FOI Requests, Small Numbers and Pupil Privacy: When Statistics Reveal More Than They Should

Steve Cullen

Oct 22

7 min read

When does a statistic become personal information?

Schools and academies regularly receive Freedom of Information (FOI) requests asking for statistical information about pupils, staff, attendance, exclusions, behaviour, special educational needs and other aspects of school life. Many of these requests come from university students, researchers, journalists, campaign groups and members of the public. Most appear perfectly straightforward. The requester wants numbers, not names, so surely there cannot be a data protection problem?

Unfortunately, it is not always that simple. Consider a school receiving an FOI request asking for the number of pupils involved in managed moves and off-site direction during an academic year, together with an ethnicity breakdown of those pupils and the wider school cohort. The request does not ask for names, dates of birth or individual records. It simply asks for statistics. But what happens if only one pupil from a particular ethnic background has been involved in a managed move? What if the circumstances of that move are already known to other parents or pupils? Suddenly, what appeared to be anonymous statistical information could reveal something about an identifiable child. This is where the school's obligations under freedom of information legislation and data protection law need to be considered together.

Freedom of Information does not override data protection

The Freedom of Information Act 2000 gives the public a general right to access recorded information held by public authorities, including maintained schools and academies in England. Schools are generally required to respond within 20 school days or 60 working days, whichever is shorter, subject to the applicable statutory rules. However, that right is not unlimited. Section 40(2) of the FOI Act provides an exemption for third-party personal information where the relevant statutory conditions are met, including where disclosure would contravene the data protection principles.

The school must also consider the UK GDPR and Data Protection Act 2018, as amended, including changes introduced by the Data (Use and Access) Act 2025. Importantly, ethnicity constitutes special category personal data under Article 9 of the UK GDPR when it relates to an identifiable individual. That does not mean schools cannot publish ethnicity statistics. They routinely do so for legitimate purposes. The distinction is whether the information is genuinely anonymous or whether individuals could reasonably be identified from it, either directly or indirectly.

The hidden danger of small numbers

Imagine a school with 900 pupils. During the academic year, 12 pupils were involved in managed moves or off-site direction. The school is asked to provide an ethnicity breakdown. The figures might look something like this:

Ethnicity	Number of pupils
White British	8
Asian British	2
Black British	1
Mixed ethnicity	1
Total	12

At first glance, there appears to be nothing particularly sensitive about this table. No names are disclosed. No individual records are provided. However, the table reveals that one pupil recorded as Black British and one pupil recorded as being of mixed ethnicity were involved in the arrangements. If there is only one pupil from either category within the relevant year group, or if the circumstances of a particular managed move are already known, identification could become possible.

This is known as disclosure by inference or, in some circumstances, a jigsaw identification risk. The danger increases when different datasets are combined. For example, the requester might already have information about the school's overall ethnic composition, year groups or exclusions. Combining that information with the newly disclosed statistics could reveal something that neither dataset would disclose independently. The important lesson is that removing names does not necessarily make information anonymous.

Should schools automatically suppress figures below five?

A common approach in statistical reporting is to suppress small numbers, often those below five. This can be a sensible starting point, but schools should not assume that it is a legal requirement. Neither the FOI Act nor the UK GDPR establishes a universal rule that all figures below five must be withheld. The correct approach is to assess the actual risk of identification.

A figure of two in a large, diverse cohort may present very little risk. Conversely, a figure of six in a very small or distinctive group might still reveal personal information. Schools should consider the size of the population, the characteristics of the individuals concerned, what is already publicly known and whether the requested information could be combined with other data.

There is also another potential problem. Suppose the school suppresses three small ethnicity categories but publishes the overall total and the larger categories. A requester might simply subtract the published figures from the total and work out the suppressed numbers. This is why statistical disclosure controls sometimes require secondary suppression: withholding an additional figure to prevent the original protected information being calculated. Alternatively, the school might combine categories into broader groups where this can be done meaningfully and safely.

The aim should not be to conceal information unnecessarily, but to provide the greatest amount of useful statistical information without exposing individual pupils.

What would the ICO expect?

