This is a query about publication of examination results to third
parties and Data Protection. It's probably familiar territory for some
of you, but I am new to adminstering this particular area so am seeking
advice. I hope you can help me with this query.
We have received a request from the AQA awarding body in the form of two
largish lists of students, requesting undergraduate degree results of
First Year and Final Year students who had previously undertaken a
Access to HE course validated by AQA. Each list shows students by name,
sex, date of birth, and the course they are believed to taken up at our
institution and requests us to provide them with UCAS No and either
First Year results/final degree results, as appropriate. It also give
us the code for the access course that the student took (from which I
can detect that some of them were within our own institution but some
were at other colleges.)
We are unsure whether this request is covered by the data protection act
requirement to have the consent of each student ('data subject') in
writing.
We have consulted the JISC Guidance on Data Protection section on
transfer of data to third parties which says:
"A further issue arises with circumstances where employment agencies or
prospective employers contact institutions to verify details about a
student, such as attendance records, examination results, and degree
classifications. In most circumstances, students would not object to the
disclosure of such information, and indeed it would appear to benefit
the student. However, at the least care should be taken to ascertain
that the third party has a genuine requirement for the information, and
thus, for example, telephone disclosure would appear to be
unsatisfactory, as verification of identity in such circumstances is
difficult. Ideally, the request for the disclosure of the details to the
third party should either come from the data subject directly, or the
request from the third party should be accompanied by a statement from
the data subject consenting to the disclosure. "
http://www.jisc.ac.uk/publications/publications/pub_dpacop_0101.aspx#thi
rd
The "Candidate Verifier" service for employers (operated by
Experian)offers confirmation of degree qualifications, but requires
those submitting requests to have the consent of potential candidates
(data subjects).
The AQA awarding body would seem to me to be a tricky example, as it is
not a potential or actual employer or sponsor, where maybe we could
automatically assume the student has given consent by virtue of applying
for a job/sponsorship, or a potential institution for further study
which the student could be assumed to have applied to. It appears to be
collecting this data for its own benefit only. So we wonder if we
should ask AQA to prove consent of the student for disclosure of this
personal data? (Bearing in mind that publication of pass lists where
the public can view them is now advised to be done anonymously by PIN
rather than by name).
Ten or 20 years ago I would have filled this in without thinking about
it and possibly my colleagues did this last year, but protection of
personal data and disclosure to third parties is now an increasing
concern in both law and wider society and we all need to be vigilant to
make sure we are following the letter and spirit of the law.
Have other people received this request and how do they respond to it
and similar?
Replies to me only please and I'll advise the list on what people have
said and what we decide to do. If anyone has a guidance sheet for staff
or information on their website, I'd be grateful if you could provide
that.
Many thanks
Mike Milne-Picken
HE Development Consultant
Bradford College
Tel 01274 433008
[log in to unmask]
Email from Bradford College is subject to a disclaimer, the full
contents of which are available for viewing at the following link:
http://www.bradfordcollege.ac.uk/emaildisclaimer.htm
