What data protection means for students
Structure and governance
The University of Portsmouth uses your personal data to record your application to the University, track your progress through your course, classify your final award and maintain contact with you as an alumni.
What data do we process?
The data will we will collect at registration includes:
- Your name.
- Contact details.
- Emergency contact details.
- Date of Birth.
- Country of nationality and of birth.
- Academic qualifications.
- Details of any criminal convictions.
- Fee information and sponsorship details.
- Special category data such as country of birth or nationality, details of physical and mental health. This data is only used for equal opportunities monitoring.
How we use your personal data at the University
Any personal data is collected to enable us to:
- Register you as a student
- Administrate your education
- Administrate financial matters
- Allow you to access the University’s facilities
- Register you onto TurnitinUK© anti-plagiarism software
Disclosure of your personal data to third parties?
We will disclose your personal data in the following situations:
- When you have given us written consent to disclose your personal data
- When we are legally required to provide information (e.g. to the Higher Education Statistics Agency, government departments, the Quality Assurance Agency, funding councils)
- When legally required to do so for crime prevention and detection purposes
- When disclosure is necessary to financial organisations associated with your education (e.g. the Student Loans Company and Local Education Authorities)
- When a debt collection agency assists in the recovery of debts to the University
- When disclosure is to the Portsmouth City Council for Council Tax purposes
- When it is believed it is in your vital interests to do so (e.g. if you are involved in an accident and need emergency treatment)
References and data protection
We are not legally required to disclose the contents of a reference we have provided or of a reference we have received, but if a reference is included within the data you have requested as part of a Subject Access Request, we will check if the referee is happy for the reference to be disclosed to you on a voluntary basis.
How long will the University keep your personal data?
We will retain your full student record for six years after you graduate or leave your course.
After six years, we will only retain:
- The dates you studied
- Your degree name
- Your degree classification
- A transcript of your marks
All other data will be disposed of in a secure manner.
Data Protection Statement for Students
What is this document about?
This Statement explains to students how their personal data, including special category data, collected from them by the University, may be used, including some examples of how such data is processed.
Who is this for?
The statement is of primary interest to all students who pay fees directly to the University of Portsmouth and whose data is processed by the University, and will also be of general interest to staff and the wider public.
Parts of the statement will also be of interest to students who are studying for a University of Portsmouth award and therefore the University will have some data about them, but who pay fees to an organisation that is separate from the University, for example, a collaborative partner.
If you are unsure about which aspects of this statement apply to you, please contact Samantha Hill, the University’s Data Protection Officer (contact details below).
How does the University check this is followed?
Students are given information about the use(s) that will be made of their personal data when they provide the data at registration each year. Part of this information is a reference, and a link, to this Statement, and further details are available in induction information.
Occasional queries about personal data from students suggest that this Statement is known about and read.
Who can you contact if you have any queries about this document?
All enquirers may contact the University’s Data Protection Officer, Samantha Hill, on 023 9284 3642 or Samantha.firstname.lastname@example.org.
The University of Portsmouth processes your personal data and, where appropriate, your special category data, in order to register you both as a student at the University and onto the course you wish to study. If you have any questions about how the University processes your data, then the following contact information may be useful.
The University’s correspondence address is:
The University of Portsmouth
Winston Churchill Avenue
Portsmouth, PO1 2UP
Main switchboard: 023 9284 8484
The University’s Data Protection Officer is:
Samantha Hill – Information Disclosure Manager
Direct telephone number: 023 9284 3642
The University of Portsmouth processes your personal data, and your special category data, for a variety of purposes, involving all aspects of the administration of your education and your welfare, associated financial matters, use of University facilities and for the purpose of equal opportunities monitoring.
The University of Portsmouth will use your contact details to keep you informed of events relevant to your studies, and to notify you of circumstances in cases of emergency, for example building closures.
Decisions on your academic progress made through the stages of your course, and on the final award you receive from the University at the end of your studies, are made using automated decision-making processes, but samples of the decisions are checked before they are confirmed. You have the right to have decisions made in relation to yourself checked manually.
In order for the University to be able to process your data correctly, it is your responsibility to inform us as soon as possible if any data we hold about you is incorrect or requires updating. We will provide an annual opportunity for you to check your data through the registration process but it remains your responsibility to notify the University via the Student Portal of any changes to your details throughout the year. We also collect, at registration, the contact details of a person nominated by you as someone to contact for you if needed. You must notify that person that we are holding this data, which will only be used in an emergency.
