Our Student Advice Service is contemplating offering advice by e-mail, something some other students unions already do in a small way. We have been trying to think whether there are any data protection implications which arise which don't already affect our work anyway.
For instance, if enquirers chooses a relatively anonymous form of address, so that at a practical level we don't know who they are, have they not yet become a data subject? Or does the fact that the address is particular to them mean that we must assume that they are?
How do we deal with the possibility that someone may enquire through this means without us realising that she is already known to us and may later inform us of a link between the separate enquiries which may be hard for us to verify?
Given that people approach us in the first place, can we infer consent to keeping a record or do we need to specifically ask for it? (Can we do it with physical enquirers?)
Having checked out the info on the DPR site, I'm not entirely confident these questions have been considered for the likes of us.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|