Thread by @alistair_sloan

#SQAResults Datatilsynet (the Norwegian ICO) has issued an "advance notification" to the International Baccalaureate Organization in respect of the grades awarded to IB students in Norway. The Advance notification is a preliminary stage prior to a final decision being taken. It

gives notice to the IBO that Datatilsynet is considering ordering the rectification of grades awarded. As with other qualification awarding bodies, the IBO faced a situation where examinations were cancelled as a result of COVID-19. They introduced an adjusted process for the

awarding of qualifications. This process consisted of three factors: (1) student coursework; (2) predicted grades from teachers; and (3) "school context". The final factor is essentially similar to what the #SQA did for Scottish exam results. Datatilsynet has taken a provisional

view that the personal data of students (i.e. their grades) has not been processed fairly (as required by Article 5(1)(a) of the #GDPR). Datatilsynet also considers that the personal data has not been processed transparently (also as required by Article 5(1)(a) of the GDPR) and

that it is inaccurate (contrary to Article 5(1)(d) of the #GDPR). This is, it must be stressed, only a preliminary view; although it should also be noted that Datatilsynet has remained unconvinced by the IBO during the earlier stages of its investigation. This is a significant

development. The full advance notification can be read (in English) here: datatilsynet.no/contentassets/… and a shorter press release here: datatilsynet.no/en/news/2020/t…

In theory similar complaints could be made to the ICO concerning the approach adopted by the SQA. However, that is an extremely slow process. However, it would add strength to a judicial review of the process - the later could, in theory, be done much quicker than the former.

However, how that will fit in with deadlines for colleges & universities is another thing. In a judicial review the court could only reduce the decision and remit back to the SQA; whereas the slower ICO route could result in a decision by the ICO similar to that envisaged by

Datatilsynet. Finally, pupils could make rectification/restriction of processing requests directly to the SQA, which could then be taken to the Sheriff Court under section 167 of the Data Protection Act 2018 (however, the SQA have at least one month, and my extend by a further

two months to respond to rectification or restriction of processing requests which would delay any section 167 Application).