The information and guidelines within this policy are important and apply to the entire College Community: the Provost, Fellows and all staff and students (referred to collectively as the "College Community" in this policy). Non-compliance may result in disciplinary action.
Introduction
Like all educational establishments, the College holds and processes information about its employees, applicants, students, non-resident members and other individuals for various purposes (for example, the administration of the admissions process, the effective provision of academic and welfare services, to record academic progress, to operate the payroll and to enable correspondence and communication, including the provision of references and certificates). To comply with the Data Protection Act 1998 ("the 1998 Act"), information must be collected and used fairly, stored safely and not disclosed to any unauthorised person.
Scope of Policy
This policy covers records held and processed by London College of Excellence. The College is responsible for its own records under the terms of the 1998 Act, and it has submitted a separate notification to the Information Commissioner.
Summary of Aims
The lawful and correct treatment of personal information is vital to successful operations, and to maintaining confidence in the College Community and the individuals with whom it deals. Therefore, London College of Excellence will, through appropriate management, and strict application of criteria and controls:
- observe fully conditions regarding the fair collection and use of information;
- meet its legal obligations to specify the purposes for which information is used;
- collect and process appropriate information, and only to the extent that it is needed to fulfil operational needs or to comply with any legal requirements;
- ensure the quality of information used;
- apply strict checks to determine the length of time information is held;
- ensure that the rights of people about whom information is held can be fully exercised under the Act. (These include: the right to be informed that processing is being undertaken; the right of access to one’s personal information; the right to prevent processing in certain circumstances; the right to correct, rectify, block or erase information which is regarded as wrong information.);
- take appropriate technical and organisational security measures to safeguard personal information;
- ensure that personal information is not transferred abroad without suitable safeguards.
Notification to the Information Commissioner
The College has an obligation as a Data Controller to notify the Information Commissioner (formerly called the Data Protection Registrar) of the purposes for which it processes personal data. Individual data subjects can obtain full details of the College’s data protection registration/notification with the Information Commissioner from the College Data Protection Officer or from the Information Commissioner’s website (http://www.dataprotection.gov.uk).
Data Protection Principles
The College, as a Data Controller, must comply with the Data Protection Principles which are set out in the 1998 Act. In summary these state that personal data shall:
- Be processed fairly and lawfully and shall not be processed unless certain conditions are met.
- Be obtained for specified and lawful purposes and shall not be processed in any manner incompatible with those purposes.
- Be adequate, relevant and not excessive for those purposes.
- Be accurate and kept up to date.
- Not be kept for longer than is necessary for those purposes.
- Be processed in accordance with the data subject’s rights under the 1998 Act, as amended by the Freedom of Information Act 2000.
- Be the subject of appropriate technical and organisational measures against unauthorised or unlawful processing, accidental loss or destruction.
- Not be transferred to a country outside the European Economic Area, unless that country or territory has equivalent levels of protection for personal data.
Processing
"Processing", in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including:
(a) organisation, adaptation or alteration of the information or data,(b) retrieval, consultation or use of the information or data,
(c) disclosure of the information or data by transmission, dissemination or otherwise making available, or
(d) alignment, combination, blocking, erasure or destruction of the information or data.
Data Protection Officer
The College Data Protection Officer is the Librarian. All queries about the College policy and all requests for access to personal data should be addressed to the Data Protection Officer (see "Right to Access Personal Data" below).
Responsibilities of individual Data Users
All members of the College Community who record and/or process personal data in any form (called "Data Users" in this policy) must ensure that they comply with the requirements of the 1998 Act (including the Data Protection Principles) and with the College’s data protection policy (including any procedures and guidelines which may be issued from time to time). A breach of the 1998 Act and/or the College’s data protection policy may result in disciplinary proceedings.
In particular, no member of the College Community may, without the prior written authorisation of the Data Protection Officer:
1. develop a new computer system for processing personal data;2. use an existing computer system to process personal data for a new purpose;
3. create a new manual filing system containing personal data;
4. use an existing manual filing system containing personal data for a new purpose.
The above does not apply to databases which are maintained by individual Data Users within the College Community for their private domestic uses, for example, private address books. However, individual Data Users should consider whether their private domestic uses fall within the scope of the 1998 Act.
Data Areas" and "Data Area Contacts
To aid the efficient administration of the College’s data protection policy, the data which the College holds/processes has been divided into a number of "Data Areas": these are described below, showing who may have access to the data. In each case, there is also specified a "Data Area Contact".
