What our students can expect at DHLNW.
Darul Hadis Latifiah Northwest [the School] is committed to transparency in its dealings with the public and fully embraces the aims of the Freedom of Information Act 2000 and the access provisions of the General Data Protection Regulations 2018. The School will make every effort to meet its obligations under the respective legislation and will regularly review procedures to ensure that it is doing so.
The underlying principle of this policy is that the public have a right of access to recorded information held by the School and that the School should seek to promote an open regime regarding access to information, subject to the exemptions contained within the relevant legislation
Freedom of Information (FOI) requests should be dealt with within 20 working days, excluding school holidays. Requests for Data Protection (subject access requests) should be dealt with within 1 month.
This policy applies to all recorded information held by the School that relates to the business of the School. This includes:
This policy does not cover personal written communications (such as personal e-mails sent by staff). The School’s Data Protection Policy establishes the standards regarding the use of “personal data” (as defined in the GDPR).
Overall responsibility for ensuring that the School meets the statutory requirements of the FOIA, EIR and GDPR lies with the Proprietor and they have delegated the day-to-day responsibility of implementation to the Headteacher.
The Headteacher is assisted by Mr Ali Reza who fulfils the role of Senior Information Risk Officer (SIRO). All School staff are responsible for ensuring that they handle requests for information in compliance with the provisions of the various Acts, taking advice from the SIRO where necessary.
The School has a duty under both the FOIA and EIR to provide advice and assistance to applicants making information requests. This includes assisting the applicant in making the application for information. Although no such duty exists under the GDPR, the same level of care will be provided.
The three information regimes contain different provisions that permit charges to be made for responding to information requests. The Proprietor may charge a fee for complying with requests, as calculated in accordance with FOIA regulations. If a charge is to be made, the School will give written notice to the applicant before supplying the information requested.
The school will only charge for the cost of copying and transmitting information, not for time taken in reaching decisions regarding whether information is covered by an exemption.
Where the School estimates that the cost of locating the information will exceed the statutory threshold of £450, it will consider whether or not to comply with the request. The School is not obliged to comply with such a request but may choose to do so.
The Freedom of Information Act contains 23 exemptions whereby information can be withheld. There are two categories; absolute and non-absolute. The School will only withhold information if it falls within the scope of one or more of these exemptions.
Where an absolute exemption applies, the School can automatically withhold the information. However, where the exemption is non-absolute the information can only be withheld where the School decides that the public interest is best served by withholding the information. Certain exemptions also contain a “prejudice test”, which means that the exemption can only be claimed if disclosing the information would prejudice the interest protected by the exemption.
The School will only withhold information covered by the exemption. Complete files or documents will not be withheld just because part of the information is covered by an exemption.
The School will only apply an exemption where it has reason to believe that prejudice might occur to the interest protected by the exemption. In addition, wherever a “public interest” exemption is being considered, the School will only withhold that information which it can demonstrate that the public interest will be best served by withholding. When considering withholding information under a non-absolute exemption the School will take into account whether the release of the information would:
Where information is withheld under an exemption in most cases the reason behind the decision will be made clear to the applicant, citing the exemption under which the information is being withheld. The applicant will also be given details of the right to challenge the decision through the School’s Proprietor and the right of appeal to the Information Commissioner’s Office.
Where the SIRO plans to apply an exemption, he/she will consider whether other schools hold similar information. If this is considered likely, he/she may contact the relevant school(s) to ensure that a consistent response is provided to the applicant.
The School will also refuse to supply information under the FOIA, where the request is considered “vexatious” or “repeated” and under the EIR, where the request is considered ‘manifestly unreasonable’
Where, in response to a request, information belonging to a third party (either an individual or other organisation) has to be considered for release, the staff member that received the request will seek input from the SIRO prior to the release of the information.
The release of third party information will be considered carefully to prevent actions for breach of confidence or, in the case of living individuals, breaches of the GDPR. Both the EIR and FOIA permit information to be withheld when its release would breach the provisions of the GDPR.
Where the requested information relates to a living individual and amounts to “personal data” as defined in the GDPR, its disclosure could breach the GDPR. Therefore, the release of third party personal information relating to living individuals will be considered in accordance with the data protection principles and, in particular, the “third party” provisions of the GDPR.
Where appropriate, the School will contact the individual to ask for permission to disclose the information. If consent is not obtained, either because it was not considered appropriate to approach the third party or the third party could not be contacted or consent is refused. The School will then consider if it is reasonable to disclose the information, taking into account:
The decision to disclose third party information will also take into account the impact of disclosure on the third party, relative to the impact on the applicant of withholding the information. Where the third party has been acting in an official, rather than private capacity, the School will be minded to disclose the information, although decisions will be made on a case by case basis.
