Decision 121/2021: Module grades

Public authority: University of St Andrews
Case Ref: 202001133

Summary

The University was asked for the highest, lowest and median grades achieved in the previous four years for named computer science modules.

The University disclosed some information in response to the request and withheld the remaining information under a number of exemptions.

The Commissioner investigated and found that the exemptions relied upon by the University did not apply. He required the University to disclose the withheld information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 30(c) (Prejudice to effective conduct of public affairs); 38(1)(b) and (5) (definitions of "personal data"); 39(1) (Health, safety and the environment)

Data Protection Act 2018 (the DPA 2018) sections 3(2) and (3) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 14 August 2020, the Applicant made a request for information to the University of St Andrews (the University). The information requested was the lowest, median and highest grades for named computer science modules for the previous four years (including the 2019/20 academic year).

2. The University responded on 21 August 2020, withholding the requested information, as it was considered to be the personal data (section 38(1)(b) of FOISA) and disclosure would, in its view, prejudice substantially the effective conduct of public affairs (section 30(c) of FOISA).

3. On the same day, the Applicant wrote to the University requesting a review of its decision. He did not accept that the exemptions applied; he considered disclosure of the withheld information would not identify an individual, or result in the substantial prejudice identified by the University.

4. The University notified the Applicant of the outcome of its review on 21 September 2020. On review, it concluded that the median grades were not exempt and disclosed these grades to the Applicant. The University also concluded that all of the highest grades, with the exception of one module, were no longer exempt under section 38(1)(b) of FOISA. The University maintained that the lowest grade continued to be exempt under section 38(1)(b) of FOISA as in many instances a single individual achieved a recorded grade and there is a causal link whereby identification is possible. However, all of the withheld information (lowest and highest grades) were still considered exempt under section 30(c) of FOISA.

5. On the same day, the Applicant applied for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of the University's review because he did not agree that the withheld information was personal data as he considered identification unlikely. He also did not consider that the prejudice (under section 30(c)) was of real and demonstrable significance, or that it was likely to occur.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 12 October 2020, the University was notified in writing that the Applicant had made a valid application. The University was asked to send the Commissioner the information withheld from the Applicant. The University provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The University was invited to comment on this application and to answer specific questions in relation to the exemptions relied upon in the review response issued to the Applicant. The University responded on 9 December 2020. In this response, the University stated that it was also relying upon section 39(1) to withhold the requested information.

9. During the investigation, aspects of the University's submissions were clarified several times, in particular, how disclosure of the requested information would identify an individual. In providing submissions on this matter, the University identified further information (some of the lowest grades) that it no longer considered exempt under section 38(1)(b) of FOISA, and confirmed it considered all of the highest grades exempt in terms of section 38(1)(b) of FOISA. It also confirmed that all lowest and highest grades were considered exempt under sections 30(c) and 39(1) of FOISA and provided further submissions as to the prejudice (in line with section 30(c) of FOISA) to the University if the withheld information was disclosed.

10. The Applicant was asked for and provided his legitimate interest or public interest submissions, as relevant, associated with the three exemptions being relied upon by the University.

Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the University. He is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) - Personal information

12. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK General Data Protection Regulation (the UK GDPR).

13. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the withheld information personal data?

14. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018. The definition is set out in full in Appendix 1.

15. The two main elements of personal data are that:

• the information must "relate to" a living individual; and
• the living individual must be identifiable.

16. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

17. An "identifiable living individual" is one who can be identified, directly or indirectly, by reference to an identifier (such as a name) or one or more factors specific to the individual (see section 3(3) of the DPA 2018).

18. The Court of Justice of the European Union looked at the question of identification in Breyer v Bundesrepublik Deutschland[1]. The Court said that the correct test to consider is whether there is a realistic prospect of someone being identified. In deciding whether there is a realistic prospect of identification, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain - if the risk of identification is "insignificant", the information will not be personal data.

The University's submissions

19. By the end of the investigation, the University's position was that the lowest grades for some modules and highest grades for all modules (that fall within scope of the request) were personal data and exempt under section 38(1)(b) of FOISA.

