[COVID-19 UPDATE] Disclosure of Predicted Grades and IB World Schools

In the aftermath of the decision to cancel exams by the International Baccalaureate (IB), we have received a number of enquiries from IB World Schools about the disclosure of predicted grades to their students ahead of final moderation by the IB.

Given the right of access that would entitle students to obtain such information from the data controller, we were asked to clarify the relationship between the IB and the IB World Schools in respect of the predicted grades. Whilst we have approached the IB about this issue, we have not yet received any response in this regard. So, we have taken a deep dive into the published IB documentation to help provide some clarity.

Having considered the IB documents and contacted some IB World Schools, it is our view that IB World Schools are not collecting the predicted grades as processors for the IB. This is because there is no written agreement between the IB and the IB World Schools which would amount to a processing contract, with the required processing clauses, for the purposes of the GDPR.

Join Mark Orchison for 9ine's Roadmap webinar as he leads a lively discussion of the roadmap and vision ahead and recent accomplishments including 9ine's new, intelligent platform for managing risk and compliance in schools.

In addition, the IB makes it very clear that each IB World School is expected to process student data in accordance with its local data protection and privacy laws, and that the IB does not wish to take any responsibility for that compliance. This would suggest the IB and the IB World Schools are processing student data as separate controllers. This is supported by the Diploma Programme Assessment Procedures 2020, which states: “Whether predicted grades should be released to candidates is left to the discretion of the school”. This means that the IB World Schools can themselves decide how to respond to requests for predicted grades. This discretion over data should only be exercised by a controller. It is therefore our view that the IB and the IB World Schools are separate data controllers. 

As a result, IB World Schools will be responsible for responding to any data subject access requests they receive concerning predicted grades on the basis of the interpretation of the GDPR by their local law, or in respect of any other relevant local law.

With the relationship clarified, it is also important that IB World Schools consider their governance documents to ensure they reflect the data protection relationship with the IB, such as Records of Processing and Privacy Notices.

Please also bear in mind that, whilst this guidance is based on the relationship between IB and IB World Schools, other associations may set up their relationships with schools differently and there may also be contractual issues to take into account in determining whether predicted grades should be released.

ABOUT THE AUTHOR:

Heidi-Anne O’Neil, LLB(Hons), LLM, PC.DP, PC.FOI,  is 9ine’s in-house Data Protection Solicitor and is a qualified Data Protection and Freedom of Information Practitioner. She plays a key role in leading 9ine’s global data protection programme, identifying, interpreting and applying the EU General Data Protection Regulation, national laws and emerging data protection laws across the world, including cyber security laws that impact on the processing of personal data. With a background in the private and public sector, Heidi-Anne has many years of experience providing advice in the diverse areas of information law covering people, policies, processes, systems and applications with a focus on continuous improvement and effective risk management. With an understanding of how information flows within schools, she is able to work alongside 9ine’s clients to provide privacy risk management advice, consultation and complex problem-solving on a global level.