Under section 7 of the Data Protection Act (DPA), an individual has the right to ask an organisation to provide them with personal confidential information they hold which identifies them and, in certain circumstances, a parent can make such a request on behalf of a child.
A subject access request for personal confidential information may be refused if it falls within a statutory exemption. The Research, History and Statistics exemption (section 33(4) of the DPA), applies to personal data being processed for research, historical or statistical purposes. As the personal information that a pupil or parent has requested is held on the NPD for these purposes, it is exempt from release to the pupil or parent.
The Department is undertaking a programme of work in preparation for General Data Protection Regulation coming into effect in May 2018. This will include a review of the policies and processes associated with Subject Access Requests.