Data protection for students

What is this document about?

This Statement explains to students how their personal data, including special category data, collected from them by the University, may be used, including some examples of how such data is processed.

Who is this for?

The statement is of primary interest to all students who pay fees directly to the University of Portsmouth and whose data is processed by the University, and will also be of general interest to staff and the wider public.

Parts of the statement will also be of interest to students who are studying for a University of Portsmouth award but pay fees to an organisation that is separate from the University, for example, a collaborative partner. This is because the University will need to hold some data about them to enable it to make the award.

If you are unsure about which aspects of this statement apply to you, please contact Samantha Hill, the University’s Data Protection Officer (contact details below).

How does the University check this is followed?

Students are given information about the use(s) that will be made of their personal data when they provide the data at registration each year. Part of this information is a reference, and a link, to this Statement, and further details are available in induction information. 

Occasional queries about personal data from students suggest that this Statement is known about and read.

Who can you contact if you have any queries about this document?

All enquirers may contact the University’s Data Protection Officer, Samantha Hill, on 023 9284 3642 or Samantha.hill@port.ac.uk.

The University of Portsmouth processes your personal data and, where appropriate, your special category data, in order to register you both as a student at the University and onto the course you wish to study. If you have any questions about how the University processes your data, then the following contact information may be useful.

The University’s correspondence address is:

The University of Portsmouth
University House
Winston Churchill Avenue
Portsmouth, PO1 2UP

Main switchboard: 023 9284 8484

The University’s Data Protection Officer is:

Samantha Hill – Information Disclosure Manager
Email: Samantha.hill@port.ac.uk
Direct telephone number: 023 9284 3642

‘Personal data’ is any information that relates to an individual (in this case, you, as a student) who can be identified either directly by that information or by a combination of that information and other identifiers, such as your name, student ID number, course.

‘Special Category data’ is information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, the processing of genetic or biometric data in order to identify an individual, data concerning heath or data concerning an individual’s sex life or sexual orientation. The University does not collect all of this data but will collect some for the purposes listed below.

‘Criminal offence data’ is any personal data relating to criminal convictions and offences. We will collect your personal and special category data - and potentially criminal offence data - directly from you on registration, through the completion of student surveys and possibly from third parties in the case of placements / study opportunities / health referrals.

The University of Portsmouth processes your personal data, your special category data and potentially criminal offence data, for a variety of purposes, involving all aspects of the administration of your education including

• your engagement with your studies
• your welfare
• associated financial matters
• your use of University facilities,
• any complaints you raise, or any disciplinary matters relating to your time at the University, and
• for the purpose of equal opportunities monitoring.

The University of Portsmouth will generally contact you to keep you informed of events relevant to your studies using your University email address. However, we may use your mobile phone number to let you know about initiatives run by the University including training advised by the University, and to notify you of circumstances in cases of emergency, for example building closures or matters relating to health and safety issues.

Decisions on your academic progress made through the stages of your course, and on the final award you receive from the University at the end of your studies, are made using automated decision-making processes. Samples of the decisions made are manually checked before they are confirmed, but you have the right to have decisions made in relation to yourself individually checked [see the Your Rights section below].

Your responsibilities - In order for the University to be able to process your data correctly, it is your responsibility to inform us as soon as possible if any data we hold about you is incorrect or requires updating. We will provide an annual opportunity for you to check your data through the registration process but it remains your responsibility to notify the University via the Student Portal of any changes to your details throughout the year. We also collect, at registration, the contact details of a person nominated by you as someone to contact for you if needed. You must notify that person that we are holding their data, which will only be used in an emergency.

The University’s legal basis for processing the majority of your personal data is that the processing is necessary for the performance of the contract you enter into with the University when registering on your course.

The University is also under a legal obligation to process some data concerning you and to provide that data to third parties. For example, we may share data with the Office for Students or the Home Office or, where it is applicable to your course, with the Disclosure and Barring Service.

If we require you to provide any further data after registration, for example if you join the University Gym, take part in volunteering opportunities or go on field trips, we will ask for your consent to process that additional data at the time it is needed. We will let you know at that time why it is needed and who will have access to it.

We will also use your contact details to keep you informed of initiatives relating to your time at the University, for example, careers services or postgraduate studies, the chance to engage in research studies, as well as to provide details of the Alumni Association. Some personal data will be made available to the University’s Students’ Union (UPSU) in order to contact you, as described elsewhere in this statement. This processing is carried out in line with the University’s legitimate interests. We will also process your personal data in relation to student complaints, appeals and disciplinary processes using the legitimate interests legal basis for processing.

