Text only	\| University \| Search \| News \| A-Z Index \| Contact Us
	Data Protection

____________

Data Protection

Guidelines for staff in the Student Records & Examinations Office (SREO)

Introduction

Data protection is a topic with which all SREO staff and Student Process Assistants (SPAs), who are constantly dealing with information relating to students, should be familiar. These guidelines set out some general points and basic principles relating to data protection in the Student Records & Examinations Office (SREO) context.

Data Protection statement for student registration

SREO staff should be aware of the Data Protection Statement for Student Registration which is available on the University of Bath website, linked to from on-line registration facilities, and reprinted in registration booklets.

Every student who registers at the University agrees to the University's processing the data given in the registration process or obtained about her/him otherwise as set out in the Data Protection Statement, and that he/she has read and understood this.

Disclosing student information to third parties

General

The Data Protection Act 1998 applies to all personal information collected and retained by the University, whether on paper files or computer (e.g. SAMIS). Students are entitled to see all information held about themselves, but personal data is only to be disclosed to third parties under specific conditions. SREO staff must be extremely careful when handling enquiries about individual students from third parties. If you are in any doubt as to how to proceed consult a senior member of SREO staff.

There are some circumstances in which it is permissible to pass personal information relating to a student on to a third party. SREO staff may legitimately disclose relevant data to appropriate third parties for purposes connected with a student's studies and to meet statutory requirements e.g. to other members of University staff, to HEFCE and HESA, to Council Tax Registration Officers, the Teacher Training Agency, LEAs, the SLC, and Research Councils.

Where it is permissible to pass on personal data about a student, members of staff must be certain that the enquirer is giving sufficient detail about the student to allow correct identification on the database (e.g. full name, date of birth, programme of study). When dealing with a request made by telephone you also need to be sure of the identity of the enquirer. Requests in writing should be on official headed paper.

To any other enquirers, without written and signed permission from the student to release personal data, you should not disclose any information about a student. Do not even confirm that a student of that name is registered at the University of Bath. You can (without implying that a student of the name given is registered at the University) agree to pass on a letter or message but you should not give out addresses or contact details.

A student's degree type (e.g. BSc), subject, classification and date are considered public information which may be given to third parties such as companies requesting references after the date of the degree congregation.

If a third party claims that it is vital to have an answer or to contact a student immediately, take the enquirer's details and say you will take advice and return to her/him. Then seek assistance from a senior member of SREO staff.

Embassies

In most cases the International Office will handle all requests from embassies for information about a current or former student. Embassies are sometimes required to verify degree awards for students returning overseas. SREO staff may confirm on request the details of an award (e.g. degree type, subject, classification and date) but not more (e.g. dates of attendance) without the written authorisation of the former student.

If an embassy requests that you disclose to them how many (or which) of its nationals are studying at the University of Bath you should not divulge any such information. You may, however, state that any message or letter they care to send will be forwarded to students SREO staff identify as appropriate nationals.

If the embassy is acting as the sponsor (paying fees etc.) for the student(s) in question, the enquirer may be entitled to access relevant informationabout a student's attendance though, even in these circumstances, you should not disclose other details (e.g. student's address) without seeking further advice from the Student Fees Officer or the International Office.

Former students

If you receive an enquiry in any form (telephone call, e-mail message, letter) from an individual claiming to be a former student of the University of Bath asking for a 'To whom it may concern...' letter to confirm his/her status as a student, or details of an award, you should not proceed until you are convinced that the enquirer is who he/she says he/she is. If sufficient detail can be elicited to establish this, then the letter can be produced as requested. You may include relevant dates of attendance if they are required. It is important to keep a record of any telephone call of this kind with any other correspondence and a copy of the outgoing letter.

Requests from former students wishing to contact other students or former students should be treated as any other request from an unknown third party. Without the written authorisation of the student involved, you should not even confirm that the named individual is registered at the University. You can volunteer to forward a message to anyone who matches the details provided (which generally need to be more than just a full name).

Landlords

You may receive a request from a landlord wishing to get in touch with a former tenant who may be, or have been, a student. In such cases remember that you should not even confirm to an unknown third party that a particular individual is a registered student at the University of Bath. Without having looked the student up on SAMIS you can volunteer to forward a message to anyone who matches the details provided (which generally need to be more than just a full name).

Local Education Authorities (LEAs) or equivalent

For all queries of this type you need to be convinced that the person is who he/she says he/she is and that the student in question is clearly identified. If in any doubt as to the authenticity of the enquiry, seek advice from a senior member of SREO staff. If sufficient detail of background to establish the legitimacy of the request is provided then the requested information should be made available. Until you are familiar with named staff at LEAs etc. it is advisable to ask for a main switchboard number to phone them back as a means of ensuring the legitimacy of a query. Keep a record of all telephone calls with any other correspondence and a copy of the outgoing letter.

Other universities

In response to forms sent directly by another university without any signed authorisation from the relevant student, staff may confirm on request the details of an award (e.g. degree type, subject, classification and date) but not more (e.g. dates of attendance) without the written authorisation of the former student. If the form asks for more information than you are able to give, the appropriate sections should either be left blank or you can write a letter confirming the position in your own terms. If in doubt seek advice from a senior member of SREO staff.

Where forms are received from the former student for despatch to another university it is safe to assume that the student's request to complete and forward the form is sufficient authority for the disclosure of all the details required unless instructed otherwise.

Police

The Police may have a variety of reasons for wishing to trace someone who they believe is or was a student at the University of Bath. You should generally aim to co-operate with any police enquiries as far as it is possible within the confines of the Data Protection Act.

With relatively simple (e.g. relating to the return of lost property) or unexplained requests for information you should not confirm whether a student is registered at the University but you may volunteer to forward a message to anyone who matches the details provided (which generally need to be more than just a full name).

If you receive a request for details about a student from the police in pursuit of a criminal investigation, before disclosing any relevant personal information the University must be convinced that failure to do so would be likely to prejudice the purpose for which it was requested (i.e. the prevention of a crime or the apprehension and prosecution of offenders). Most police forces have a common form, often known as a 'Section 29(3) form', for requesting personal data for such purposes. It gives details of the crime under investigation, why the data is needed, and how non-disclosure would be likely to prejudice the investigation. However, it is important to note that a completed 'Section 29(3) form' is a request: it is not a warrant requiring the release of the information. In such cases the advice of the University Data Protection Officer and the Head of Security should be sought.

If you are in any doubt as to how to deal with a particular enquiry seek advice from a senior member of SREO staff.

Recruitment agencies and employers

It is common procedure for a student to sign a statement authorising the release of data about them for the purpose of a reference; do not release information without such an authorisation. (Specific procedures for dealing with reference requests are outlined in a separate 'General Office Procedures' sheet held by the Registry Enquiry Office Supervisor, who logs and deals with such requests).

In response to a telephone enquiry or a letter which does not enclose a signed authorisation from the student in question, staff members may confirm on request the details of an individual award (e.g. degree type, subject, classification and date) but no more (e.g. dates of attendance).

In response to a letter which does enclose a signed authorisation from the student in question, staff members may confirm on request the details of an award (e.g. degree type, subject, classification and date), and any further details covered by the written authorisation. If in doubt seek advice from a senior member of SREO staff.

Schools

If contacted by a school wishing to ascertain the outcome of a former pupil's University study you may confirm on request the details of the award (e.g. degree type, subject, classification and date) but not more (e.g. dates of attendance) without the written authorisation of the student. If the individual in question has left the University prematurely you should not even confirm that he/she was a registered student.