Data Protection of Project by lta97130


More Info
									Student sponsors

1. Background
The Data Protection Act, 1998, puts explicit constraints on the circumstances in which
data may be processed. The disclosure of data to third parties is considered to be

In cases where data is to be disclosed to a third party, there are certain legal criteria that
must be met before an institution may disclose information to another party. These
criteria are defined in Schedule 2 of the Act and include:
(i)      that disclosure is with the consent of the data subject, or
(ii)     that disclosure is “necessary…for the performance of a contract to which the data
         subject is a party”, or
(iii) that disclosure is necessary for compliance with any legal obligation to which an
         institution is subject, or
(iv)     that disclosure is required “for the purposes of the legitimate interests [of the data
         controller – i.e. the institution – or by third parties to whom the data is disclosed]”

Many students of Higher Education Institutions receive „sponsorship‟, in the form of
funding towards their studies, from government agencies, research councils or private
corporations (for example, the Student Loan Company, ESRC, NERC, etc). In most
cases, this will involve the payment of some or all of a student‟s tuition fees by the
sponsor. Most HEIs send regular reports on progress to many sponsors, and will also
routinely confirm changes of circumstance to sponsors when the need arises (for
example, if a student withdraws). Such disclosures require justification under the terms of
Data Protection law as outlined above. There is an obligation to ensure that students are
properly informed about those bodies to whom data may be disclosed (Principle 1).
A recognised definition of the term „sponsor‟ is required to allow explicit notification of
this processing both to students and the Data Protection Commissioner.


Defining the term ‘sponsor’
If HEIs are to justify the release of student information to a third party then they must be
able to provide a sensible definition of that third party. However, the term „sponsor‟ does
not appear easy to define, even though most HE sector staff seem to have a hazy, shared
understanding of the term.

For example, if a „sponsor‟ is defined solely as “someone who contributes some or all of
the money that allows a student to pay their fees” then this definition would include
students‟ parents, many of whom provide some or all of a student‟s fees. This problem is
not solved if the definition is extended to “someone who pays fees directly to the
University, on behalf of a student”, because many parents do exactly that – providing
payment directly by cheque or credit card. The proposal that individuals shouldn‟t be
considered „sponsors‟ but organisations can be neatly solves the parent problem but is not
a definition it would be easy to justify or base a policy around (not least because there are
occasions when a private individual, for example the Bishop of Blackburn, may also
sponsor a student).

Taking matters to the opposite extreme, an HEI might define a sponsor as “someone who
has a contractual agreement with the University to pay the fees of one or more nominated
students”. However, few sponsoring bodies enter into a contract both with the student and
directly with the institution (though some exceptions do exist, e.g. with research councils
such as the BBSRC). Instead, any contract is usually between the sponsor and the
student. This view is ingrained in the way many HEIs deal with student fees. In many
cases, institutions consider every student‟s default sponsor to be “self”, such that in cases
where a nominated sponsor fails to pay fees, the student is held responsible for payment.

The most comfortable – and practical – definition available is that a „sponsor‟ is a person
or organisation who has entered into a formal agreement with a student to cover some or
all of the costs of that student‟s studies. Personal data should, therefore, only be released
to those bodies who have a formal contract with the student they are sponsoring. This
offers institutions three particular advantages. Firstly, it provides a clear definition of the
term „sponsor‟, which means that the institution can justify this term in its Data
Protection notification and make clear to students just what it means. Secondly, incoming
students can be asked for a copy of their sponsorship agreement and informed that the
institution will pass appropriate information to their sponsor. This allows the institution
to retain proof of sponsorship (and thus proof of the right to disclose) on file. Thirdly, this
should answer the terms of point (ii) (above) of the requirements for processing.
It should be noted that if there are bodies who do not require a formal sponsorship
agreement with their students, then the institution will only be able to disclose to
information to them by seeking consent from the student on an ad hoc basis.

Alternatively it could be argued that HEIs may disclose to sponsors because „it is in their
legitimate interests‟ (point iv) above). Clearly, the billing and collection of fees, from
whatever source, is one of an institution‟s legitimate interests. Thus, an HEI might tell all
students at first registration that they intend to release details to their sponsors as
necessary, because this will be done in pursuit of its legitimate interests. It is debatable,
however, whether the release of information on student progress to sponsors is an
essential part of this legitimate interest (as it could be argued that a student‟s progress is a
private matter between the student and their sponsor). An institution could reasonably
expect that, if they were unable to provide adequate information to sponsors then those
sponsors may stop supporting students who come to the institution. However, whether
this would provide adequate grounds for disclosure as a legitimate interest, would be
open to question in court (especially where the default for payment is ‘self’).

Should HEIs be unable to justify disclosure solely on the grounds of „legitimate interest‟,
then point (iii) may still give grounds to release data to some sponsors. There may be
legislation (perhaps the 1992 Education Act, for example) that compels an institution to
release information to certain government bodies such as the ESRC. However, this would
be only a partial solution to the problem, because this would leave the institution needing
to seek consent for disclosure to any other sponsors.


Given the above considerations it appears most practical for a HEI to operate under a
system that defines a sponsor as „any body that has a formal contract with a student to
pay part, or all, of their tuition fees‟. Further consideration should also be given by
institutions as to exactly what data will be released to sponsors: institutions should take to
ensure that the minimum necessary data is disclosed to sponsors (see Disclosures to 3rd
Parties and Student Support guidelines).

To top