Stella
The DPA does not specify at what age a person becomes a data subject entitled
to their rights.
It is couched in terms of whether the individual understands their rights
(competence) and I should be surprised if 19 year olds are unaware of their
right to be treated as adults.
If you wanted to disclose details of a staff member to their parents
(excluding emergency situations) you would need consent. It therefore
follows that you would need the consent of any competent person including
students.
If, however, fees are paid by the parents (a contract situation?) and you
need to tell them their son / daughter is not attending I see no problem so
long as you tell them the bare minimum necessary to know that their money is
being wasted.
I noticed a reply from the DPO at Dundee University but Scots law on this
matter differs from that applicable in England and Wales.
Ian Buckland
MD
Keep IT Legal Ltd
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|