Request for comments
*Key*
<T> = title
<ST> = Subtitle
<R> = Recommendation
<T>StudentUse of Personal Data
<ST>Personaldata processed under the effective control of an
institution
In cases where students are processing personal data within HE
and FE institutions (e.g. on institutional machinery):
- for the purposes of research or study;
- in pursuit of an academic qualification;
- and under the direct supervision of a member of staff,
if those HE and FE institutions can demonstrate direct and
effective control over the personal data then the students
conducting the research, or engaged in the course of study, can
rely upon the notification to the DPC provided by their institutions.
<R> HE and FE institutions should ensure that personal data
processed for research and study purposes is adequately covered
by their institutional notification.
<ST>Personal data processed outside the effective control of an
institution
Where students process personal data, and that processing is:
- for the purposes of research or study in pursuit of an academic
qualification, but not under the direct supervision of a member of
staff; or
- their institutions cannot guarantee direct and effective control
over the personal data;
such processing will be deemed to be for the student’s own
personal or domestic purposes and the processing will be exempt
from notification.
<R> HE and FE institutions are not responsible for notification of
personal data processed by students outside the effective control
of those institutions e.g for students’ own personal or domestic
purposes.
Where students process personal data, and that processing is:
- not for the purposes of research or study in pursuit of an
academic qualification; or
- for the purposes of research or study in pursuit of an academic
qualification but with a view to the students commercially
exploiting its products
notification by the students to the DPC may be required.
<R> HE and FE institutions should ensure that students are
provided with guidelines explaining the need for notification where
their processing is likely to fall outside the institutional notification
or the “personal or domestic purposes” exemption, e.g. where the
processing is intended to lead to the commercial exploitation of
personal data.
<ST>Student access to, and use of, Personal Data within FE and
HE institutions
Students may on occasion be in a position to access personal
data held and processed within FE and HE institutions. It is
important to ensure that students are apprised of the rights of data
subjects, and both their, and their institution’s, responsibilities with
regard to access to, and use of, personal data. This is particularly
so where students will be processing personal data in the course of
their studies.
<R> FE and HE institutions should ensure that students are:
- aware that all personal data collected, held, and processed on
institutional machinery, including via WWW tools and other Internet
software are subject to the Data Protection Principles
- aware that all personal data collected, held, and processed in
structured manual files within institutions are subject to the Data
Protection Principles
- aware of the circumstances under which they may legitimately
access, process and disclose personal data held on institutional
computer systems
<R> FE and HE institutions should ensure that
- guidelines for the proper use of personal data within an
institution are available to all students
- there is a mechanism to ensure that misuse of personal data by
students within an institution can be identified and remedied
- there is a mechanism for data subjects to object to the
accessing, processing and disclosure of their personal data held
by students within an institution, in structured manual files or
computerised form, where data subjects feel it may cause them
significant damage or distress
Andrew Charlesworth
Senior Lecturer in IT law
Director, Information Law and Technology Unit
University of Hull Law School
Hull, UK, HU6 7RX
Voice: 01482 466387 Fax: 01482 466388
E-mail: [log in to unmask]
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
