Data Protection and Freedom of Information

1. Data Protection and Freedom of Information

2. Objectives • Describe the main points of the Data Protection Act 1998 and Freedom of Information Act 2000 • Illustrate the “things you need to know” about Data Protection (DP) and Freedom of Information (FOI)

3. The Acts • Data Protection Act 1998 came into force in March 2000. The Act covers information about living individuals • Freedom of Information Act 2000 came into force in January 2005 and provides a right of access to information held by public bodies • The Information Commissioner’s Office (ICO) regulates the operation of the DPA & FOIA (as well as related legislation like the Privacy and Electronic Communications Regulations

4. DPA or FOI?To release or not to release? • A student requests his examination results • A student requests the College internal guidelines for dealing with appeals • A local authority wishes to verify a student’s details for Council Tax • A parent wants to know if their son or daughter is attending classes These areas will be reconsidered in terms of whether or not to release the data or information and which law applies

5. Data Protection Act • All Data Controllers must be registered with the Information Commissioner’s Office. The registration specifies the purposes for which data is processed • Data Subjects are the person about whom the data is held • Data processing covers the collection, recording, holding, maintenance and destruction of any data • Personal data is information about any living person who can be identified from that information • Sensitive Personal Data relates to information about an individual’s health, ethnicity, criminal convictions, sexual life, religious belief, political opinions, TU membership

6. Data Protection Act (cont) Eight Data Protection Principles, which should be complied with. Data shall: • Be obtained and processed fairly and lawfully and shall not be processed unless certain conditions are met. • Be obtained for a specified and lawful purpose and shall not be processed in any manner incompatible with that purpose. • Be adequate, relevant and not excessive for those purposes. • Be accurate and kept up to date. • Not be kept for longer than is necessary for that purpose. • Be processed in accordance with the data subject’s rights. • Be kept secure from unauthorised access, accidental loss or destruction. • Not be transferred to a country outside the European Economic Area, unless that country has equivalent levels of protection for personal data.

7. Data processing good practice The following checklist is taken from the Information Commissioner’s Office website: www.ico.gov.uk • Do I really need this information about an individual? Do I know what I'm going to use it for? • Do the people whose information I hold know that I've got it, and are they likely to understand what it will be used for? • If I'm asked to pass on personal information, would the people about whom I hold information expect me to do this? • Am I satisfied the information is being held securely, whether it's on paper or on computer? And what about my website? Is it secure? • Is access to personal information limited to those with a strict need to know? • Am I sure the personal information is accurate and up to date? • Do I delete or destroy personal information as soon as I have no more need for it? • Have I trained my staff in their duties and responsibilities under the Data Protection Act, and are they putting them into practice?

8. Freedom of Information Act • Places a duty on public authorities (that includes QMUL) to ensure access is available to official information • Regardless of age, format or origin of the info. • Each public organisation must publish a Publication Scheme whichis approved by the Information Commissioner. QMUL’s scheme is found on its website http://www.qmul.ac.uk/about/collegeinfo/scheme/index.html

10. Dealing with Requests • Request under DPA (known as Subject Access Request) must be dealt with in 40 calendar days (except for examination results); a maximum fee of £10 may be charged • An FOI request must be dealt with in 20 working days. If the request is excessive and costly it can be denied on these grounds • Both types of request may come to any part of the College and need to be logged with the Records & Information Compliance Manager • If you are unsure, check with the Records & Information Compliance Manager

11. Some FOI Exemptions • FOI exemptions are either absolute or qualified. Qualified exemptions are subject to the public interest test. Absolute exemptions do not require this • Personal information, where the DPA applies and the release of information would lead to the identification of an individual is an absolute exemption • Where information is commercial the information might be covered by a qualified exemption as its release could be damaging to the College or other party • Vexatious and repeated requests or requests that have been declined recently for good reason can be exempt

12. Some DPA Exemptions • Section 29 exemptions: data may be provided without the consent of the Data Subject to authorities for the purposes of the prevention and detection of crime and benefits/tax fraud etc. All such requests must be specific, state for what the data will be used and be checked with the QM Data Protection Officer • Research exemptions: personal data may be processed for the purpose of research without the consent of the Data Subject. However, the identity of the Data Subject must not be made known without explicit consent and the data must not be used to support decisions about that individual or where there may be substantial damage or distress. The time restrictions are different – data for research purposes only may be kept indefinitely • Examination results: there is a longer time frame so students cannot access results earlier

13. Research • Personal data may be used for purposes beyond the originally stated purpose • Can be retained indefinitely • Exempt from SARs – as long as published research does not identify individuals • FOI – Commercial interests or subject to future publication

14. Examinations • Comments on scripts (and marks) but not scripts themselves can be accessed under DPA • Exam Board minutes can be accessed under DPA (about that individual only) but not FOI • Achievement/progression data can be accessed under DPA • It is okay to put lists of those who have passed on the noticeboard but by number is preferable and only if you have told students that this is how their results are published • You should not pass on an individual student’s results to a third party • External examiners reports – in most circumstances these would be accessible under FOI despite the argument they are confidential and it is important to ensure that External Examiners are able to write frank and helpful comments – in the public interest!

15. Dos and Don’ts • DO respond quickly – the clock is ticking • DO remember that we have a duty to provide advice and assistance • DON’T withhold information without a clear justification under one of the exemptions • DON’T wilfully destroy or alter any original documents – criminal offence

16. To release or not release • A student requests his examination results • A student requests the College internal guidelines for dealing with appeals • A local authority wishes to verify a student’s details for Council Tax • A parent wants to know if their son or daughter is attending classes

17. Other Sources of Guidance • Updated Data Protection Policy • Guidelines on dealing with SARs and other scenarios e.g. photos, marketing, third parties • FOI pages on QM website • ICO website has lots of specific guidelines • See http://www.arcs.qmul.ac.uk/information_governance/index.html

18. Questions?

19. Contact Records & Information Compliance Manager • E-mail: foi-enquiries@qmul.ac.uk data-protection@qmul.ac.uk • Tel: (13) 7596