If we process any special category data about you, such as health data, when requesting your information, we will either: 

• ask for your specific consent to process this data;
• process your data because we consider it is necessary for reasons of public interest in the area of public health, such as protecting against serious crossborder threats to health; or
• process the data to enable us to promote and maintain equality of opportunity or treatment between different groups of people.

Under the Equality Act 2010, the University has a legal responsibility to make reasonable adjustments if you disclose a disability, which is defined as special category data. This data is accessed by the Additional Support and Disability Advice Centre (ASDAC) and staff from ASDAC will contact you to discuss this and only act on this information with your consent.

We need the personal data we ask you to provide at registration, and failure to provide this data may cause you not to be registered as a student at the University of Portsmouth.

Only those staff within the University who need to have access to the data you provide at registration, in order to administrate your education, will have access. Therefore, staff within the service departments of the Department of Student and Academic Administration, Finance and the Library will have access to your data, as will administrative and academic staff within the academic schools and departments in which you study. However, if concerns about your welfare have been raised with a member of staff, that individual may share your data with the University’s Student Support Services team in order to help provide you with support.

Staff within the Careers and Employability Service and the Marketing Department will also have access to your data. If you do not wish to receive communications from these services (emails or text messages) you may either unsubscribe from receiving them at any time or contact the University’s Data Protection Officer to ask for your details to be removed from any contact lists.

It is not possible to list all of the bodies with whom we might share your personal data, but the following are examples of when the University will release data about you either to third parties, where we have a legitimate reason in connection with your time here at the University to use that data, or where the University is under a legal requirement to provide data:

• We will share your contact details, student number, course and study details with the University of Portsmouth’s Students’ Union (UPSU) in order to help UPSU to communicate with you, and to target those communications, effectively. We will also share with, and request data from, UPSU in relation to ethnicity, gender and disability for statistical planning purposes – this information will not be used to make any decisions about an individual although it may be used to appropriately target messages around initiatives. This data sharing is covered by an Operational Agreement between the University and UPSU, available from the Data Protection Officers of both organisations.
• If you are a student registered with the University, but studying with the International College Portsmouth (ICP), the University will share your student data with ICP, in order for ICP to be able to administer your education at that organisation.
• If you are studying a course that involves a placement opportunity your details will be shared with the placement provider in order to set up and administer your placement. We are legally required to pass some data to government education departments, the Quality Assurance Agency (QAA), and to representatives of those bodies such as auditors.
• We are legally required to pass some data to government education departments, the Quality Assurance Agency (QAA), and to representatives of those bodies such as auditors.
• If you have applied for accommodation in halls, we will, where appropriate, share your application details with Unite Students, the private company that operates Trafalgar, Margaret Rule, Rosalind Franklin Halls and Greetham Street Halls, or Yugo, that operates Catherine House, for accommodation allocation and management of the accommodation agreement.
• We will provide data on request to the police and other enforcement agencies in emergencies, and where crime detection or prevention can be aided by its release, for example, responding to information requests from the UK Visas and Immigration Service (UKVI). If the University has a justifiable concern about a student’s welfare, the University may pass a student’s contact details and information about the concern to an appropriate third party, e.g. the police or a mental health team, to safeguard that student. The University may also contact the person you have nominated as your emergency contact in this situation. The University also has a duty of care to the wider community and may pass a student’s contact details to the public health authorities if requested.
• If the University deems a payment to be suspicious, we will share those suspicions (including personal data items) with the National Crime Agency in accordance with our anti-money laundering obligations.
• We will share data with the UK Home Office in relation to visas applied for, or issued to, students.
• We are required to provide data to the Office for Students (OfS) or to other bodies acting on the OfS’s behalf. One such example would be where the University is required to provide student contact details for the National Student Survey.
• If your course, or a volunteering opportunity for which you apply, requires a Disclosure and Barring Service (DBS) check, the personal data you provide to the University on the DBS application form will be submitted to the University’s third party DBS checking supplier ( Due Diligence Checking ), which will review the data for obvious inaccuracies / omissions and then submit that data to the DBS. The results of the DBS check are reported back to the University, but the details are sent directly to you, as the applicant.
• Data may be released to third parties in relation to financial matters associated with your education. We are required to pass data about you to HESA and some of this data will be passed to other statutory bodies involved with the funding of education. Further information on how your Student Record may be used by HESA can be found at www.hesa.ac.uk/about/regulation/data-protection/notices. We will provide data to the Student Loans Company and to your devolved Student Finance administration area, as well as to the US Department of Education for direct loan students. We will also provide data to the Education Skills Funding Agency (ESFA) for students enrolled on degree apprenticeships. If necessary, the University will also release data to parties involved in the recovery of debts to the University.
• Students are required to provide details of their highest qualifications on entry to the University and this information is recorded on the University’s student database. The University and others (for example, the OfS) may check this information with the Higher Education Statistics Agency (HESA) or other institutions to confirm the qualifications obtained.

