I was hoping not to say any more!
>As Ian Webb has written in another email, the DPA really only comes into
its
> full effect when information is passed between 2 or more institutions. Any
> information can be passed within an institution as long as its use is
> deemed
> worthy - i.e. you can only pass (sensitive) information to people to whom
> it
> would be relevant.
>
It is perfectly possible for a DPA offence to be committed by transfers of
personal data within an organisation. Sensitive data including racial or
ethnic origin and physical or mental health or condition can only be
processed (and that includes passing it to somebody else) in circumstances
meeting one of the conditions in Schedule 3 to the Act as well as one of the
conditions in Schedule 2, which all processing has to meet. The most likely
Schedule 3 condition is the "explicit consent" of the data subject. In this
context that means that the student with disabilities should have an
informed understanding of what you might do with information about their
disability and agree to it. If that hasn't happened you will need a better
reason than that it was "deemed worthy" to pass it on even within the
institution and even when you think it's to the student's benefit. I think
the general assumption must be that if a person is capable of deciding to
take an HE course and benefiting from it they're capable of deciding what
you can do with information about their disability. If their decision will
have negative consequences, they need to take account of them but you can't
take the decision away from them.
Paul
|