20. In support of its submissions, the University referred to the findings and conclusions in Decision 098/2019[2], which supported its arguments that exam grades, broken down by subject and grade, were the personal data of an identifiable individual.

21. The University submitted that there is a realistic possibility of linking the examination results to individuals where:

• here is a relatively small population;
• results are linked to subject areas;
• the number of individuals achieving a particular grade is low; and
• the interactions with the population are such that there is a causal chain, which can lead to identification.

22. The University also submitted that, if a module is compulsory and a student fails the module, then they can opt to take a leave of absence and re-sit the module the following year. If the student is ineligible to re-sit an assessment, then they may opt to retake the module. Doing so would mean that they would be seen entering the lecture hall and it would apparent they had not progressed to the later modules. Students can re-sit an assessment during the re-assessment diet and, as numbers are low, it would be possible to triangulate which individuals achieved the lowest grade. Also, if the module is mandatory and the student does not progress, then, where the numbers are small it would be possible to identify the individual.

23. The University also submitted that higher grades may be attributable to specific students, due to the nature of the course, being group work (with students working closely together) and continual assessment with oral feedback being given.

24. The University explained that the frequency of a student receiving the highest grade was very low (between 1 and 3). Additionally, the School of Computing normally awards a medal to the best student in each sub-honours module, therefore identifying the student(s) who achieved the highest module grade.

25. In summary, the University submitted that, taking account of: the small population size, the subject specific nature of modules, the low frequency of students achieving the lowest grades, and that failure of a module has consequences, there are a number of realistic routes to the identification of an individual, who has secured the lowest module grade.

The Applicant's submissions

26. The Applicant submitted that he did not consider that disclosure of the module grades would lead to the identification of an individual. He did not believe any realistic causal chain had been put forward which would allow a third party to identify anyone.

The Commissioner's findings

27. The Commissioner is satisfied that the grades could relate to an individual, but must also consider whether an individual can be identifiable from this information. The Commissioner has considered all of the University's detailed submissions as to why it considered disclosure of the grades would identify an individual.

28. At the outset, the Commissioner notes that this request does not seek the number of candidates associated with a particular grade, and therefore the information can be distinguished from that sought in Decision 098/2019.

29. The University's arguments on identifiability appear to be based on the ability to identify an individual attending a resit exam / resitting the year (for the lowest grades). The Commissioner is not satisfied that there is a direct correlation between those resitting the exam and those receiving the lowest grades. For example, candidates may have been ill and unable to attend, or they may want to take the exam again in an attempt to improve a grade.

30. The Commissioner also considers that there could also be other reasons for students not continuing with their studies. He does not accept that there is a one-to-one correlation between an individual who did not continue with their studies and the individual receiving a lower (or lowest) grade for a module.

31. The Commissioner is also satisfied that, with respect to the highest grades, if it is already known who achieved that grade, then it is not disclosure of the information requested by the Applicant which would lead to identification of the individual - the information is already known.

32. The University's submissions appear to be on the basis that an individual would keep a record of all the students who attended a module again or re-sat the grading process between 2016 and 2020. The Commissioner considers that this process of identification, through the triangulation of many variables, to be unrealistic and remote.

33. The question for the Commissioner is what the withheld information might conceivably add to information already available, making identification more likely (bearing in mind that there might be individuals sufficiently motivated to make such a connection).

34. When reaching a view on whether disclosure of information would lead to the identification of an individual, the Commissioner takes into account the means accessible to a determined individual. In this instance, the Commissioner considers that the process of identification of an individual from a module grade would require more than just the disclosure of the module grade in itself: the individual would have to know more about the individual(s) via other means, than solely the disclosure of a module grade. The Commissioner is of the view that such a process would go beyond any reasonable expectations of what a determined individual would do to identify an individual from the disclosure of a module grade.

35. The Commissioner considers that there are things that will be known about the students concerned and there are things that may well be the subject of speculation as to whether particular students received the highest or lowest module grade. The Commissioner has been provided with extensive submissions, but the link between disclosure of a number and identification of an individual, is in his view, a remote possibility.