The University’s legal basis for processing the majority of your personal data is that the processing is necessary for the performance of the contract you enter into with the University when registering on your course.
The University is also under a legal obligation to process some data concerning you and to provide that data to third parties, for example, to the Office for Students or, where applicable to your course, to the Disclosure and Barring Service.
If we require you to provide any further data after registration, for example if you join the University Gym, take part in volunteering opportunities or go on field trips, we will ask for your consent to process that additional data at the time it is needed. We will let you know at that time why it is needed and who will have access to it.
We will also use your contact details to keep you informed of initiatives relating to your time at the University, for example, careers services or postgraduate studies, the chance to engage in research studies, as well as to provide details of the Alumni Association. Some personal data will be made available to the University’s Students’ Union (UPSU) in order to contact you, as described elsewhere in this statement. We believe that this processing is necessarily within the University’s legitimate interests.
If we process any special category data about you, such as health data, when requesting your information, we will either:
– ask for your specific consent to process this data;
– process your data because we consider it is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health; or
– process the data to enable us to promote and maintain equality of opportunity or treatment between different groups of people.
Under the Equality Act 2010, the University has a legal responsibility to make reasonable adjustments if you disclose a disability, which is defined as special category data. This data is accessed by the Additional Support and Disability Advice Centre (ASDAC) and staff from ASDAC will contact you to discuss this and only act on this information with your consent.
We need the personal data we ask you to provide at registration, and failure to provide this data may cause you not to be registered as a student at the University of Portsmouth.
Only those staff within the University who need to have access to the data you provide at registration, in order to administrate your education will have access. Therefore, staff within the service departments of the Department of Student and Academic Administration, Finance and the Library will have access to your data, as will administrative and academic staff within the academic schools and departments in which you study.
Staff within the Careers and Employability Service and the Marketing Department will also have access to your data. If you do not wish to receive communications from these services (emails or text messages) you may either unsubscribe from receiving them at any time or contact the University’s Data Protection Officer (details for whom are given at the top of this Statement) to ask for your details to be removed from any contact lists.
It is not possible to list all of the bodies with whom we might have to share your personal data, but the following are examples of when the University will release data about you to third parties, where we have a legitimate reason in connection with your time here at the University to use that data, or where the University is under a legal requirement to provide data:
- We will share your contact details, student number, course and study details with the University of Portsmouth’s Students’ Union (UPSU) in order to help UPSU to communicate with you, and to target those communications, effectively. We will also share with, and request data from, UPSU in relation to ethnicity, gender and disability for statistical planning purposes – this information will not be used to make any decisions about an individual. This data sharing is covered by an Operational Agreement between the University and UPSU, available from the Data Protection Officers of both organisations.
- If you are a student registered with the University, but studying with the International College Portsmouth (ICP), the University will hold your student details, and will share that data with ICP, in order for ICP to be able to administer your education at that organisation.
- We are legally required to pass some data to government education departments, the Quality Assurance Agency (QAA), and to representatives of those bodies such as auditors.
- If you have applied for accommodation in halls, we will, where appropriate, share your application details with Unite Students, the private company that operates Trafalgar, Margaret Rule, Rosalind Franklin Halls and Greetham Street Halls, or The Student Housing Company, that operates Catherine House, for accommodation allocation and management of the accommodation agreement
- We will provide data on request to the police and other enforcement agencies in emergencies, and where crime detection or prevention can be aided by its release, for
example, responding to information requests from the UK Visas and Immigration Service (UKVI).The University has a duty of care to all of its students and therefore, if the University has a justifiable concern about a student’s welfare, the University may pass a student’s contact details and information about the concern to an appropriate third party, e.g. the police or a mental health team, to safeguard that student. The University also has a duty of care to the wider community and may pass a student’s contact details to the public health authorities if requested
- We are required to provide data to the Office for Students (OfS) or to other bodies acting on the OfS’s behalf. One such example would be where the University is required to provide student contact details for the National Student Survey.
- If your course, or a volunteering opportunity for which you apply, requires a Disclosure and Barring Service (DBS) check, the personal data you provide to the University on the DBS application form will be submitted to the University’s third party DBS checking supplier ( Due Diligence Checking ), which will review the data for obvious inaccuracies / omissions and then submit that data to the DBS. The results of the DBS check are reported back to the University, but the details are sent directly to you, as the applicant.