Where the information relates to a staff member, the provisions of the GDPR will still apply in many circumstances but the nature of the information will influence the School’s decision whether to release the information. Where the information relates to a matter clearly private to the individual, e.g. a disciplinary hearing, the information will almost certainly be withheld. However, where the information relates to the member of staff acting in their official capacity, e.g. an expenses claim, the information will normally be released. The exemption relating to the release of a third party’s personal data will not be used to withhold information about administrative decisions taken by the School.
As the GDPR only relates to living individuals, the exemption relating to Data Protection under both the EIR and FOIA will not apply to information held about the deceased. Where the request might be controversial, the staff member will seek input from the SIRO officer who will take advice from the Proprietor where necessary. Where the third party is an organisation, rather than an individual, the provisions of GDPR 2018 will not apply. The School will consider consulting the third party concerning the release of their information where
Consultation will not be undertaken where:
Where input from a third party is required, the response time for the request remains the same. Therefore, it will be made clear to the third party at the outset that they have a limited time for their views to be provided and that where responses are not immediate, the decision to disclose may have to be made without their input in order for the School to comply with the statutory time limits dictated by the legislation. The School will endeavour to inform individuals and organisations submitting information that the information might be released following an information request and, where appropriate, will provide the supplier of the information opportunity to request confidentiality or supply reasons as to why the information should be treated confidentially.
Any contractual information, or information obtained from organisations during the tendering process, held by the School are subject to the provisions of the FOIA and EIR. Whenever the School enters into contracts, it will seek to exclude contractual terms forbidding the disclosure of information beyond the restrictions contained in the legislation. A standard form of wording will be included in contracts to cover the impact of FOIA and EIR in relation to the provision of information held in contracts.
The School can withhold contractual information where its disclosure under either the FOIA or EIR could be treated as actionable breach of confidence. Where the School intends to include non-disclosure provisions in a contract, it will agree with the contractor a schedule of the contract that clearly states which information should not be disclosed.
The School will only agree to enter into confidentiality clauses where the information is confidential in nature and that it is confident that the decision to restrict access to the information could be justified to the Information Commissioner.
Where information is not covered by the exemption relating to information accepted in confidence, a further exemption specifically under FOIA may be relevant, relating to commercial interests. This exemption is subject to a “public interest” test. Whenever the School has to consider the release of such information, it will contact the relevant organisation to obtain its opinions on the release of the information and any exemptions they may think relevant. However, the School will make the final decision relating to the disclosure of the information.
The School can also withhold information contained in contracts where any of the other exemptions listed in the FOIA or EIR are appropriate, although information will only be withheld in line with the School’s policy on the use of exemptions. All future contracts should contain a clause obliging contractors to co-operate fully and in a timely manner where assistance is requested in responding to an FOIA or EIR request
Whenever the School withholds information under an exemption, or for any other reason, it will inform the applicant of their right to complain about the decision through the School’s complaints procedure and of the right of appeal to the Information Commissioner. Any complaint received will be dealt with in accordance with the School’s complaints procedure as detailed in its Complaints Policy. If the result of the complaints is that any decision to withhold information be overturned, this information will be supplied as soon as it is possible.
The General Data Protection Regulations 2018 entitles an individual to his or her ‘personal data’, as defined in that Act, where the information is held on an automated system, such as a computer and also manual files, where they amount to what the GDPR describes as an “accessible record” or in a structured filing system, defined in the GDPR as a “relevant filing system”.
The parental right to receive information pertaining to the “educational record” of their child should continue to be administered under the Education (Pupil Information) (England) Regulations 2000. Whenever a request for personal data is received and is not covered by these regulations, the request will be administered in accordance with the relevant section of the School’s FOIA operating procedures.
Whenever a request is made under the GDPR for personal data, the School will provide the applicant with the relevant information contained within files relating to that individual that is accessible under both the GDPR and FOIA, subject to any exemptions.
Where it is not possible to remove third party information without rendering the response useless to the individual, the provision of third party information will be considered in line with section 8 of this policy regarding the disclosure of third party information.
The GDPR contains the provision for numerous types of exemption. Therefore, whenever a member of staff is considering applying an exemption, he/she will seek the opinion of the SIRO
It is a criminal offence under any of the three information regimes for members of staff to alter, deface or remove any record (including e-mails) following receipt of an information request. Both the FOIA and EIR contain specific provisions to make such action a criminal offence
If you have any queries in relation to this policy, please contact the School’s SIRO who will also act as the contact point for any subject access requests or email: firstname.lastname@example.org
The policy will be reviewed as it is deemed appropriate, but no less frequently than every 5 years.
Signature:___________________________ Date: ___/___/20__
Name: _____________________________ Position: Headteacher
Signature:___________________________ Date: ___/___/20__
Name: _____________________________ Position: Proprietor
Last Reviewed: September 2018, Next Review September 2023 | Approved by the Proprietor.