36. Having taken account of the arguments presented by both parties, therefore, the Commissioner does not accept that the University has demonstrated there is a realistic possibility of identification of individual(s)using the withheld information. In the circumstances, he is not satisfied that this withheld information falls within the definition of personal data.

37. As the Commissioner is not satisfied that this information is personal data, he must find that the University was not entitled to withhold the information under section 38(1)(b) of FOISA.

Section 30(c) - Prejudice to effective conduct of public affairs

38. Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs". The use of the word "otherwise" distinguishes the harm required from that envisaged by the exemptions in sections 30(a) and (b). This is a broad exemption and the Commissioner expects any public authority citing it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.

39. The standard to be met in applying the tests contained in section 30(c) is high: the prejudice in question must be substantial and therefore of real and demonstrable significance. The Commissioner expects authorities to demonstrate a real risk or likelihood of substantial prejudice at some time in the near (certainly foreseeable) future, not simply that such prejudice is a remote or hypothetical possibility. Each request should be considered on a case by case basis, taking into consideration the content of the information and all other relevant circumstances (which may include the timing of the request).

The University's submissions

40. The University submitted that the grade a student received is contractually and morally a private matter between the University and its students; there is no expectation that those details will be released to any third party except in very limited circumstances. The limited circumstances were communications with a sponsor in line with the sponsorship condition or with consent of the data subject.

41. The University considered disclosure would result in a breach of trust between institution and students. It submitted that disclosure would be harmful to the student and their self-esteem. It considered that a student may be satisfied with their grade, but if they found out where they fell in the distribution, this could affect their wellbeing.

42. The University did acknowledge that disclosure of the module grades may not result in significant increases in referrals to Student Services, but considered that any increase in referrals for anxiety/wellbeing in human terms is harmful, and to be avoided.

43. The University was asked to expand upon its submission as to the prejudice in disclosure of the module grades. It submitted that:

• the working relationship between students and the University would be undermined where confidential information is disclosed;
• there was no reasonable expectation that an individual's grade would be disclosed; doing so would lead to a loss of trust between the student and the University.
• disclosure would result in harm to the wellbeing and/or mental health of some students (the University has a duty of care to students), which in turn would place unnecessary burdens on individuals and on academic and student support services. Consequently, there would be an increase in demand for services and staff time (student support and academic) which would also impact on other areas of core service delivery, for example an academic spending more time on supporting students will spend less time developing their teaching and research; and
• lead to some students making misinformed choices when planning for their academic progression.

The Applicant's submissions

44. The Applicant considered that the integrity of the University's assessment process, which affects approximately 10,000 students a year, outweighs the interests of the very small number of students whose grades may be released.

The Commissioner's conclusions

45. In this instance, the University's submissions are largely based on the premise that individuals would be identified from the disclosure of the lowest and highest grades, and the prejudicial effects which, in its view, would follow. Once again, the Commissioner emphasises that this request did not seek the number of students who received a particular grade, but the lowest or highest grade associated with a particular course. He cannot, therefore, accept the arguments from the University which associate harm directly to the identifiability of an individual.

46. However, the University also submitted that disclosure of the module grades would lead to students making misinformed course choices. It is understood that the University considers that disclosure of the module grades would indicate how easy or difficult it is to pass a particular module. The Commissioner does not accept that this conclusion necessarily follows. He does not accept that confirmation of the highest or lowest grades could lead to an opinion about the difficulty or otherwise of a course. The provision of the highest or lowest grade does not take into account the number of students submitted for exam, the number achieving those grades, or the abilities of the individuals concerned.

47. The University has not demonstrated, to the satisfaction of the Commissioner, why the disclosure of the module grades (that would not identify an individual), in all of the circumstances, correlates with the harm suggested.

48. The reasons given by the University are that disclosure would lead to harm in its relationships with students (past and present) and the effect on University services is not supported by the submissions. Even if these were consequences of disclosure, the Commissioner considers that the resulting prejudice would be minimal and not substantial as required for section 30(c) to apply.

