Gail Waters from the OU brought this up last week but nobody's come up
with a reassuring answer yet.
What about STUDENTS processing personal data (e.g. from
questionnaires) as part of their academic research? Who is the data
controller? Who has to notify?
1. It isn't really the UNIVERSITY who is the data controller, since
the students aren't employees, and we don't 'control' what data they
collect, and what they do with the data. The student isn't processing
the data on our behalf, they are independently undertaking the
research as part of their studies. (I am excluding quasi-employees
such as postgraduate research assistants here, as they probably do
come under the University's remit. I am just thinking about an average
social sciences undergraduate doing their final year project or
whatever).
2. If it is the STUDENT who is the data controller, then it looks to
me as if they would have to NOTIFY the Data Protection Commissioner!
[See the 'Notification' bit of the DP Commissioner's website
http://wood.ccta.gov.uk/dpr/dpdoc.nsf which has a step-by-step guide
'do I have to notify'. If you are processing data for the purpose of
research, the answer comes out as 'YES']. I could understand it if
the student had to conform with the Act -fair and lawful processing
etc- but didn't have to notify (as with manual processing) but surely
they can't be expcted to NOTIFY?!
Or have I missed some notification exemptions somewhere.....
Anne Johnson, Assistant Registrar
Student Systems Office, Sussex House,
University of Sussex, Falmer, Brighton BN1 9RH
Telephone (01273) 678761; Fax (01273) 877389
E-mail [log in to unmask]
http://www.sussex.ac.uk/Units/sso/
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|