Has anyone affected (or their parents) considered how this sits in line with the GDPR (implemented as the Data Protection Act 2018). It has various provisions

Has anyone affected (or their parents) considered how this sits in line with the GDPR (implemented as the Data Protection Act 2018). It has various provisions for purely automated decision making processes that have significant effects on a person, and some of these require prior impact assessments to be carried out. It's quite likely these weren't carried out, given the circumstances. Might be an angle for anyone affected that's looking to learn some "real world" skills they weren't taught in the syllabus, and fight back on such a basis.