Dear all

Mmm, puzzling how a service costing £35 a throw is trumpeted as a 
benefit to employers, when the current service offered by most HEIs is 
free.  But who am I to object to someone taking work away.... More 
seriously, I'm not at all sure that the DPA angles on this have been 
covered properly.

a) Though I've tried in various ways to get a straight answer, it isn't at all 
clear how HEI's obligation to return individuated student data to HESA 
fares under the 1998 DPA.  The underlying principle is that consent 
must be obtained from the data subject for processing to occur, 
including release of data to a 3rd party.  This raises the possibility of a 
student being entitled to refuse the HEI permission to pass data to 
HESA.  We are repeatedely advised by DPR's office that making 
consent to certain types of processing a condition of entering the 
institution does not constitute free consent and is not acceptable. So 
one goes looking for an exemption to cover us.  The only relevant 
exemption I can see relates to cases where the data controller is 
obliged *by law* to release data to another agency.  The HEI has indeed 
an obligation to return HESA the data it demands, but that obligation, I 
believe, is merely >as a condition of funding<.  This might be stretched 
to 'statutory', but I'm not at all sure that it meets the legal criterion of the 
relevant exemption. So we may all be on shaky ground in this area 
anyway.

b) The mechanism proposed under this new arrangement relies on the 
student giving the employer permission to approach the new agency, for 
the qualification check to be carried out, and it is suggested that this 
satisfies DPA requirements.  But surely the DPA principle of consent to 
processing has *already been broken*, by the passing of data from 
HESA to another agency without specific consent (indeed, the data 
subject won't even know it is happening routinely, unless HEIs tell 
them).

All very dodgy.

Owen

On Mon, 17 Jan 2000 11:05:44 GMT Graham P Robinson wrote:

> From: Graham P Robinson <[log in to unmask]>
> Date: Mon, 17 Jan 2000 11:05:44 GMT
> Subject: HESA and Experian
> To: [log in to unmask]
> 
> 
> Data Protection sneaked into the newspapers again this weekend:
> Saturday's Guardian and today's Telegraph carried articles on the 
degree result 
> checking service being set up by the Higher Education Statistics 
Agency 
> (HESA) and Experian, the credit reference agency.  Employers will 
pay GBP35 
> to Experian for them to check the institution attended, dates, subjects 
studied 
> and grades achieved by prospective employees. Saturday's Guardian 
reported 
> that "To comply with data protection rules, employers will have to 
seek an 
> applicant's permission before consulting Experian but to refuse may 
reflect 
> badly on a job candidate".  
> I understand that HESA was originally set up to analyse and report on 
HE 
> statistics. Though I note from their Register Entry that they are 
registered 
> under "P018 Trading in Personal Information".  This was news to me.  
> I should be interested in reading colleagues views on this.  
> Graham
> PS: I expect most university Student Records offices would be more 
than 
> happy to offer employers a bargain priced confirmation of results 
service 
> undercutting HESA!
> 
> 
> 
> 
> 
> -------------------------------------------------
> Graham Robinson, Senior Administrative Officer
> Registrars Department, Main Building Room B13
> UMIST, PO BOX 88, Manchester M60 1QD, UK
> Telephone 0161 200 8890  Fax 0161 200 3635
> -------------------------------------------------


_____
Owen Richards
Academic Registrar
Sussex University
Tel: 01273 877019
Email: [log in to unmask]





%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%