If the counselling service is confidential, this is exactly the sort of
circumstance where I would suggest looking at Statutory Instrument 2000
No.417 - The Data Protection (Processing of Sensitive Personal Data) Order
2000, which adds to the list of Schedule 3 conditions.
The relevant bit of the SI (s.4 of its Schedule) says that processing
sensitive personal data may be carried out where:
"The processing -
(a) is in the substantial public interest;
(b) is necessary for the discharge of any function which is designed for the
provision of confidential counselling, advice, support or any other service;
and
(c) is carried out without the explicit consent of the data subject because
the processing -
(i) is necessary in a case where consent cannot be given by the data
subject,
(ii) is necessary in a case where the data controller cannot reasonably be
expected to obtain the explicit consent of the data subject, or
(iii) must necessarily be carried out without the explicit consent of the
data subject being sought so as not to prejudice the provision of that
counselling, advice, support or other service."
In other words, as long as you are protecting the interests of the Data
Subject by maintaining confidentiality, you can process sensitive data
without consent until things have calmed down.
Paul Ticher
0116 273 8191
22 Stoughton Drive North, Leicester LE5 5UB
I hereby require any recipient of this message not to use my personal data
for direct marketing purposes.
----- Original Message -----
From: "Okey, Andrew" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Thursday, May 11, 2006 2:33 PM
Subject: Student support and counselling
A question for colleagues in the HE sector:
Each year, hundreds of students make contact with our student support
and/or counselling services, seeking help with personal problems. This
is, of course, a busy time of year, as exams loom, and its particularly
the case at such stressful times that students arrive unannounced,
without appointments, seeking immediate help.
My own general advice
(http://www.dpa.lancs.ac.uk/approved/student_support.htm) remains that
"for Support services the required condition for processing personal
data will be "consent of the data subject". Such consent should be
sought at the point of first contact, in general terms for non-sensitive
personal data and in more detail for sensitive personal data such as
that relating to a student's health. The student should be informed as
to how their data will be used and to whom data may be disclosed". This
advice was derived from consultation with the OIC.
What concerns the various student support services at Lancaster is that
there are occasions when the student is at such a point of crisis that
they are in no state to sign anything and it would be wholly
inappropriate to try to make them do so. In terms of fair processing
Schedule 1 Part II does state that fair processing information should be
provided "before the relevant time or AS SOON AS PRACTICABLE AFTER THAT
TIME". Hence, if we were to wait for them to calm down and then give
them information about how their data will be used then that should be
OK. However, because they will nearly always raise, and hence we will
record, sensitive issues about health, beliefs, sexuality etc, there are
real problems because I'm assuming that the Schedule 3 requirement that
sensitive data be processed in a very limited set of circumstances
(which pretty much means explicit consent in this sort of case) isn't
something that can be delayed until "as soon as practicable" after the
event.
I'd be interested to know how other HEIs deal with this. I guess the
options are -
(i) Process anyway, in the knowledge that complaint is fairly unlikely
and you are acting in good faith, seeking consent later
(ii) Get them to sign something whatever sort of state they are in (and
refuse to provide a service until you've got something in writing?!)
(iii) Try to hide behind some sort of potentially spurious
interpretation of the situation, e.g. that you're acting in protection
of the individual's "vital interests" and hence the requirements of
schedule 3 are met.
Thoughts welcome.
Andrew Okey
Data Protection Officer
Lancaster University
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
http://www.jiscmail.ac.uk/help/commandref.htm
Any queries about sending or receiving message please send to the list owner
[log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
http://www.jiscmail.ac.uk/help/commandref.htm
Any queries about sending or receiving message please send to the list owner
[log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|