Wycombe High School: infringements of GDPR data processing principles

The request was refused by Wycombe High School.

Dear Wycombe High School,

Since 2016 I have made repeated requests for factual information which fully meets the definition of “dataset” given in s.11(5) of the Freedom of Information Act:
In this Act “dataset” means information comprising a collection of information held in electronic form where all or most of the information in the collection—
(a)has been obtained or recorded for the purpose of providing a public authority with information in connection with the provision of a service by the authority or the carrying out of any other function of the authority,
(b)is factual information which—
(i)is not the product of analysis or interpretation other than calculation, and
(ii)is not an official statistic …

My purpose for requesting these datasets was aimed at understanding how personal data are collected and processed to produce the “standardised” scores used by Wycombe High School to determine which children to admit. These requests were initially directed towards the test provider CEM. Since 2018 I have asked TBGS for this information. Both have refused. In recent court proceedings, counsel for TBGS clarified that TBGS is a private company set up to manage the secondary transfer test on behalf of Wycombe High School and 12 other schools and questioned whether TBGS is subject to laws relating to transparency. Wycombe High School is a state funded Academy school, responsible for determining its own admissions. Whilst CEM and TBGS may argue that they are not accountable Wycombe High School is fully accountable to the public for actions they take on its behalf.

Article 4 of the General Data Protection Regulation (GDPR) contains the following definitions:
(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’) …
(4) ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements
(7) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data …

Wycombe High School are the data controller, responsible for determining how this personal data is profiled.

Article 5 of GDPR contains the following Principles:
(1)(a) Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’).
(2) The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

This process is not transparent. After four and a half years of being refused the datasets needed to understand the profiling carried out on behalf of Wycombe High School, I would like to request the following information.

1. Details of where you publish your publication scheme, which it is the duty of every public authority to publish. If not obvious, the date this was last revised.

2. Details of all the personal data which passes between Wycombe High School, TBGS, the council, GLA and any other party in connection with 11+ tests. This may include but not be limited to; name, unique pupil number, date of birth, school, answer sheet, raw scores, standardised scores and number of attempted questions etc. (This request is not for the data itself but details of what personal data is shared between each of the parties involved.)

3. Details of how these data are processed. This must explain exactly how an individual raw score in each of the tests is combined with the child’s age to produce a standardised score. If this information is based on the data itself, for example the mean and standard deviation values of the raw test marks for a given cohort, this explanation must include the calculated values over the last three years (tests taken in 2018, 2019, 2020). As the data controller Wycombe High School should be fully familiar with exactly how this personal information is being processed without the need to consult with your data processor.

4. How the “qualifying score” of 121 is determined by your data processor? Is this an objective measure consistent with past years or is it set at a level designed to qualify a given number or proportion of those who sit the test. If it is set to select a quota, what criteria are used to determine the pass mark?

5. A copy of the minutes of the full meeting of TBGS directors held on 27 September 2019. If no minutes were taken at that meeting, please explain why Wycombe High School allow important decisions to be taken on its behalf with no official record being taken.

The law is clear. Accountability for compliance with GDPR sits with Wycombe High School. This accountability is not something which can be absolved by outsourcing the processing to a series of private companies. GDPR was implemented into UK domestic law via the 2018 Data Protection Act which received royal assent in May 2018. Wycombe High School are long overdue in complying with this law.

Although I have chosen to contact Wycombe High School via a website designed to handle Freedom of Information, my request for information relates to the systemic contraventions of basic data processing principles for which Wycombe High School are responsible. As such, unless I receive substantive responses to the above requests by 5pm on Friday 9 April, I shall refer this matter to the Information Commissioner who has the power to impose fines of up to €20 million for infringements which go against the very principles of GDPR, specifically those included in Article 5. I reserve the right to also treat this as a Freedom of Information request and refer any response I receive to the Information Commissioner under s.50 of the Freedom of Information Act in due course.

