Jane,
As an ex-erstwhile student of your employer's predecessor, as well as a DPO,
I think you are totally correct in stating that information gathered for
emergency contact purposes and general student administration may not be
used for fund raising from parents.
If you have identified marketing to the student as a purpose, that does not
include marketing or fund raising from the parent.
I suffer a lot from "but so and so does it this way, so why can't we"
arguments. This assumes that they have it right, I do wonder with some
organisations. I think the only answer here is to ask them to sign off
against a memorandum where you explain the law and ask them to take full
responsibility for not following your professional advice. Very few people
will sign up to deliberately processing data beyond what they have notified
the Commissioner or the data subject once they understand the impact this
could have on them.
As I am still in personal contact with some other Plymouth alumni I will
discover if you win!
Andrew
Andrew Fogden
Global IT Security & Data Protection Officer
The British Council
London
+44 (0) 20 7389 4148
|