The University collects a wide range of personal data relating to staff and students for its own purposes, and to meet external obligations. This may result in the eventual transfer of personal data to an outside third party, however any such transfers must be permitted under the Act.
Transfers will only be permitted where data subjects have given their consent to the transfer, or where the Act expressly allows transfers without such consent. Consent cannot be inferred from silence, so if the University requests consent so that the University can provide personal data to a third party, and no response is received, the University must infer that consent is withheld.
Personal data must not be disclosed to unauthorised third parties. Unauthorised third parties includes another individual or organisation, family members, friends, local authorities, government bodies, and the police where the individual has not consented to the transfer unless disclosure is exempted by the 1998 Act, or by other legislation. There is no general legal requirement to disclose information to the police.
However data can sometimes be disclosed without consent, where, for example, it is required for:
-
Protecting the vital interests of the data subject (i.e. release of medical data in emergency), or
-
The prevention or detection of crime
NB. The police should only request information on a specified form. Please check with the Information Compliance Manager whether data can be released.
A further issue arises where sponsors or prospective employers contact the University to verify details about a student, such as attendance records, examination results, and degree classifications. In most circumstances, students would not object to the disclosure of such information, and indeed it would appear to benefit the student. However, best practice suggests that the request for information should be accompanied by a statement from the student consenting to the disclosure, or at least that the student should be contacted if possible before disclosing anything more than final published results.
Talking to parents
Staff at the University of Birmingham are not allowed to discuss a student's welfare or progress with a parent unless they have received explicit permission from the student in order to do this. This consent should be in writing either a letter or an email, from a recognised student email account.
Sponsors
The University of Birmingham is not allowed to discuss a student's welfare or progress with a sponsor unless the University has received explicit permission from the student in order to do this.
It should be noted that this consent is often written into the contract between the student and the sponsor.
Banks
Explicit consent is required from a student or member of staff before the University is permitted to discuss their financial situation.
Consent can either take the form of written consent or an email from a recognised email address.
Police
If the police contact you asking whether an individual is either a student or member of staff, they should be directed to Legal Services.
This applies whether the individual is connected to the University of Birmingham or not.
All enquiries should be directed to Legal Services.