Collecting Personal Data - for Departments
As a minimum, data subjects should be told:
- who is collecting the personal data (e.g. name of department, research centre);
- the purposes for which the personal data will be held;
- to whom the personal data will be released.
A contact name, job position and telephone number should also be provided.
Prior consent should be obtained from data subjects to hold and process ("handle") their personal data and it is essential that such consent is obtained if the personal data is to be sent outside the EU and/or is sensitive data. Consent must be meaningful so it is important that individiduals understand what will happen to their data and that their consent is freely given.
It is strongly recommended that departments give individuals a plain language description of what will be done with their personal data and, where appropriate, a reassurance that individuals will not be disadvantaged if they choose to withdraw their personal data (for example, tell patients that if they withdraw from a clinical trial their medical data will be unaffected).
The following wording can be suitably amended by departments when collecting personal data:
This personal information will be held and processed for the following purpose(s):
I agree to the University of Bristol ("University") handling (including passing such information to authorised third parties in accordance with the purposes set out above) and processing this information about me. I understand that the information will only be used for the purpose(s) set out above and my consent is conditional upon the University complying with its duties and obligations under the Data Protection Act 1998.
Signature:
Date:
Where appropriate, include a marketing opt-out on data collection forms, so that individuals can assert their right not to receive direct marketing.