Student Fair Processing Information
How your personal data will be used within the College
The official purposes for which the College processes personal data are notified to the Information Commissioner, and can be viewed on the Office of the Information Commissioner's Register. To find the College's registration you can use the search form for the Register. You just need to enter the College's Registration Number, which is Z7056965.
To manage its operations effectively, provide services to you and meet certain legal requirements, the College will process and maintain your personal data. This personal data includes, but is not limited to, data such as name, address, personal email address, telephone number, date of birth, programme studied, fee payments, information about examinations, assessments and results.
Your personal data will be used within the College to contact you and provide you with services, such as accommodation, employability, sporting facilities, the Library, computer facilities and support. Any personal data shared in these ways will not be excessive. For example, the accommodation office will need your name, address, phone number in order to process your accommodation requirements, but it does not need to see your academic results.
In addition to this, the College may process some personal data about you which requires additional protections, such as details about your health in order to provide care, and information concerning ethnicity, sexual orientation, gender identity, domicile and disability for planning and monitoring purposes. For certain programmes of study, information about past criminal convictions may be processed.
If at any point during your programme of study you are required to work with children or vulnerable adults and/or if your programme is accredited by certain professional bodies concerned with health and social responsibility, the College will pass data to relevant external bodies to discharge its statutory responsibilities and to enable routine vetting for fitness to practise to take place where appropriate.
Sharing your personal data (third party disclosures)
The College may disclose appropriate personal data, including sensitive personal data, to third parties, where there is legitimate need or obligation, during or after your period of study. Such disclosure is subject to procedures to ensure the identity and legitimacy of such agencies.
The College may use third party companies as data processors to carry out certain administrative functions on behalf of the College. If so, a written contract will be put in place to ensure that any personal data disclosed will be held in accordance with the Data Protection Act and have appropriate security measures in place.
We will share your data with the following third parties (please note that this is not an exhaustive list):
The Students' Union
By registering as a student of Royal Holloway you will automatically become a member of the Students’ Union. To enable the Students’ Union to carry out its duties in accordance with the Education Act 1994, the College will share with the Students’ Union your name, email address, course code, year of study, age, gender and home postcode. If you choose not to remain a member of the Students’ Union, you may opt out by writing to the Students’ Union at president@su.rhul.ac.uk.
Local Authorities
Students’ names, term time addresses, nationality and end date of study are shared with the local council for the purposes of maintaining the electoral roll.
Turnitin®
The College makes use of the Turnitin® UK system for the purposes of enabling assessors to check students' work for improper citation and potential plagiarism. The system creates a textual similarity review by comparing students' work against a variety of sources. Students are therefore required to provide a limited amount of personal data, for instance name, email address and course details and submissions, to Turnitin® when using the service. On request, the College may share anonymised assignments with other educational institutions in order to meet those purposes.
Copyright of your submitted assignments remains with you as the student author.
The College is responsible for ensuring that the transfer and security of the data shared with Turnitin® is fully compliant with UK Data Protection legislation.
Higher Education Statistics Agency (HESA), HE funding councils and other government bodies
Your personal data will be provided to HE funding councils, government bodies and HESA. Further details about the data shared with HESA can be found in the HESA-Student collection notice on the HESA website.
HESA will use the personal data provided to them in order to contact you about completing surveys into the outcomes of higher education and your activities after graduation. HESA may approach your parents or another higher education institution, if you have gone on to further study, in order to complete the survey if they cannot contact you. More information about the Graduate Outcomes Survey is available on HESA’s website.
National Student Survey
The College is required to pass data about its final year undergraduates to the Higher Education Funding Council for England (HEFCE), or their agents, in order for them to carry out the National Student Survey. This survey gives final year students the chance to give feedback on their experiences at the College and so informing the choices of prospective students. It is described in detail on the National Student Survey website.
The College will pass your name and contact details to the agent carrying out the survey. The agent may then contact you to take part. You do not have to take part in the survey and you can opt out at any time by contacting the agent and providing them with verification of your identity by confirming your date of birth.
Higher Education (HE) institutions
Where students are involved in exchange or placement programmes, joint or double programmes, or similar study arrangements, the College may disclose their personal data, including sensitive personal data, to the partner institution (or related organisations) for the purposes of administering the programme, assessment and any further purposes set out in the College's notification with the Information Commissioner. Students that are studying abroad as part of these arrangements should be aware that their personal information may be sent to, stored and used by overseas partner institutions (and related organisations).
Sponsors, loan organisations and scholarship schemes
Where students have a sponsor or an employer, the College may disclose student personal data to these organisations to determine whether support should continue. Personal data about students may be disclosed to third parties attempting to recover debt on behalf of the College where internal procedures have failed.
Office of the Independent Adjudicator (OIA)
If you make a complaint to the OIA, the College may disclose student personal data in order to assist the OIA with their investigation.
