Disclosure of Student Personal Data to Third Parties The table below is based on work by the Lancaster University Data Protection Project. City University will develop appropiate procedures as indicated in the text. It shows those bodies to which an HE institution might release student information either as a regular or ad hoc occurrence and details the basis upon which a disclosure may be made. Where an asterisk appears in the Log column, this marks a case where any disclosure should be recorded in the institutional log of exceptional disclosures. In this event please contact the Head of Information Compliance & Policy before releasing any data. Third party Basis for disclosure Notes Log Professional Bodies Contract with body or statutory requirement (dependent on body) Institutions should ensure that, in cases where particular degree schemes lead to professional recognition, accreditation or exemption, students on such schemes are told at point of registration that their final result (including, if necessary, failure) will be communicated to the relevant professional body. In cases where a professional body makes an ad hoc approach seeking the details of students with qualifications in a particular academic discipline, then such enquiries can only be answered after first seeking the consent of the student(s) involved. Relatives and Guardians Students in Higher Education are private individuals and the University has no responsibility or obligation to keep the relatives of students informed of their progress, or any other aspect of their studies or private lives. The fact that many parents pay substantial sums towards their children s education is nearly always wholly irrelevant (though see also the reference to contractual arrangements raised in the section on Sponsors below). Staff regularly come under intense pressure to discuss students cases with parents. In such cases, it is essential that personal data is not disclosed without the consent of the student involved. Written, rather than verbal, consent is recommended. In certain highly exceptional circumstances, it may be appropriate to disclose information under the terms of Schedule 2 (paragraph 4) of the 1998 Data Staff are free, of course, to discuss institutional procedures with parents. Thus it is possible to explain to a parent what, in principle, happens when a student must resit examinations, spend a year on industrial placement etc, but the specific circumstances of an individual student s case cannot be discussed without the consent of that student. There may be occasional, exceptional circumstances (in which a student s life or health is threatened) in which the usual need to get consent before disclosing to parents may be waived. Most institutions keep students next of kin details for just such purposes, and disclosures should be made only to these named individuals and, as appropriate, the emergency services Census Census officers have no statutory right to ask HE institutions to provide student data. Institutions should co-operate with the distribution of Census forms as far as is possible, but they should not release student data directly to Census officers unless they have prior permission from the student(s) involved. Environment Agency (formerly various bodies including the Radiochemical Inspectorate) In certain highly exceptional circumstances, it may be appropriate to disclose information under the terms of Section 29 of the 1998 Data Institutions should not usually pass student information to the Environment Agency. However, in cases where there has been a potential or actual breach of the Agency s regulations (e.g. the inappropriate disposal of radioactive material) then disclosure may be valid under the terms of the exemptions covered by section 29 of the Data. This section exempts data controllers from Principle 1 in cases where personal data is processed for the purpose of preventing or detecting crime. Health and Safety Executive Reporting of injuries, diseases and dangerous occurrences regulations, 1995 (Statutory instrument SI1995/3163) In cases of accidental injury (for example, occurring to a student during a science lab) institutions are legally obliged to report details of such incidents to the Health and Safety Executive. Institutions should disclose only basic personal details of those injured. Such disclosures should be noted additionally in the institution s Safety Office Department of Environmental In certain circumstances, it may be appropriate to disclose information under the terms of Schedule 2 In cases of notifiable disease amongst students, institutions may be approached by Environmental Health Officers (acting on behalf of a local Medical Officer for Health) requesting information about the student who is suffering the illness and/or those who are
Health (paragraph 4) of the 1998 Data In certain circumstances, there is also a statutory requirement to report notifiable diseases (details of these can be obtained from local health authorities) believed to have been in close contact with them. There is a statutory obligation on institutions to disclose in cases of notifiable disease. Where the disease is serious but not notifiable, institutions may choose to disclose under the terms of paragraph 4 of schedule 2 of the Data (which allows for processing for the purpose of protecting the vital interests of the data subject). In such cases, institutions should disclose only basic details (name, contact address). It is advisable to disclose only to one preagreed individual at the Environmental Health Office. It may also be advisable to accept such requests on a pre-designed form that makes explicit the requester and the circumstances in which the request is made. A sample request form is included as Appendix Three to these guidelines. Council Tax Registration Officers Section 29 (para.1c), and Schedule 2 (para 6(1)) of the 1998 Data Student data may be disclosed to Council Tax Registration Officers as necessary, even without consent. Such disclosures may be made under the terms of Section 29 of the Data, which states that information processed for the assessment or collection of any tax or duty are exempt from the first data protection principle (except to the extent to which it requires compliance with the conditions in Schedules 2 and 3), and section 7. Thus, institutions may pass data to Council Tax Registration