Student sponsors 1. Background The Data Protection Act, 1998, puts explicit constraints on the circumstances in which data may be processed. The disclosure of data to third parties is considered to be „processing‟. In cases where data is to be disclosed to a third party, there are certain legal criteria that must be met before an institution may disclose information to another party. These criteria are defined in Schedule 2 of the Act and include: (i) that disclosure is with the consent of the data subject, or (ii) that disclosure is “necessary…for the performance of a contract to which the data subject is a party”, or (iii) that disclosure is necessary for compliance with any legal obligation to which an institution is subject, or (iv) that disclosure is required “for the purposes of the legitimate interests [of the data controller – i.e. the institution – or by third parties to whom the data is disclosed]” Many students of Higher Education Institutions receive „sponsorship‟, in the form of funding towards their studies, from government agencies, research councils or private corporations (for example, the Student Loan Company, ESRC, NERC, etc). In most cases, this will involve the payment of some or all of a student‟s tuition fees by the sponsor. Most HEIs send regular reports on progress to many sponsors, and will also routinely confirm changes of circumstance to sponsors when the need arises (for example, if a student withdraws). Such disclosures require justification under the terms of Data Protection law as outlined above. There is an obligation to ensure that students are properly informed about those bodies to whom data may be disclosed (Principle 1). A recognised definition of the term „sponsor‟ is required to allow explicit notification of this processing both to students and the Data Protection Commissioner. Discussion Defining the term ‘sponsor’ If HEIs are to justify the release of student information to a third party then they must be able to provide a sensible definition of that third party. However, the term „sponsor‟ does not appear easy to define, even though most HE sector staff seem to have a hazy, shared understanding of the term. For example, if a „sponsor‟ is defined solely as “someone who contributes some or all of the money that allows a student to pay their fees” then this definition would include students‟ parents, many of whom provide some or all of a student‟s fees. This problem is not solved if the definition is extended to “someone who pays fees directly to the University, on behalf of a student”, because many parents do exactly that – providing payment directly by cheque or credit card. The proposal that individuals shouldn‟t be considered „sponsors‟ but organisations can be neatly solves the parent problem but is not a definition it would be easy to justify or base a policy around (not least because there are occasions when a private individual, for example the Bishop of Blackburn, may also sponsor a student). Taking matters to the opposite extreme, an HEI might define a sponsor as “someone who has a contractual agreement with the University to pay the fees of one or more nominated students”. However, few sponsoring bodies enter into a contract both with the student and directly with the institution (though some exceptions do exist, e.g. with research councils such as the BBSRC). Instead, any contract is usually between the sponsor and the student. This view is ingrained in the way many HEIs deal with student fees. In many cases, institutions consider every student‟s default sponsor to be “self”, such that in cases where a nominated sponsor fails to pay fees, the student is held responsible for payment. The most comfortable – and practical – definition available is that a „sponsor‟ is a person or organisation who has entered into a formal agreement with a student to cover some or all of the costs of that student‟s studies. Personal data should, therefore, only be released to those bodies who have a formal contract with the student they are sponsoring. This offers institutions three particular advantages. Firstly, it provides a clear definition of the term „sponsor‟, which means that the institution can justify this term in its Data Protection notification and make clear to students just what it means. Secondly, incoming students can be asked for a copy of their sponsorship agreement and informed that the institution will pass appropriate information to their sponsor. This allows the institution to retain proof of sponsorship (and thus proof of the right to disclose) on file. Thirdly, this should answer the terms of point (ii) (above) of the requirements for processing. It should be noted that if there are bodies who do not require a formal sponsorship agreement with their students, then the institution will only be able to disclose to information to them by seeking consent from the student on an ad hoc basis. Alternatively it could be argued that HEIs may disclose to sponsors because „it is in their legitimate interests‟ (point iv) above). Clearly, the billing and collection of fees, from whatever source, is one of an institution‟s legitimate interests. Thus, an HEI might tell all students at first registration that they intend to release details to their sponsors as necessary, because this will be done in pursuit of its legitimate interests. It is debatable, however, whether the release of information on student progress to sponsors is an essential part of this legitimate interest (as it could be argued that a student‟s progress is a private matter between the student and their sponsor). An institution could reasonably expect that, if they were unable to provide adequate information to sponsors then those sponsors may stop supporting students who come to the institution. However, whether this would provide adequate grounds for disclosure as a legitimate interest, would be open to question in court (especially where the default for payment is ‘self’). Should HEIs be unable to justify disclosure solely on the grounds of „legitimate interest‟, then point (iii) may still give grounds to release data to some sponsors. There may be legislation (perhaps the 1992 Education Act, for example) that compels an institution to release information to certain government bodies such as the ESRC. However, this would be only a partial solution to the problem, because this would leave the institution needing to seek consent for disclosure to any other sponsors. Conclusion Given the above considerations it appears most practical for a HEI to operate under a system that defines a sponsor as „any body that has a formal contract with a student to pay part, or all, of their tuition fees‟. Further consideration should also be given by institutions as to exactly what data will be released to sponsors: institutions should take to ensure that the minimum necessary data is disclosed to sponsors (see Disclosures to 3rd Parties and Student Support guidelines).
Pages to are hidden for
"Data Protection of Project"Please download to view full document