A question for colleagues in the HE sector:
Each year, hundreds of students make contact with our student support
and/or counselling services, seeking help with personal problems. This
is, of course, a busy time of year, as exams loom, and its particularly
the case at such stressful times that students arrive unannounced,
without appointments, seeking immediate help.
My own general advice
(http://www.dpa.lancs.ac.uk/approved/student_support.htm) remains that
"for Support services the required condition for processing personal
data will be "consent of the data subject". Such consent should be
sought at the point of first contact, in general terms for non-sensitive
personal data and in more detail for sensitive personal data such as
that relating to a student's health. The student should be informed as
to how their data will be used and to whom data may be disclosed". This
advice was derived from consultation with the OIC.
What concerns the various student support services at Lancaster is that
there are occasions when the student is at such a point of crisis that
they are in no state to sign anything and it would be wholly
inappropriate to try to make them do so. In terms of fair processing
Schedule 1 Part II does state that fair processing information should be
provided "before the relevant time or AS SOON AS PRACTICABLE AFTER THAT
TIME". Hence, if we were to wait for them to calm down and then give
them information about how their data will be used then that should be
OK. However, because they will nearly always raise, and hence we will
record, sensitive issues about health, beliefs, sexuality etc, there are
real problems because I'm assuming that the Schedule 3 requirement that
sensitive data be processed in a very limited set of circumstances
(which pretty much means explicit consent in this sort of case) isn't
something that can be delayed until "as soon as practicable" after the
event.
I'd be interested to know how other HEIs deal with this. I guess the
options are -
(i) Process anyway, in the knowledge that complaint is fairly unlikely
and you are acting in good faith, seeking consent later
(ii) Get them to sign something whatever sort of state they are in (and
refuse to provide a service until you've got something in writing?!)
(iii) Try to hide behind some sort of potentially spurious
interpretation of the situation, e.g. that you're acting in protection
of the individual's "vital interests" and hence the requirements of
schedule 3 are met.
Thoughts welcome.
Andrew Okey
Data Protection Officer
Lancaster University
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
http://www.jiscmail.ac.uk/help/commandref.htm
Any queries about sending or receiving message please send to the list owner
[log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|