For your information, I have had the following response from our Funding
Council. I am particularly interested in the final paragraph where mention
is made of the First Destination data being linked with funding and hence
coming under the FE&HE Act 1992. The implication is that there is only a
statutory requirement to disclose to HESA if it is tied in with the Funding
Councils remit under the Act. Also, the Funding Councils have the statutory
requirement to collect this data and must therefore be the data
controllersand data controllers for other data they ask HESA to collect.
Universities and HESA must be the data processors and will require contracts
covering the specific data processing operations.




>From HEFCW:

> "Under Schedule 2 of the 1998 Data Protection Act, the relevant condition
> is whether "the processing is necessary for the exercise of any functions
> conferred on any person by or under any enactment".
> 
> In England, legal advice has been sought and the conclusion was that the
> HEFCE is required to provide the information to the Secretary of State at
> the DfEE. The relevant act is the F&HE Act 1992. HESA then extended this
> to Wales, Scotland & Northern Ireland. 
> 
> All of the above seems perfectly logical except that the responsibility of
> the HEFCW is to the National Assembly for Wales (NAW). We have asked HESA
> to check this point but I suspect that, for full compliance with the Data
> Protection Act, the  request for the data should go from the DfEE to the
> NAW to the HEFCW to HESA to the institutions. At present we do not have
> the NAW link. When HESA report back we will let you know their response.
> 
> Looking at it from a completely different perspective, the NAW have issued
> a remit letter to the HEFCW. It specifies that in future years, the HEFCW
> should take First Destination data into account when determining funding
> for institutions. As funding is a function of the F& HE Act 1992, then to
> request the data seems reasonable."
> 


> ----------
> From: 	Lloyd M J B (ISaCS)[SMTP:[log in to unmask]]
> Sent: 	15 August 2000 10:08
> 
> Subject: 	Statutory requirement to send data to HESA
> 
> Dear  <snip>,
> 
> 	One of my duties within the University is to advise on compliance
> with the Data Protection Act.
> 
> 	I am trying to establish the exact statutory requirement on the
> University to send specific data to HESA. On contacting HESA, I was
> advised
> that the authorisation was in the Financial Memorandum issued to us from
> the
> Funding Council. This appears to say no more than the Funding Council can
> demand any information it requires and not to specify the exact
> information.
> It also makes reference to the effect that the University should subscribe
> to HESA.
> 
> 	Whilst it is accepted that there is a requirement to send data to
> the Funding Council, I would like clarification as to whether any and
> every
> request from HESA is subject to the same statutory requirement.
>  	One recent example of the type of request from HESA for information
> on students is for addresses and telephone numbers of students for a MORI
> survey on First Destination employment.
> 
> 	Are you able to advise whether all disclosures of personal data on
> staff and students to HESA are under the terms of a statutory requirement,
> and is that statutory requirement the Further and Higher Education Act
> 1992?
> If that is the case, then I will be able to advise our staff and students
> that they cannot withhold their personal data and their consent is not
> required.
> 
> 
> 
> Mike Lloyd
> 
> Assistant Head (Academic)
> Information Systems and Campus Services
> University of Glamorgan
> Llantwit Road
> Treforest
> Pontypridd CF37 1DL
> 
> tel: 01443 482417
> email: [log in to unmask]
> 
> 
> 




%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%