He or she will be responsible in relation to the data in the Data Area in question (and thus not simply for the files which he or she maintains) for the following:
- informing the Data Protection Officer of proposed processing of personal data within the College which may need to be notified to the Information Commissioner;
- providing personal data to the Data Protection Officer in response to a subject access request when requested to do so by the Data Protection Officer; and
- maintaining the security of, and access to, personal data within the Data Area.
The Data Protection Officer may from time to time designate other Data Areas and/or Data Area Contacts. The Data Protection Officer or his appointee will have access to all of these data areas as required to achieve compliance with the Data Protection and Freedom of Information Acts.
Data Areas
1. Tutorial files
Tutorial files are maintained in respect of students’ academic progress and welfare. They may also contain financial and medical data. The purposes for which they are maintained include monitoring students’ academic progress and general welfare and administering the relevant student’s applications for employment, professional training or admission to other educational establishments.
Current Tutorial files are to be kept by the Senior Tutor. Tutorial files may be consulted on a day-to-day basis by the Senior Tutor, the students’ own Tutor and Director of Studies, the Tutorial Bursar and Lay Dean, and members of the secretarial staff in the Tutorial Office. Tutorial files for past students are held in semi-current storage and may be consulted by the Senior Tutor and, with his permission, Fellows writing references. All other requests for access to a Tutorial file must be authorised by the Senior Tutor or the relevant Director of Studies.
Data Area Contact: Senior Tutor2. Student admissions files
Admissions files are maintained in respect of candidates, and potential candidates, for admiss¬ions. During the admissions process such files are maintained and kept by the Admissions Tutor, the Graduate Tutors and their secretaries. For successful candidates, the admissions documentation is included in a Tutorial file. For unsuccessful candidates, the admissions documentation is retained for one year and then confidentially destroyed. During the admiss¬ions process, Admissions files may be consulted by the Senior Tutor, any of the Admissions Tutors, any Director of Studies and any other interviewers. All other requests for access to an Admissions file must be authorised by either of the Admissions Tutors or the Senior Tutor.
Data Area Contact: Senior Tutor3. Files relating to loans and grants made by the College to students
These are maintained and kept by the Senior Tutor, the Tutorial Bursar, their secretaries, and the Chief Accountant. These files may be consulted on a day-to-day basis by the Senior Tutor, the Tutorial Bursar, the Graduate Tutors, their secretaries, the Chief Accountant, and senior staff in the Accounts Office. All other requests for access to any of these files must be authorised by either the Tutorial Bursar or the Senior Tutor for those held in the Tutorial Office and the Chief Accountant for those held in the College Office.
Data Area Contact: M Richardson 4. Files in respect of any disciplinary matters involving studentsAll such files are to be maintained and kept by the senior lecturer, who may each consult the same on a day-to-day basis. Sensitive information is placed in a sealed envelope in the student’s Tutorial File. All other requests for access must be authorised by the Senior Tutor.
Data Area Contact: M Richardson5. Medical files in respect of student health and welfare
Medical files are to be maintained and kept by the College Nurse, who may consult the same on a day-to-day basis. All other requests for access to medical files must be authorised by the College Nurse.
Data Area Contact: M Richardson6. Medical notes in respect of students
Such notes are maintained by the Senior Tutor in the student’s Tutorial file for health and safety reasons, to assist in meeting the needs of students with disabilities, or for reasons connected with absences from College, poor performance, applications to the University or to charities etc.
All current notes in this category are to be kept by the Senior Tutor. Sensitive information is placed in a sealed envelope in the student’s Tutorial File. The notes may be consulted on a day-to-day basis by the Senior Tutor, the students’ own Tutor and the Senior Tutor’s Assistant. All other requests for access to these notes must be authorised by the Senior Tutor.
Data Area Contact: Senior Tutor7. Files relating to loans and allowances for Fellows
These are maintained and kept by the First Bursar, the First Bursar’s Personal Assistant, the Chief Accountant, and senior staff in the Accounts Office, who may each consult the same on a day-to-day basis. All other requests for access to any of these files must be authorised by the Chief Accountant.
Data Area Contact: Chief Accountant8. Personnel files in respect of other employed staff of the College
These are maintained and kept by the Personnel Manager. These files may be consulted on a day-to-day basis by the First Bursar, the Domus Bursar, the Chief Accountant, senior Accounts Office staff, any Head of Department (for their own staff only), and their secretaries. All other requests for access to these files must be authorised by the Personnel Manager.