Parents, guardians and other relatives
Other than in the most exceptional of circumstances, the College will not to disclose a student's personal data to parents, guardians and any other relative. If students have provided a nominated contact in the event of a medical problem or emergency then some personal data may be provided. Further details can be found in the related policy.
Published information
Pass/fail lists may be displayed on notice boards within the College, and any award (such as a degree) made by the College is a matter of public record rather than personal data, and as such will be publicly available and publicised at, for instance, graduation ceremonies.
Photographs of students during the course of their study may also be taken. If you do not wish your photograph to be taken, then simply absent yourself from any pictures. Group photographs taken will assume the permission of individuals pictured for use in College publications and publicity materials, and publications produced by third parties authorised by the College. Attendance at graduation ceremonies will assume the permission of the attendees and photographs and recordings taken one the day may be publicised on the College's website.
Employment agencies, prospective employers and third parties requesting confirmation of awards
Employment agencies, prospective employers and third parties who request confirmation of awards made by the College will be required to provide a consent form which has been signed by the student. The College will then disclose details of an award including the date of the award and its classification without notifying the student.
Police, crime and taxation
The College works closely with the local Surrey Police to ensure a safe environment to live, study and work for all students. As part of this relationship, both Surrey Police and the College share data about some students and we have a data sharing agreement with Surrey Police to manage this process.
The College may be obliged to provide information to other police forces or other organisations that have a crime prevention or law enforcement function, such as Benefit Fraud Sections within Local Authorities, about students if it is necessary for the prevention or detection of a crime or the collection of taxes.
CCTV and automatic number plate recognition (ANPR)
The College has a comprehensive, image-only CCTV surveillance system across its campuses. Cameras located on and within buildings are monitored by Security. All staff operating the CCTV system do so in compliance with the Data Protection Act 1998 and the Freedom of Information Act 2000.
On occasions, Security staff will wear Body Worn Cameras in the course of their duties. These cameras record both images and sound, and data captured in this manner is processed in compliance with the Data Protection Act 1998 and the Freedom of Information Act 2000.
College uses ANPR (Automatic Number Plate Recognition) camera technology to manage, control and enforce parking on its sites. They are governed under guidelines from the Information Commissioners Office on the use of CCTV and ANPR Cameras and conform to the Data Protection Act. They are operated by College’s Security team.
How your personal data will be used after you have finished your studies
After graduation, some of your details will be passed to the Development and Alumni Relations office; their privacy policy explains how they will use your personal data and how you can opt out of this.
The Careers & Employability Service will have access to your contact details after you graduate in order to contact you about their services and provide you with support, guidance and information about events and opportunities which may be relevant to you. You will be able to opt out of these communications at any time.
The College will hold your contact details after you graduate and check with you periodically to ensure they are up to date, in order for you to be contacted to complete the Graduate Outcomes survey. Your contact details may be passed to HESA and/or an organisation contracted to undertake the Graduate Outcomes survey. Please consult the HESA Student collection notice for further information.
When you have completed your programme of study your central student record will become part of the College’s historical record. Your School or Department may keep your record for up to five years after you have graduated, at which time the record is archived.
You may wish to use the College to provide a reference for you when you are applying to other institutions or for employment. If you provide the name of a member of staff for a reference, you should inform them of this so that they know you have given your consent for them to disclose your personal data.
Your rights
Under the Data Protection Act 1998 you have certain rights and responsibilities around your personal data including:
- to be informed what personal data about you the College holds and what they are used for
- to access this personal data
- to update the personal data the College holds
- to be informed how the College is complying with its obligations under the Act
- to complain to the Data Protection Officer if you believe that the Data Protection policy has not been followed.
From 25 May 2018, there will be a change in the law and you will have additional rights around your personal data. These are:
- the right of erasure, also known as the right to be forgotten, which is where you can request the deletion or removal of your personal data whether there is no compelling reason for its continued processing.
- the right to restrict processing of your data, which is where you can request that College stops actively processing your data in certain circumstances.
- the right to receive the personal data which you provided to the College in a certain format and the right to then transmit those data to another Higher Education provider without difficulty from the College.
If you wish to access your personal data under the provisions of the Data Protection Act, you should make a Subject Access Request.
Your responsibilities
Providing personal data to the College
Students must ensure that all personal information provided to the College is accurate and up to date.
Processing personal data
Under the Data Protection Act and the College's Data Protection Policy students have responsibilities when processing personal data. These include:
if you are considering processing personal data as part of your studies you must notify and seek approval from your supervisor before any processing takes place
if you are processing personal data other than as part of your studies you should contact the Information Commissioner to ensure that you are doing so in compliance with the Data Protection Act as you will not be covered under the College's registration.
Questions
If you have any questions about how the College processes your personal data, please contact foi@rhul.ac.uk