Data Protection Act 1998: Information for Students
1 Nature of the Act
The Data Protection Act 1998 concerns personal privacy. It provides in relation to personal information held about individuals that:
- the data must be held only when necessary;
- the fact that data is held should be known to the individual;
- the reasons for holding the data should be explained to the individual;
- the data should be accurate;
- the data should be shown to third parties only with the individual’s permission or with justification;
- subject to some exceptions, the data must be available for the individual’s inspection;
- the individual may request amendment or destruction of the data.
2 Data held by the University
The University must hold and process data relating to students in order to undertake teaching and research, to comply with health and safety and other laws and regulations, and to ensure the security and well-being of staff and students. For legal reasons, unless specifically stated in a University record retention schedule, data on students will be held for at least six years after the student has left the University. There is special provision for the care and disposal of medical records held by the Students’ Health Service.
3 Conditions of acceptance
It is a condition of acceptance at the University of Bristol that students agree that, where relevant for the purposes mentioned above, the following data may be retained and used in accordance with the Data Protection Act 1998:
- Personal details
- Photographs
- Financial information
- Academic marks
- Appraisals
- References
- Disciplinary information
- Information relating to criminal offences or convictions
- Information relating to health
- Information on disability
- Information on ethnic origin (for Equal Opportunities monitoring)
- Information on interests and hobbies
- Dietary requirements
- Religious belief
It is a further condition of acceptance for students that, unless there are good reasons to the contrary, the University may put their names, departments, programmes of study and, where appropriate, research details on the Internet, and this will be considered public knowledge. Degree results will be made public on University notice boards and at degree ceremonies.
Unless there are good reasons to do otherwise, the University will also put each student’s photograph onto the University’s internal Intranet, for administrative purposes.
Unless a student requests otherwise, the University will retain students’ names and addresses after they have left the University for friend- and fund-raising activities.
The University will also contact recent graduates to ask them to complete the Higher Education Statistics Agency (HESA) ‘Destination of Leavers from Higher Education’ survey. Some leavers may be re-surveyed a few years later; if so, the University will pass their contact details on to the organisation that has been contracted to carry out that survey. That organisation will use the contact details only for that purpose and will then delete them. Individuals who do not wish to take part in the second survey should inform the University.
For more information on how the University uses student personal data, please see http://www.bris.ac.uk/secretary/dataprotection/individ/students.html
4 Data provided to the Higher Education Statistics Agency (HESA)
The University is required by law to send certain personal information relating to all its students annually to HESA. The categories of sensitive data collected by HESA are ethnicity and disability. The University is obliged to ask staff and students for this information. Staff and students, however, may refuse to give it. These records will be added to a database that will be passed to the central government departments and those agencies and devolved administrations that need the data to carry out their statutory functions under the Education Acts. The data will also be used for statistical analysis by HESA and the above bodies, the result of which will be published and released to other approved non-statutory users, including academic researchers and commercial bodies.
HESA will also retain the contact details of current students; they are not provided to other government departments or other agencies. Student contact details will, however, be passed to the organisation contracted to carry out the National Student Survey. The details will be used for that purpose only and then deleted.
Individuals are allowed to withdraw their record from HESA analyses; further information on this can be found at the HESA website (see below).
Under the Data Protection Act 1998 students have the right, for a small fee, to a copy of the data held about them by HESA. Anybody wishing to avail themselves of this right, or to discuss any concerns about the use of their personal data, should contact HESA at www.hesa.ac.uk, or write to the Data Protection Officer, HESA, 95 Promenade, Cheltenham GL50 1HZ.
Further information on how HESA uses student personal data, please see: http://www.bristol.ac.uk/secretary/dataprotection/individ/hesadata.html
Last amended August 2006.