Data Area Contact: Personnel Manager9. Wages files in respect of employed staff and Fellows
These are maintained and kept by the Chief Accountant and Accounts Office staff. These files may be consulted on a day-to-day basis by the Chief Accountant and Accounts Office staff. All other requests for access to these files must be authorised by the Chief Accountant.
Data Area Contact: Chief Accountant10. Files relating to tenancies of College properties, suppliers of goods and services to the College, and other third parties not otherwise dealt with in this policy document
These are maintained and kept by the centre manager. These files may be consulted on a day-to-day basis. All other requests for access must be authorised.
Data Area Contact: First Bursar11. College Archives
The individual files relating to members of the College Community are the basis of the non-resident member records and detailed historical archives of the College, and may be retained indefinitely for reference and research purposes.
At some point after a member of the College Community leaves the College, his or her file(s) will be transferred to the Semi-Current Record Store, then to the Archive Centre. The timing for this will differ from Data Area to Data Area, and within each Data Area will depend upon a number of factors.
Personal data which is contained in archived files may be processed for research purposes (including statistical, historical or biographical purposes). Such processing will be carried out in such a manner to comply with the Data Protection Principles (so far as applicable). The application form to consult these records for research purposes is available from the Archivist.
The College reserves the right to destroy (in whole or in part) archived files whenever it considers it appropriate to do so.
Data Area Contact: Archivist12. Non-resident Member relations
Manual and computer based files are maintained in respect of current and former Fellows, non-resident members, and other current, past and potential donors to the College.
All files are to be kept in the locked Development Office; access to the computer database is to be password protected. Development Office staff may consult the manual and computer based files on a day to day basis, but requests by others to view these files must be authorised by the Head of Development.
Data will be used by the College for a full range of non-resident member activities, including the sending of College publications, promotion of benefits and services available to non-resident members (including those being made available by external organisations), notification of non-resident member activities and fund raising programmes (which might include an element of direct marketing).
The Development Office will seek individuals’ consent to disclosure of their contact details. If an individual has an objection to other aspects of the processing of their data for administrative or fund raising purposes, then written notice should be given to the Head of Development.
Data Area Contact: Head of Development13. Computer Databases
Certain of the files referred to above are maintained in electronic databases as well as, or instead of, paper files. Access to such databases is restricted in the same manner as access to paper files in the relevant Data Area.
In addition, however, the Computer Manager and Computer Officer may have day-to-day access to the electronic databases for the purposes of administering and maintaining the same.
Data Area Contact: Computer ManagerCCTV
The College operates no CCTV cameras.
It is permissible and appropriate for the College to keep records of internal communications which are relevant to an individual’s ongoing relationship with the College, whether as a Fellow, member of staff or student, including information concerning performance and conduct issues, provided such records comply with the Data Protection principles.
It is recognised that email is used for such communications and that such emails should form part of the College’s records. It goes beyond the scope of this policy document to address the appropriate use of email in the proper functioning of the College, and the limitations and legal implications with this mode of communication. However, all members of the College Community need to be aware that:
- the 1998 Act applies to emails which contain personal data about individuals which are sent or received by members of the College Community (other than for their own private purposes as opposed to College purposes);
- subject to certain exceptions, individual data subjects will be entitled to make a data subject access request and have access to emails which contain personal data concerning them, provided that the individual data subject can provide sufficient information for the College to locate the personal data in the emails; and
- the legislation applies to all emails from and to members of the College Community which are sent and received for College purposes, whether or not the emails are sent through the College email system or on an individual’s own email account.
Sensitive Personal Data
The College may from time to time process "sensitive personal data" relating to admissions candidates, members and staff of the College.
"Sensitive personal data" is information as to a data subject’s racial or ethnic origin, political opinions, religious beliefs or beliefs of a similar nature, trade union membership, physical or mental health or condition, sexual life, offences or alleged offences, and information relating to any proceedings for offences committed or allegedly committed by the data subject, including the outcome of those proceedings.
