sir William
Borlase's Grammar School, TBGS, the council, GLA and any other party in
connection with 11+ tests. This may include but not be limited to; name,
unique pupil number, date of birth, school, answer sheet, raw scores,
standardised scores and number of attempted questions etc. (This request
is not for the data itself but details of what personal data is shared
between each of the parties involved.)

3. Details of how these data are processed. This must explain exactly
how an individual raw score in each of the tests is combined with the
child’s age to produce a standardised score. If this information is
based on the data itself, for example the mean and standard deviation
values of the raw test marks for a given cohort, this explanation must
include the calculated values over the last three years (tests taken in
2018, 2019, 2020). As the data controller Sir William Borlase's Grammar
School should be fully familiar with exactly how this personal
information is being processed without the need to consult with your
data processor.

4. How the “qualifying score” of 121 is determined by your data
processor? Is this an objective measure consistent with past years or is
it set at a level designed to qualify a given number or proportion of
those who sit the test. If it is set to select a quota, what criteria
are used to determine the pass mark?

5. A copy of the minutes of the full meeting of TBGS directors held on
27 September 2019. If no minutes were taken at that meeting, please
explain why Sir William Borlase's Grammar School allow important
decisions to be taken on its behalf with no official record being taken.

The law is clear. Accountability for compliance with GDPR sits with Sir
William Borlase's Grammar School. This accountability is not something
which can be absolved by outsourcing the processing to a series of
private companies. GDPR was implemented into UK domestic law via the
2018 Data Protection Act which received royal assent in May 2018. Sir
William Borlase's Grammar School are long overdue in complying with this
law.

Although I have chosen to contact Sir William Borlase's Grammar School
via a website designed to handle Freedom of Information, my request for
information relates to the systemic contraventions of basic data
processing principles for which Sir William Borlase's Grammar School are
responsible. As such, unless I receive substantive responses to the
above requests by 5pm on Friday 9 April, I shall refer this matter to
the Information Commissioner who has the power to impose fines of up to
€20 million for infringements which go against the very principles of
GDPR, specifically those included in Article 5. I reserve the right to
also treat this as a Freedom of Information request and refer any
response I receive to the Information Commissioner under s.50 of the
Freedom of Information Act in due course.

Yours faithfully,

James Coombs

-------------------------------------------------------------------

Please use this email address for all replies to this request:
[1][FOI #742111 email]

Is [2][Sir William Borlase's Grammar School, Marlow request email] the wrong address for Freedom of Information
requests to Sir William Borlase's Grammar School, Buckinghamshire? If
so, please contact us using this form:
[3]https://www.whatdotheyknow.com/change_re...

Disclaimer: This message and any reply that you make will be published
on the internet. Our privacy and copyright policies:
[4]https://www.whatdotheyknow.com/help/offi...

For more detailed guidance on safely disclosing information, read the
latest advice from the ICO:
[5]https://www.whatdotheyknow.com/help/ico-...

Please note that in some cases publication of requests and responses
will be delayed.

If you find this service useful as an FOI officer, please ask your web
manager to link to us from your organisation's FOI page.

-------------------------------------------------------------------

References

Visible links
1. mailto:[FOI #742111 email]
2. mailto:[Sir William Borlase's Grammar School, Marlow request email]
3. https://www.whatdotheyknow.com/change_re...
4. https://www.whatdotheyknow.com/help/offi...
5. https://www.whatdotheyknow.com/help/ico-...

enquiries, Sir William Borlase's Grammar School, Marlow

Dear Mr Coombs,
 
Thank you for the Freedom of Information Request received on 28^th March
2021.
 
We will be looking into this and will reply to you as soon as possible
but no later than 11^th May 2021 (20 working days after the request
bearing in mind the school is closed over the Easter holidays).
 