49. In all the circumstances, the Commissioner is not satisfied that disclosure of the module grades would prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

50. As the Commissioner is not satisfied that the module grades were withheld correctly under section 30(c) of FOISA, he is not required to go on to consider the public interest test in section 2(1)(b) of FOISA in relation to this information.

Section 39(1) - Health, safety and the environment

51. Under section 39(1) of FOISA, information is exempt information if its disclosure under FOISA would, or would be likely to, endanger the physical or mental health or the safety of an individual. This is a qualified exemption and is subject to the public interest test required by section 2(1)(b) of FOISA.

52. As the Commissioner notes in his briefing on this exemption[3], section 39(1) does not contain the usual harm test. Instead of the "substantial prejudice" test found in many other harm-based exemptions in Part 2 of FOISA, this exemption refers to the "endangerment" of health or safety. This test is less demanding than the "substantial prejudice" test.

The University's submissions

53. The University referred to paragraph 25 of Decision 045/2017, in which the Commissioner found that "there should be a threat to a person, direct or indirect to their safety; in terms of harm (arising from the threat should that materialise), that should be a distinct possibility."

54. The University submitted that, for some students, release of the highest and lowest grades would be harmful to their mental health and wellbeing.

55. The University noted that, in Decision 098/2019[4], at paragraphs 54 and 55, the Commissioner recognised that release of a pupil's grade, may cause harm to their wellbeing. The University considered that there were similar parallels between the possibility of harm arising from disclosure in that case, to that considered in Decision 098/2019.

56. In support of its view, the University confirmed, from their experiences, that harm from disclosure is actual and not hypothetical. Consequently, the University considered that disclosure would, or would be likely to, endanger the mental health of some of the students involved.

The Commissioner's conclusions

57. In coming to a decision on the application of section 39(1) of FOISA, the Commissioner has considered all of the submissions made by the University.

58. The phrase "endanger" is broad enough to apply where there is a threat, direct or indirect, to the safety of a person. Since the exemption does not specify that any threat should be imminent before it applies, the threat may be either immediate, or one which would foreseeably arise in the future. However, the Commissioner believes that, for endangerment to be considered likely, there must be some well-founded apprehension of danger, such that the prospect of harm could be regarded as a distinct possibility.

59. The Commissioner has concluded that disclosure of the withheld information (module grades) would not identify an individual.

60. Again, the University's arguments are predicated on the basis that disclosure of the grades would identify an individual. The University's argument is applied both to the individuals that it considers would be identified following disclosure of the grade and those individuals who did receive the grade they expected to achieve.

61. The above arguments are all hypothetical, what the Commissioner must consider here is whether, and to what extent, disclosure of the information withheld by the University would, or would be likely to, make any of the associated risks any greater, to the extent that the endangerment of any person would be made more likely.

62. Having considered the case in detail, the Commissioner is not persuaded by the arguments presented by the University. In his view, these arguments do not demonstrate why disclosure of the withheld information would be likely to increase the risk of endangerment to the health or safety of individuals, particularly where the Commissioner has concluded that disclosure would not lead to identification. The University is required to demonstrate a link between disclosure and endangerment: in all the circumstances of this case, the Commissioner does not find such a link to have been established.

63. Having concluded that the exemption was wrongly applied, the Commissioner is not required to consider the public interest test in relation to disclosing or withholding this information. He requires the University to disclose the information to the Applicant.

Decision

The Commissioner finds that University of St Andrews (the University) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant.

The Commissioner found that the exemptions relied upon to withhold the requested information, did not apply.

The Commissioner therefore requires the University to disclose the withheld information, by 21 September 2021.

Appeal

Should either the Applicant or the University wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the University fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the University has failed to comply. The Court has the right to inquire into the matter and may deal with the University as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement
12 August 2021

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

…

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

…

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(5) In this section-

…

"personal data" and "processing" have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);

…

39 Health, safety and the environment

(1) Information is exempt information if its disclosure under this Act would, or would be likely to, endanger the physical or mental health or the safety of an individual.

…

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to section 14(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier, such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

…

---