Officers on a need-to-know basis: such disclosures are compliant with Schedule 2 of the Act, as the Council Tax Officers clearly are pursuing their legitimate interests in requesting such information. UK Funding Councils (HEFCE, HEFCW etc) and their agents Further and Higher Education Act, 1992 (Section 79) HEIs are required, under the terms of the Further and Higher Education Act, 1992, to disclose information to the Higher Education Funding Councils of England, Wales and Scotland on request. The wording of Section 79 is Each of the following shall give a council such information as they may require for the purposes of the exercise of any of their functions under the Education Acts (b) the governing body of any institution within the higher education sector, and (c) the governing body of any institution at which prescribed courses of higher education are currently or have at any time been provided. (for example, HESA, QAA, HEFCE auditors). Such disclosures will include the incidental disclosure of student data during visits by academic or other auditors appointed by the Funding Councils. There is no need to obtain the consent of students for such disclosures. Students should be informed of the obligation to Funding Councils during the first registration process. Disclosures may be made not only direct to Funding Councils, but also agents of those Councils. HESA acts as a contracted agent of the UK Funding Councils, and thus HEIs are required to disclose information to HESA in the form of the various standard reports HESA collect. These reports include sensitive data relating to ethnicity and disability. Students should be informed of the obligation to HESA during the first registration process, and HEFCE have provided statements for use by institutions for this purpose. UK funding councils are under statutory obligation to monitor quality of tuition at those institutions that they fund. Institutions are statutorily obliged to provide appropriate data to funding councils on request by the Further and Higher Education Act, 1992. Hence, disclosure to QAA (for example, when students details appear in aspect boxes etc) is will be a statutory obligation for UK HEIs. UCAS Applicants are made aware by UCAS when they first submit their details that information will be passed between them and HEIs. Thus, HEIs may pass applicant data freely to UCAS as the need arises. The Police Section 29 (paras.1a,1b), and Schedule 2 (para 6(1)) of the 1998 Data Disclosures to representatives of the Police are not compulsory except in cases where the institution is served with a Court Order requiring information. However, Section 29 of the 1998 Act does allow limited exemption from the first Principle in cases where data is disclosed in relation to the prevention or detection of crime and the apprehension or prosecution of offenders. Thus, institutions may choose to release personal information to the Police in very limited circumstances. Such disclosures should be made only in cases where the Police confirm that they wish to contact a named individual about a named criminal investigation (regardless of whether that individual is suspect or witness) and where the data controller is sure that failure to release would prejudice the investigation. Releases should be made only on receipt of written confirmation (signed by a senior Officer), preferably to an officer who is holding appropriate identification. Most Police Forces will have their own request form, which should always include a statement confirming that the information requested is required for the purposes covered in Section 29, a brief outline of the nature of the investigation and the subject s role in that investigation, and the signature of the investigating officer. Survey / research organisations Institutions may be approached, from time to time, by survey and research organisations, or others conducting research, who wish to be provided with student information or contact details for a sample of the student body. Given the unpredictability of such requests (both in terms of information required and type of enquirer) institutions may not seek any form of blanket consent from students for disclosures of this sort. Instead, institutions must seek informed consent from any student whose details might be disclosed in this context. As an alternative, institutions may be able to act as a host mailer for an enquirer who wishes to survey
the student body. University insurers Other educational establishments Employers and Recruitment Agencies Sponsors Legitimate interests (unless sensitive/exceptional data must be disclosed, in which case consent) Legitimate interests (unless sensitive/exceptional data must be disclosed, in which case consent) Schedule 2, para. 2 of the 1998 Data In cases of accidents occurring within institutional property, an institution may need to release the details of the accident to its insurers. This may involve the release of student details to insurers, notably in cases where a student has suffered injury and may be in a position to claim damages. Such disclosures will usually be justified by the terms of Schedule 2, in that an institution would be making such a disclosure in pursuit of its legitimate interests. However, such disclosures will usually involve health information, which is deemed to be sensitive, and thus disclosure can only be justified if the circumstances match the terms of Schedule 3. Therefore, the possibility of disclosure to insurers should be made clear to students during first registration, so that, in registering, each student is effectively expressing consent for such disclosure to take place should the need arise. Institutions may be asked for information about its current or former students by other educational establishments. Typically, this occurs when a former student wishes to be admitted to a course at another institution. Clearly, such disclosures will usually be in the best interests of the student involved and disclosures of this sort will be a regular occurrence between educational institutions. As this is the case, students should be clearly informed that such disclosures will be made, subject to appropriate security checks. The information released should be the minimum relevant to the request usually, just attendance and award details (though classification and module marks may also be relevant in certain