- Data may be released to third parties in relation to financial matters associated with your education. We are required to pass data about you to HESA and some of this data will be passed to other statutory bodies involved with the funding of education. Further information on how your Student Record may be used by HESA can be found on the HESA website. We will provide data to the Student Loans Company and to your devolved Student Finance administration area, as well as to the US Department of Education for direct loan students. We will also provide data to the Education Skills Funding Agency (ESFA) for students enrolled on degree apprenticeships. If necessary, the University will also release data to parties involved in the recovery of debts to the University.
- Students are required to provide details of their highest qualifications on entry to the University and this information is recorded on the University’s student database. The University and others (for example, the OfS) may check this information with the Higher Education Statistics Agency (HESA) or other institutions to confirm the qualifications obtained.
The University provides student details to Portsmouth City Council in the following circumstances:
- for the purpose of confirming eligibility for council tax exemption (we send similar information to Gosport Borough Council);
- on request from either the Pollution Control / Noise team or the Anti-Social Behaviour Unit of the Council for the purpose of detection and prevention of anti-social behaviour issues in both residential halls and private accommodation
- so that Home and EU students living within the PO1 – 6 postcodes can be invited to register to vote in local and central Government elections as a Portsmouth resident. This data sharing is covered by an Operational Agreement between the University and the Portsmouth City Council, available from the Data Protection Officers of both organisations.
- Data may also be shared securely with third party organisations that host University data, for example, the University’s student card supplier, for use in the production of your student card; the University of Northumbria in order to provide out of hours IS/Library help; the Graduate Schools’ Skills Forge programme; Google Apps for Education and WPM Education that hosts the University’s online payments system. This is not an exhaustive list. Each instance of data sharing/hosting is covered by
- The University uses the TurnitinUK© anti-plagiarism software that could involve some personal data (your name and the University at which you study) being released to other HE institutions for comparison purposes.
- Where students are enrolled on courses which are accredited by professional bodies, some identifying data may be passed to the appropriate professional body so that
students can be registered with that professional body.
- Where students are sponsored by, for example, their employer or embassy or the NHS, the University will provide details of attendance and attainment to the sponsor on request. Requests for any further data will be considered on a case-by-case basis and the University may contact you for your consent to this further disclosure, if appropriate.
The University will not release data to any third person without there being a legitimate reason to do so, except where you ask for this to happen. This means that the University will not release data to banks, friends, relatives (including parents), without your prior agreement. If you wish the University to provide data in these circumstances you should provide written consent to release the data, stating the name and contact details of the individual to whom you wish the data to be sent, and the particular data you agree can be released / discussed.
Although the University does store some data in the cloud via Google Apps for Education, the servers for the data are EU based and therefore the data will not be stored abroad.
If you study via distance-learning or are registered with a collaborative partner based outside the EEA, we will send your data to you or the collaborative partner directly. This processing will be carried out as part of the contract between the University and either yourself or the collaborative partner.
If your sponsor is based outside the EEA, we will pass data to your sponsor. This processing will be carried out as part of your contract for sponsorship.
The data supplied to UPSU will be stored securely on UPSU servers hosted by Amazon Web Servers, which utilise a global network of servers. For further details of this arrangement, please contact UPSU on email@example.com.
We will retain your full student record for six years after you have left the University so that we can fulfil our function of recording details of the awards we make, and provide details of your education and references when asked to do so. (After these six years we will retain transcript data only in order to confirm details of your award.)
If your data is held locally for specific purposes, for example, in Student Finance, other retention periods may apply to your data – you will be given more information about this when you are asked for your data.
You are entitled to request a copy of the data you provide to us in an electronic format so that you may pass that data to another body (the right to data portability), as well as to request a copy of the data we hold about you (a Subject Access Request).
You are also entitled to raise an objection to the processing where the processing of data we hold about you is likely to cause you damage or distress, and to request either the rectification of any incorrect data, the restriction of any further processing of your data or the erasure of your data (right to be forgotten).
You have the right to withdraw your consent for processing your personal data where we have originally asked for your consent. However, where we collect your personal data under another legal basis, it may not be possible for us to remove all of your personal data from our records if you request this.
If you require any further information on, or wish to object to, any of the uses to which we put your data, you should contact Samantha Hill, the University’s Data Protection Officer on 023 9284 3642 or Samantha.firstname.lastname@example.org.
Finally, you have the right to complain about the processing of your data to the UK regulator, the Information Commissioner’s Office. For more information about this body and how to make a complaint, please see the ICO website.