The University provides student details to Portsmouth City Council in the following circumstances:

• for the purpose of confirming eligibility for council tax exemption (we send similar information to Gosport Borough Council);
• on request from either the Pollution Control / Noise team or the Anti-Social Behaviour Unit of the Council for the purpose of detection and prevention of antisocial behaviour issues in both residential halls and private accommodation
• so that Home and EU students living within the PO1 – 6 postcodes can be invited to register to vote in local and central Government elections as a Portsmouth resident. This data sharing is covered by an Operational Agreement between the University and the Portsmouth City Council, available from the Data Protection Officers of both organisations.

Data may also be shared securely with third party organisations that host University data, for example, the University’s student card supplier, for use in the production of your student card; the University of Northumbria in order to provide out of hours IS/Library help; the Graduate Schools’ Skills Forge programme; Google Apps for Education and WPM Education that hosts the University’s online payments system. This is not an exhaustive list. Each instance of data sharing/hosting is covered by contractual arrangements.

• The University uses the TurnitinUK© anti-plagiarism software that could involve some personal data (your name and the University at which you study) being released to other HE institutions for comparison purposes.
• Where students are enrolled on courses which are accredited by professional bodies, some identifying data may be passed to the appropriate professional body so that students can be registered with that professional body.
• Where students are sponsored by, for example, their employer or embassy or the NHS, the University will provide details of attendance and attainment to the sponsor on request. Requests for any further data will be considered on a case-by-case basis and the University may contact you for your consent to this further disclosure, if appropriate.
• Where students are registered on degree apprenticeship courses, we are required to pass some data about you to OfSTED.

The University will not release data to any third party without there being a lawful basis to do so, except where you ask for this to happen. This means that the University will not release data to banks, friends, relatives (including parents) etc, unless in an emergency, without your prior agreement unless we have any safeguarding and / or wellbeing concerns for you. If you wish the University to provide data to third parties in non-emergency situations (for example, references), you should provide written consent to release the data, stating the name and contact details of the individual to whom you wish the data to be sent, and the particular data you agree can be released / discussed.

Although the University does store some data in the cloud via Google Apps for Education, AWS and Microsoft Azure, where possible the data will be located in the UK. However, data may also be stored on servers within the EU.

If you study via distance-learning or are registered with a collaborative partner based outside the EEA, we will send your data to you or the collaborative partner directly. This processing will be carried out as part of the contract between the University and either yourself or the collaborative partner.

If your sponsor is based outside the EEA, we will pass data to your sponsor. This processing will be carried out as part of your contract for sponsorship.

The data supplied to UPSU will be stored securely on UPSU servers hosted by Amazon Web Servers, which utilise a global network of servers. For further details of this arrangement, please contact UPSU on hello@upsu.net.

We will retain your full student record for six years after you have left the University so that we can fulfil our function of recording details of the awards we make, and provide details of your education and references when asked to do so. (After these six years we will retain transcript data only in order to confirm details of your award.)

If your data is held locally for specific purposes, for example, in Student Finance, other retention periods may apply to your data – you will be given more information about this when you are asked for your data.

You are entitled to request a copy of the data you provide to us in an electronic format so that you may pass that data to another body (the right to data portability), as well as to request a copy of the data we hold about you (a Subject Access Request).

You are also entitled to raise an objection to the processing where the processing of data we hold about you is likely to cause you damage or distress, and to request either the rectification of any incorrect data, the restriction of any further processing of your data or the erasure of your data (right to be forgotten).

You have the right to withdraw your consent for processing your personal data where we have originally asked for your consent. However, where we collect your personal data under another legal basis, it may not be possible for us to remove all of your personal data from our records if you request this.

You also have the right to request that any decisions made as a result of automated decision making processes are manually checked by University of Portsmouth staff (right not to be subject to a decision based solely on automated processing).

If you require any further information on, or wish to object to, any of the uses to which we put your data, you should contact Samantha Hill, the University’s Data Protection Officer on 023 9284 3642 or Samantha.hill@port.ac.uk.

Finally, you have the right to complain about the processing of your data to the UK regulator, the Information Commissioner’s Office. For more information about this body and how to make a complaint, please see the ICO website.