We use cookies to ensure that we give you the best experience on our website. You can change your cookie settings at any time. Otherwise, we'll assume you're OK to continue.

Data Protection

Frequently Asked Questions

1.     Another organisation has asked me to provider a reference about a colleague. If I write it, will my colleague be entitled to see it?

You will not be required to provide it to your colleague. The University is not obliged under the DPA to provide access to confidential references it has given to another organisation. However, the other organisation may be required to provide access to the reference to your colleague if it is requested. Usually, the other organisation will attempt to contact you to see if you have any objections to it being released. Please see this detailed guidance for additional information

2.     Does the University have a standard fair processing notice to use when collecting personal data?

No. The contents of fair processing notices will depend upon the reasons why personal data is being collected and what will be done with it. As a bare minimum they must include:

  • The name and contact details of the University
  • The name and contact details of any organisation collecting personal information on behalf of the University
  • The purposes for which personal information is being collected
  • Any other information necessary to be fair to the data subject.

The last point requires careful consideration. The best advice is to think about it from the point of view of the individual. If the personal information was about you, what would be important to you to know?

 3.   Since we use anonymous codes when marking student work do we not need to worry about the DPA?

If the University or someone else holds the anonymous key then the information is still personal information and subject to the DPA. Making personal information truly anonymous (i.e. destroying the key) should only be done after careful consideration. In fact, changing personal information to anonymous information is regulated by the DPA. An individual should have been informed by the University prior to collection that their information would be made anonymous and why.

4.     Why should I bother using anonymous codes if it does not help compliance with the Data Protection Act?

It does help the University to comply. The best reason to de-couple identifying information from other aspects of personal information is to help secure the personal information from unauthorised use or disclosure that would cause harm or prejudice to the individual. It is still personal information, however.

5.     Can I use students' assignments as good/bad examples of work for other students?

The work students submit is personal information. In order to use students' work, even if the students cannot be identified in the work, they should agree to this happening. If the students have not been informed you should not use the work.

6.     The Police want me to give them information about a University student. Should I provide it to them?

Do not let the Police, or anyone else, pressure you to hand over personal information. The Police have no rights under the DPA to demand that personal information be handed over. In non-emergency cases, you should ask the Police to make their request for personal data in writing and explain why it is required. A decision to release personal information to the Police should be made at a senior level (i.e. College Principal or Senior Tutor) and the rationale well documented.

In a situation where personal information may be required immediately to protect the life of the individual or another third party, the decision whether to release personal information should not be made lightly and the information provided should be proportionate to the nature of the situation and its urgency. As time allows, you should involve available senior University staff to assist with the decision. Provide senior staff with a description of the information provided to the Police as soon as possible. Further actions may be necessary.

7.     If I make a subject access request will I be able to see my exam scripts?

No. Schedule 7(9) of the Data Protection Act specifically exempts access to information recorded by students during academic, professional or other exams. You are able to have a copy of the comments recorded by examiners when marking scripts but the work you submitted would not be provided.

8.     It is almost the end of term and I have just noticed that SPA will be publishing pass lists. Can I ask for my name to be omitted?

Yes, you can, but please bear in mind that the University makes all students aware that pass lists will be published when you enrol and agree to abide by the Data Protection Policy and section 6.5.7 of the Learning and Teaching Handbook. The University publishes pass lists for just a few months in order to provide results to students quickly and easily regardless of their location and to help student verify their awards to potential employers. Due to the volume of work in SPA during the exams and results publishing periods, it may not be possible to process a request to be omitted from a pass list promptly if it is received later than two weeks after the start of the term in which the pass list will be published. If you do submit a late request to have your name omitted from a pass list, please complete the relevant form in the Learning and Teaching Handbook, giving a brief explanation of why your name should be omitted. SPA will comply with your request at the earliest opportunity, but you should be aware that this is likely to follow publication. A new form will need to be completed for each pass list in each year in which results are published.