Currently, the College envisages the need to process sensitive personal data of a type specified in the consent forms set out in Schedule to this policy for the purposes specified. For example, data relating to the ethnic origin of members or staff of the College may be processed for the purposes of equal opportunities monitoring or to identify any necessary dietary requirements and possible sources of financial assistance. Medical records need to be processed for the provision of healthcare and general welfare, to identify any necessary dietary and accommodation requirements and to assist in meeting the needs of members of the College Community with disabilities. In exceptional circumstances, the College may need to process information regarding criminal convictions or alleged offences in connection, for example, with any disciplinary proceedings or other legal obligations.
In other circumstances, where sensitive personal data is to be held or processed, the College will seek the explicit consent of the member of the College Community in question unless one of the limited exemptions provided in the Data Protection Act 1998 applies (such as to perform a legal duty regarding employees or to protect the data subject’s or a third party’s vital interests).
Data Security and Disclosure
All members of the College Community are responsible for ensuring that:
- Any personal data which they hold is kept securely.
- Personal data is not disclosed either orally or in writing or otherwise to any unauthorised third party, and that every reasonable effort will be made to see that data is not disclosed accidentally.
Unauthorised disclosure is a disciplinary matter and may be considered gross misconduct. If in any doubt, consult the College Data Protection Officer.
Personal data must be kept securely and examples of how this may be done will include:
- keeping the data locked in a filing cabinet, drawer or room; or
- if the data is computerised, ensuring that the data is password protected or kept only on disk which is itself kept securely; or
- any other appropriate security measure.
Candidates’ and Junior Members’ obligations
Candidates and Junior Members must ensure that any personal data provided to the College is accurate and up to date. They must ensure that any changes of address or other personal details are notified to one of the Admissions Tutors or their secretaries in the case of candidates or the Senior Tutor in the case of Junior Members.
Junior Members must comply with the College’s Computing Regulations.
Data Subjects’ Consent
Certain types of personal data may be processed for particular purposes without the consent of individual data subjects. However, it is the College’s policy to seek express consent whenever practicable from individual data subjects for the main ways in which the College may hold and process personal data concerning them. This is to allow individuals an opportunity to raise any objections to any intended processing of personal data. The College will consider any such objections but reserves the right to process personal data in order to carry out its functions as permitted by law.
Therefore, all prospective Fellows, staff, admissions candidates and students will be asked to sign a consent form regarding particular types of information which the College may in due course hold/process about them. Existing Fellows, staff and students will also be asked to sign a consent form.
Right to Access Personal Data
- Staff, students and other individuals have the right under the 1998 Act to access any personal data that is being held about them either in an "automatically processable form" (mainly computer records) or in a "relevant filing system" (i.e. any set of information structured in such a way that specific information relating to a particular individual is readily accessible) and to request the correction of such data where they are incorrect. The Freedom of Information Act 2000 amends the Data Protection Act 1998 in a number of ways, including extending data subjects’ right of access to personal information held about them by the College. From 1 January 2005 individuals have the right to access personal information held in "unstructured" files, so that even personal data held in a file relating to something else (e.g. a file without the subject’s name on the front, or minutes of a meeting) must be disclosed to the data subject under the Data Protection Act provided that the individual data subject can provide sufficient information for the College to locate the personal data.
An individual who wishes to exercise his/her right of access is asked to complete the College "Subject Access Request" form which is available from the Archives Centre and give it to the Data Protection Officer.
Any inaccuracies in data disclosed in this way should be communicated immediately to the Data Protection Officer who shall take appropriate steps to make the necessary amendments.
The College will make a charge of £10 (or such other charge as is permitted from time to time by the Data Protection Act 1998) on each occasion that access is requested and this fee should accompany the Subject Access Request form. In accordance with the 1998 Act, the College reserves the right to refuse repeated requests where a reasonable period has not elapsed between requests.
The College will normally respond to the request for access to personal data within 20 days (including bank holidays and weekends) of the request or payment of the fee, whichever is the later.
Please contact the Data Protection Officer for further information.
Disclosure outside of the EEA
The College may, from time to time, desire to transfer personal data to countries or territories outside of the European Economic Area in accordance with purposes made known to individual data subjects. For example, the names and contact details at the College of members of staff on a website may constitute a transfer of personal data world wide. Accordingly, the consent form signifies an individual’s consent to the inclusion of such data on an authorised College website. If an individual wishes to raise an objection to this disclosure then written notice should be given to the Data Protection Officer.
Other personal data, even if it would otherwise constitute fair processing, must not, unless certain exemptions apply or protective measures taken, be disclosed or transferred outside the EEA to a country or territory which does not ensure an adequate level of protection for the rights and freedoms of data subjects.