I am new to Data Protection and have not emailed the list before. I am
taking a risk by doing it on a Friday but here goes ……..
It is has been brought to my attention that our Finance Office have
purchased a piece of software from company X which enables them to obtain
addresses for debtor students that have been provided to company X by (I
think) credit reference agencies and loan companies. If this address
differs from that held on the student record, the Finance Office then uses
these addresses to chase student debtors. Our Student Records Office will
not use this information to update the official student record as the data
was not supplied by the individuals and so the Finance Office are holding
the information in separate paper files.
I have several issues for debate:
1. I doubt that having new contact addresses passed to the University was
one of the purposes for which the individuals expected their data to be
used when they originally supplied it. But is the University at fault if
company X assures us that they are compliant with the Data Protection Act?
2. Would a suitable contract between the University and company X provide
assurance that the University is compliant with the Act?
3. Could the chasing of debts be regarded as a legitimate interest of the
University, therefore exempting the processing from requiring the consent
of the data subject? Does this allow us to use the information collected
from the third party?
4. Can the University trust company X's assurances that the data is
accurate? Or is the University responsible for checking this data with the
individuals (but how could they do this other than to write to them at the
"new" address?)
5. Should the Finance Office be storing the information once the student
has been contacted/paid their debt?
6. Would we a statement that the University may obtain addresses from third
party sources to help chase debt once students have left the University (in
an early debt collection letter to the students) mean that the collection
of the data complied with the first principle (processed fairly and lawfully)?
7. Would it be better for the University to use a debt collection agency
(as long as we inform students that their personal data will be disclosed
to a third party for this purpose)?
Any comments gratefully received.
Thanks
Miranda
Miranda Whyte
Assistant Registrar
Academic Registry
Loughborough University
01509 222228
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
www.jiscmail.ac.uk/user-manual/summary-user-commands.htm
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|