circumstances). Institutions may wish to consider various systems that will help to ensure that disclosures are only made where there is justifiable need. For example, institutions could provide all graduates with a standard permission to disclose letter that they then copy and include in every course application they make, or they could issue each alumni with an identity reference that they should quote on applications made to other institutions. Some institutions may, for promotional purposes, wish to release details of graduating students back to their previous institution (typically, the school at which they took their A levels). Though institutions may wish to regard such promotional work as within their legitimate interests, they may not be able to rely on this justification. Institutions are recommended, therefore, to either inform all incoming students of this purpose at first registration and allow them to opt-out, or to seek consent to disclose as relevant to individual cases. Institutions may be asked for information about its current or former students by their current or potential employers, recruitment agencies etc.. Typically, this occurs when a former student applies for a job. Clearly, such disclosures will usually be in the best interests of the student involved and disclosures of this sort will be a regular occurrence between educational institutions and employers. As this is the case, students should be clearly informed that such disclosures will be made, subject to appropriate security checks. The information released should be the minimum relevant to the request usually, just attendance and award details (though classification and module marks may also be relevant in certain circumstances). Institutions may wish to consider various systems that will help to ensure that disclosures are only made where there is justifiable need. For example, institutions could provide all graduates with a standard permission to disclose letter that they then copy and include in every course application they make, or they could issue each alumni with an identity reference that they should quote on applications made to other institutions. In cases where a student receives sponsorship (defined as financial assistance with fees and/or living costs) from some other person or institution, then institutions will be justified in disclosing limited, relevant information (attendance details, overall performance). Such justification is found in Schedule 2 of the 1998 Act, which states that processing is justified if necessary (a) for the performance of a contract to which the data subject is a party, or (b) for the taking of steps at the request of the data subject with a view to entering into a contract. In all cases, an institution should be certain that disclosures are made only to organisations or individuals with which the student in question has a contractual relationship (this issue is explored fully in the Sponsor guidelines). This definition takes in UK research councils and the Student Loan Company. Institutions are advised, in all cases, to ask students for copies of any formal agreements between them and their sponsor(s). Institutions should note that point (b) of Schedule 2 clearly implies that, in cases where there is not yet any formal contract between student and sponsor, then consent must be sought before release is made to any potential sponsor. Institutions should also note that the release of sensitive data to sponsors (for example, when the suspension of a student s studies is allowed due to illness) will require the explicit consent of the student involved.
Work placement sites Legitimate interest In cases where students undertake industrial placements there will, of necessity, be a limited flow of student data between HEIs and placement sites. Students should be notified of the likelihood of such disclosures before their placement begins. This advice covers the placement of medical students within the Health Service. Overseas institutions (legitimate interest) In cases where there are formal exchange links between UK and overseas HEIs (or equivalent bodies), there will, of necessity, be a limited flow of student data between these sites. In cases where the exchange institution is based outside the EEA, such disclosure will usually require consent from students, sought before their exchange begins. Disclosure to institutions inside the EEA will not need consent (though students should be warned of this anyway before their placement begins). This matter is covered more fully in the Overseas Exchange guidelines. Debt collection agencies Legitimate interest In cases of student bad debt, institutions may refer students to debt collection agencies. Such disclosure can be justified in terms of the pursuit of an institution s legitimate interests, assuming that no sensitive data is passed to any debt agency. Students should be informed of this possibility, at the commencement of any debt review procedures. External Auditors Legitimate Interests All HEIs will be required by their own statutes to appoint external financial auditors. Such auditors will see student data during the course of their investigations. Students should be made aware of this possibility at first registration so that, in registering, they give consent from disclosure of external auditors. Prize-givers In most cases where external bodies (private companies, professional bodies, charities etc) fund prizes to be given to students who attain high standards, the external bodies will wish to see the details of those who have received their prizes. Institutions are advised, therefore, to make prize-winners aware that acceptance of their prize will indicate consent for their details to be disclosed to the prize-giver. The minimum information possible (name and, perhaps, a general indication of performance, but certainly not address) should be disclosed to the prize-giver. Landlords of Universitymanaged properties Many institutions manage residences on behalf of landlords, acting effectively as a letting agent. There is thus no direct contractual (or other formal) relationship between landlord and student. Should a landlord wish to be given the details of the student(s) resident in his/her property, then such disclosures can only be made with the consent of the student(s) involved. Electoral registration officers Representation of