The Information Commissioner's Office (ICO) provides guidance on anonymisation and the circumstances in which information can still identify individuals. One important concept is the motivated intruder test. In straightforward terms, this involves considering whether someone reasonably motivated to identify an individual could do so using the information disclosed and other information reasonably available to them. The hypothetical person does not need specialist investigative powers or unlawful access to school systems. They might simply have knowledge of the school community, access to published reports or information obtained from social media. For example, if a parent already knows that a particular pupil was transferred to another school, a statistical breakdown might reveal additional information about the circumstances or classification of that move.

The ICO's approach recognises that anonymisation is not always absolute. Schools should consider whether identification is reasonably likely, rather than focusing on remote or purely theoretical possibilities. This is particularly important when dealing with children, safeguarding information, special educational needs or potentially sensitive behavioural matters.

What about university students and academic research?

Schools sometimes receive requests from students undertaking dissertations or research projects. The research may be entirely legitimate and potentially valuable. Indeed, providing statistical information can contribute to greater understanding of educational practice and outcomes. However, the requester's academic status does not create an automatic entitlement to information that would otherwise be exempt from disclosure.

Under FOI, information released in response to a request is generally treated as information that could be disclosed to the public, not simply shared confidentially with the individual requester. A university student might assure the school that the information will only be used for research, but that assurance does not remove the school's responsibilities under the FOI Act.

Where disclosure under FOI would be inappropriate, a school could separately consider whether a properly governed research-sharing arrangement is lawful and justified. That would require its own assessment and safeguards; it is not a way of bypassing an FOI exemption.

A practical approach for schools

Before releasing statistical information that includes small groups or potentially sensitive characteristics, schools should follow a proportionate review process.

1. Establish what information is actually held. FOI generally concerns recorded information. The school is not normally required to undertake new research or create information it does not hold, although extracting information from existing records may still be required.

2. Review the complete dataset. Consider all the tables and figures being disclosed, rather than assessing each figure in isolation.

3. Identify small or distinctive groups. Particular attention should be paid to ethnicity, disability, special educational needs, safeguarding, exclusions and other sensitive matters.

4. Consider identification risks. Could someone familiar with the school reasonably identify an individual or discover previously unknown information about them?

5. Consider aggregation and suppression. Combining categories, using broader reporting periods or suppressing particular figures may reduce the risk. Check whether suppressed values can be calculated from totals.

6. Document the decision. Record what was disclosed, what was withheld and why. Where section 40(2) applies, explain the exemption appropriately in the response.

7. Respond within the statutory timescale. Privacy concerns do not remove the school's obligation to handle the request promptly and lawfully.

Schools should also be careful not to overreact. A small figure is not automatically personal data, and it would be inappropriate to withhold useful information simply because it might be considered sensitive. The decision should be based on a reasoned assessment of identification risk and the relevant legal provisions.

Good information governance means being open and careful

Freedom of Information and data protection are sometimes portrayed as competing obligations. In reality, both are concerned with the responsible handling of information.

FOI promotes transparency and public accountability. Data protection safeguards individuals against inappropriate use or disclosure of their personal information.

Schools should be able to meet both objectives.

A well-managed FOI process should encourage the release of information wherever lawful, while recognising that statistical information about relatively small groups of children sometimes requires additional care. This is particularly important in smaller schools, specialist settings and schools with limited ethnic diversity, where individuals may be more readily identifiable. The same considerations can apply to information about staff, including sickness absence, disciplinary cases, grievances and other workforce statistics.

Keeping a proper record

For Insight MSIG clients, the Information Governance Master Record provides a convenient means of recording FOI requests, decisions, exemptions, response dates and associated information governance activity.

Where a request raises particular concerns about anonymisation or statistical disclosure, I recommend retaining a brief record of the assessment and the reasoning behind the final decision. This provides an audit trail if the requester subsequently challenges the response or refers the matter to the ICO. It also helps schools apply a consistent approach when similar requests are received in the future.

Final thoughts

Schools should not be afraid of providing statistical information. Most requests can be answered without compromising pupil confidentiality, and openness about school performance, demographics and educational practices is an important part of public accountability.

However, the assumption that statistics are automatically anonymous simply because names have been removed is a dangerous one. A single figure, combined with other apparently harmless information, may reveal considerably more than the school intended.

The best approach is neither automatic disclosure nor blanket refusal. It is to ask one simple question:

Could someone reasonably work out who this information relates to?

If the answer is yes, the school should consider whether the information can be presented differently or whether an FOI exemption applies.

That is sensible information governance, and it protects both the school and the pupils whose information it holds.