Yours faithfully,

James Coombs

Office, Wycombe High School

Thank you for your email. Please be aware that this email account is not
monitored during the evenings, weekends or before 8.30 am in the mornings.

As of Wednesday 10 March 2021 all year groups will have returned to
physical school.

Regular updates will continue to be sent via SchoolComms. Letters, updates
and wellbeing resources can be located via the
website: [1]www.whs.bucks.sch.uk

If you or a member of your close family has a confirmed case of
Coronavirus, please email [2][email address]

If your email relates to a serious concern for the immediate safety or
wellbeing of a student outside school hours, please contact the police on
101 or 999, or Social Care on 01296 383962 (daytime) or 0800 9997677 (out
of hours)

If you are a student and need advice or support outside school hours
please speak to a parent / family member, health professional or contact a
helpline.

If your contact is a general enquiry relating to COVID-19 please refer
to [3]www.gov.uk/government/topical-events/coronavirus-covid-19-uk-government-response

 

References

Visible links
1. https://www.whs.bucks.sch.uk/
2. mailto:[email address]
3. https://www.gov.uk/government/topical-ev...

Office, Wycombe High School

6 Attachments

Dear Mr Coombs

 

Thank you for your e-mail dated Saturday 27 March 2021.  We will respond
within 20 school working days.

 

Kind regards

 

Wycombe High School Academies Trust: a Company Limited by Guarantee |
Registered in England

Company Number 07597324 | Registered Office: Marlow Road | High Wycombe |
Bucks | HP11 1TB

 

We Look Beyond | Infectious Joy | Limitless Ambition | Insatiable
Curiosity | Generous Spirit

Tel 01494 523961 | Web [1]www.whs.bucks.sch.uk

 

[2]facebook icon  [3]twitter icon  [4]youtube icon  [5]linkedin
icon  [6]instagram icon

 

[7]cid:image006.png@01D6CD38.7CCDE7E0

 

show quoted sections

Dear Office,

Thanks for confirming receipt of my request for information.

I am concerned that the school have been acting illegally since 2018 by failing to ensure that the processing of personal data carried out on its behalf is not (lawful, fair and) transparent. Unless I receive an explanation of how these data are profiled by Friday 9 April I will be referring this to the Information Commissioner who has the power to impose fines of up to €20 million

I reserve the right to *also* refer any response I receive to the Information Commissioner under s.50 of the Freedom of Information Act in due course.

Please do not conflate those two separate issues.

Best wishes

James Coombs

Office, Wycombe High School

Thank you for your email.  School is closed from 1.45 pm on Thursday I
April for the Easter break.  Term starts at 8.45 am on Monday 19 April. 

      

o If you or a member of your close family has a confirmed case of
Coronavirus, please email [1][email address]  

 

o If your email relates to a serious concern for the immediate safety or
wellbeing of a student outside school hours, please contact the police
on 101 or 999, or Social Care on 01296 383962 (daytime) or 0800
9997677 (out of hours)  

 

o If you are a student and need advice or support outside school hours
please speak to a parent / family member, health professional or
contact a helpline.  

 

If your contact is a general enquiry relating to COVID-19 please refer to
[2]https://www.gov.uk/government/topical-ev...

References

Visible links
1. mailto:[email address]
mailto:[email address]
2. https://www.gov.uk/government/topical-ev...
https://www.gov.uk/government/topical-ev...

Office, Wycombe High School

7 Attachments

Good afternoon

 

Please find attached a response to your Freedom of Information request.

Kind regards

 

 

Wycombe High School
 
 
[1]A
school [2]Wycombe [3]Facebook   [4]Twitter   [5]LinkedIn   [6]Wycombe
that High School High TV
looks
beyond
 
Wycombe High School Academies Trust: a Company Limited by Guarantee |
Registered in England | Company Number 07597324, Registered Office: Marlow
Road, High Wycombe, Buckinghamshire HP11 1TB
 

 

show quoted sections