As you sent your request by email, we will respond by email unless we
hear otherwise from you.
Yours sincerely,
Mrs C S McLeod
Business Manager
Finance Director
Telephone 01628 816500

On Sunday, 28 March 2021 at 19:54:52 UTC+1 James Coombs wrote:

Dear Sir William Borlase's Grammar School,

Since 2016 I have made repeated requests for factual information
which fully meets the definition of “dataset” given in s.11(5) of
the Freedom of Information Act:
In this Act “dataset” means information comprising a collection of
information held in electronic form where all or most of the
information in the collection—
(a)has been obtained or recorded for the purpose of providing a
public authority with information in connection with the provision
of a service by the authority or the carrying out of any other
function of the authority,
(b)is factual information which—
(i)is not the product of analysis or interpretation other than
calculation, and
(ii)is not an official statistic …

My purpose for requesting these datasets was aimed at
understanding how personal data are collected and processed to
produce the “standardised” scores used by Sir William Borlase's
Grammar School to determine which children to admit. These
requests were initially directed towards the test provider CEM.
Since 2018 I have asked TBGS for this information. Both have
refused. In recent court proceedings, counsel for TBGS clarified
that TBGS is a private company set up to manage the secondary
transfer test on behalf of Sir William Borlase's Grammar School
and 12 other schools and questioned whether TBGS is subject to
laws relating to transparency. Sir William Borlase's Grammar
School is a state funded Academy school, responsible for
determining its own admissions. Whilst CEM and TBGS may argue that
they are not accountable Sir William Borlase's Grammar School is
fully accountable to the public for actions they take on its
behalf.

Article 4 of the General Data Protection Regulation (GDPR)
contains the following definitions:
(1) ‘personal data’ means any information relating to an
identified or identifiable natural person (‘data subject’) …
(4) ‘profiling’ means any form of automated processing of personal
data consisting of the use of personal data to evaluate certain
personal aspects relating to a natural person, in particular to
analyse or predict aspects concerning that natural person’s
performance at work, economic situation, health, personal
preferences, interests, reliability, behaviour, location or
movements
(7) ‘controller’ means the natural or legal person, public
authority, agency or other body which, alone or jointly with
others, determines the purposes and means of the processing of
personal data …

Sir William Borlase's Grammar School are the data controller,
responsible for determining how this personal data is profiled.

Article 5 of GDPR contains the following Principles:
(1)(a) Personal data shall be processed lawfully, fairly and in a
transparent manner in relation to the data subject (‘lawfulness,
fairness and transparency’).
(2) The controller shall be responsible for, and be able to
demonstrate compliance with, paragraph 1 (‘accountability’).

This process is not transparent. After four and a half years of
being refused the datasets needed to understand the profiling
carried out on behalf of Sir William Borlase's Grammar School, I
would like to request the following information.

1. Details of where you publish your publication scheme, which it
is the duty of every public authority to publish. If not obvious,
the date this was last revised.

2. Details of all the personal data which passes between Sir
William Borlase's Grammar School, TBGS, the council, GLA and any
other party in connection with 11+ tests. This may include but not
be limited to; name, unique pupil number, date of birth, school,
answer sheet, raw scores, standardised scores and number of
attempted questions etc. (This request is not for the data itself
but details of what personal data is shared between each of the
parties involved.)

3. Details of how these data are processed. This must explain
exactly how an individual raw score in each of the tests is
combined with the child’s age to produce a standardised score. If
this information is based on the data itself, for example the mean
and standard deviation values of the raw test marks for a given
cohort, this explanation must include the calculated values over
the last three years (tests taken in 2018, 2019, 2020). As the
data controller Sir William Borlase's Grammar School should be
fully familiar with exactly how this personal information is being
processed without the need to consult with your data processor.

4. How the “qualifying score” of 121 is determined by your data
processor? Is this an objective measure consistent with past years
or is it set at a level designed to qualify a given number or
proportion of those who sit the test. If it is set to select a
quota, what criteria are used to determine the pass mark?

5. A copy of the minutes of the full meeting of TBGS directors
held on 27 September 2019. If no minutes were taken at that
meeting, please explain why Sir William Borlase's Grammar School
allow important decisions to be taken on its behalf with no
official record being taken.

The law is clear. Accountability for compliance with GDPR sits
with Sir William Borlase's Grammar School. This accountability is
not something which can be absolved by outsourcing the processing
to a series of private companies. GDPR was implemented into UK
domestic law via the 2018 Data Protection Act which received royal
assent in May 2018. Sir William Borlase's Grammar School are long
overdue in complying with this law.