the People Act 2000 Electoral Registration Officers have certain powers to require the provision of student information for the purposes of maintaining registers of parliamentary and local government electors. If approached by an Electoral Registration Officer for information about students, an institution should check with the officer why the data is required and under what powers. If satisfied with this, the disclosure can be made. However students should be informed of the disclosure (either being warned of the possibility of disclosure during registration, or being explicitly informed at point of disclosure). Inter-library loans Legitimate Interests In certain cases (notably, when a student requests a copy of an article from the British Library) student details, including a contact address, may be released to libraries for the purposes of completing inter-library loan requests. Students should be alerted to this fact on Inter-Library Loan application forms. European Audit Commission Statutory Obligation The European Audit Commission is entitled, by law, to audit student records pertaining to any scheme that is partially or wholly funded by the European Social Fund. Students should be notified of this possibility during the first registration process. Learning and Skills Councils The DfEE is entitled, by law, to view and audit student records pertaining to any scheme that is partially or wholly funded by the Learning and Skills Councils. Additionally, the DfEE employ an independent research organisation to analyse the performance of FE schemes, and this organisation may also demand to see relevant student records. Students should be notified of this possibility during the first registration process. Local Education Authorities Local Education Authorities assess undergraduate student eligibility for fee and loan payments, operating on behalf of the DfES. Whilst the first assessment process requires no disclosure of information from HEIs to LEAs, LEAs do still require confirmation that students have taken up their place at their institution and/or that they are still in attendance. HEIs are under statutory obligation to make such disclosures, though data disclosed should be limited to bare facts (if sensitive data is to be forwarded to LEAs, this will require the consent of the student involved). Students should be notified of the likely disclosure of data to LEA during the first registration process Student Loan Company Contractual obligation The Student Loan Company provides loans (and, in come cases, fee payments) for undergraduate students. Students who are in receipt of SLC funding sign a formal agreement with the SLC regarding the financing of their studies. Thus, the SLC may be considered a sponsor to whom data may be disclosed as necessary (see above for full discussion regarding sponsors).. Students
should be notified of this during initial application for Student loans Alumni Representatives and other overseas agents Some institutions operate a network of former students and other agents who are available to give advice to applicants (particularly overseas applicants) about the institution. Applicants must give consent for their details to be passed to such agents: they should not receive unsolicited calls from representatives. Solicitors acting on behalf of your institution. Section 35, para. 2 of the 1998 Data Section 35(2) states that the Act s non-disclosure provisions are waived for the purpose of obtaining legal advice. Thus institutions may, without subject consent, release information to their solicitor(s) if that information is relevant to any case on which the institution is seeking legal advice. Solicitors etc. acting on behalf of other persons/bodies. Section 35, para. 2 of the 1998 Data Section 35(2) states that the Act s non-disclosure provisions are waived for the purpose of or in connection with legal proceedings or is otherwise necessary for establishing, exercising or defending legal rights. In cases where institutions are approached by solicitors or others engaged in a Court case, it is worth noting that there is no compulsion to disclose, just because the law gives dispensation to do so. In cases where the institution has no direct involvement in the case, they are advised not to disclose anything without the consent of the student concerned. Journalists Institutions should be aware that there is an exemption from many of the provisions of the Act for the processing of personal data for the purposes of journalism (Section 32). However this does not allow for the disclosure of personal data to journalists by HE staff. Students Union Legitimate Interests The Charters and Statutes of most old Universities mean that their associated Students Unions are an integral part of their organisation, rather than a separate body. For the new universities, Students Unions may well be entirely separate bodies. In most cases, institutions do send limited student information to their Students Union, usually as soon as a student s place at the institution is confirmed, and applicants should be notified of this practice at point of application or point of confirmation of admission. Clearly, such disclosures are within the legitimate interests of both the institution and its Students Union. However, if sensitive details are to be passed to a Union (for example, details of the health of an appellant who is asking the Students Union to represent them at appeal) then, whatever the constitutional position of the Union, explicit consent must be obtained. Department for Work and Pensions (formerly the DHSS) Social Security Administration Act 1992 (Section 109b) [As amended by the Social Security Fraud Act 2001] In cases where an officer of the DWP suspects an individual (for example, a student) of benefit fraud, then statutory powers are available to them that may allow them to require an institution to provide data on one or more named individuals. In such cases, it is recommended that an explicit written statement be obtained from the relevant authorised Officer explaining the context of the request and that the Officer s identity is checked as valid through the DWP s on-line validation service. Disclosures of this sort should be recorded in the institutional exceptional disclosures log. NB. Social Security Officers are governed, in their enquiries, by a Code of Practice available at www.dwp.gov.uk