Although I have chosen to contact Sir William Borlase's Grammar
School via a website designed to handle Freedom of Information, my
request for information relates to the systemic contraventions of
basic data processing principles for which Sir William Borlase's
Grammar School are responsible. As such, unless I receive
substantive responses to the above requests by 5pm on Friday 9
April, I shall refer this matter to the Information Commissioner
who has the power to impose fines of up to €20 million for
infringements which go against the very principles of GDPR,
specifically those included in Article 5. I reserve the right to
also treat this as a Freedom of Information request and refer any
response I receive to the Information Commissioner under s.50 of
the Freedom of Information Act in due course.

Yours faithfully,

James Coombs

-------------------------------------------------------------------

Please use this email address for all replies to this request:
[1][FOI #742111 email]

Is [2][Sir William Borlase's Grammar School, Marlow request email] the wrong address for Freedom of
Information requests to Sir William Borlase's Grammar School,
Buckinghamshire? If so, please contact us using this form:
[3]https://www.whatdotheyknow.com/change_re...

Disclaimer: This message and any reply that you make will be
published on the internet. Our privacy and copyright policies:
[4]https://www.whatdotheyknow.com/help/offi...

For more detailed guidance on safely disclosing information, read
the latest advice from the ICO:
[5]https://www.whatdotheyknow.com/help/ico-...

Please note that in some cases publication of requests and
responses will be delayed.

If you find this service useful as an FOI officer, please ask your
web manager to link to us from your organisation's FOI page.

-------------------------------------------------------------------

References

Visible links
1. mailto:[FOI #742111 email]
2. mailto:[Sir William Borlase's Grammar School, Marlow request email]
3. https://www.whatdotheyknow.com/change_re...
4. https://www.whatdotheyknow.com/help/offi...
5. https://www.whatdotheyknow.com/help/ico-...

Dear Mrs McLeod,

Thanks for confirming receipt of my request for information.

I am concerned that the school have been acting illegally since 2018 by failing to ensure that the processing of personal data carried out on its behalf is not (lawful, fair and) transparent. Unless I receive an explanation of how these data are profiled by Friday 9 April I will be referring this to the Information Commissioner who has the power to impose fines of up to €20 million

I reserve the right to *also* refer any response I receive to the Information Commissioner under s.50 of the Freedom of Information Act in due course.

Please do not conflate those two separate issues.

Best wishes

James Coombs

enquiries, Sir William Borlase's Grammar School, Marlow

The school is now closed for the Easter break. We return on Monday 19th April and will respond to your email then.

enquiries, Sir William Borlase's Grammar School, Marlow

Dear Mr Coombs

Thank you for your email which has been forwarded on to Ms McLeod 

On Monday, 5 April 2021 at 14:24:32 UTC+1 James Coombs wrote:

Dear Mrs McLeod,

Thanks for confirming receipt of my request for information.

I am concerned that the school have been acting illegally since 2018 by
failing to ensure that the processing of personal data carried out on
its behalf is not (lawful, fair and) transparent. Unless I receive an
explanation of how these data are profiled by Friday 9 April I will be
referring this to the Information Commissioner who has the power to
impose fines of up to €20 million

I reserve the right to *also* refer any response I receive to the
Information Commissioner under s.50 of the Freedom of Information Act in
due course.

Please do not conflate those two separate issues.

Best wishes

James Coombs

show quoted sections

enquiries, Sir William Borlase's Grammar School, Marlow

1 Attachment

Dear Mr Coombs,
Please find attached our response to your request received on March
28th.
Yours sincerely, 
Catriona McLeod
Mrs C S McLeod
Business Manager
Finance Director
Telephone 01628 816570

On Monday, 5 April 2021 at 14:24:32 UTC+1 James Coombs wrote:

Dear Mrs McLeod,

Thanks for confirming receipt of my request for information.

I am concerned that the school have been acting illegally since
2018 by failing to ensure that the processing of personal data
carried out on its behalf is not (lawful, fair and) transparent.
Unless I receive an explanation of how these data are profiled by
Friday 9 April I will be referring this to the Information
Commissioner who has the power to impose fines of up to €20
million

I reserve the right to *also* refer any response I receive to the
Information Commissioner under s.50 of the Freedom of Information
Act in due course.

Please do not conflate those two separate issues.

Best wishes

James Coombs

show quoted sections