Disability services student privacy notice

Until 24 May 2018 we shall process your personal data in accordance with the Data Protection Act 1998 (or ‘DPA’ for short). From 25 May 2018, we shall process your personal data in accordance with the General Data Protection Regulations (or ‘GDPR’ for short). 

This notice complies with requirements under both DPA and GDPR.

This notice complies with requirements under both DPA and GDPR. 

We reserve the right to make changes to this notice. We shall inform you of any changes to this notice using the appropriate medium of communication (eg where our main contact with us is by email, we will email you). You can obtain the current version from the Support for disabled students section of the site.

If there is anything you are unclear about, please contact Disability Services in the first instance and we will be happy to answer any queries you may have concerning this notice of the way in which we process your personal data.

We obtain personal data about you from the following sources:

• From you, when you register with us using our online sign-up form;
• From you, when you contact us via email, phone or post, or when you provide us with details at information days or open days;
• From medical or health and social care professionals, or those providing you with evidence of your disability, when you have given permission for them to contact us;
• From other services and academic schools within the University, if you declare a disability and ask for your information to be shared with us;
• From assessment centres regarding your Study Needs Assessment, when you have given permission for this information to be shared;
• From third party sources such as UCAS, research councils, sponsors, placement providers, parents/guardians and schools/colleges. When we obtain personal data about you from third party sources, we will look to ensure that the third party has lawful authority to provide us with your personal data. 

We will collect and process personal data about you for the following purposes.

• Personal data may contain ‘sensitive personal data’ as described under the DPA and ‘special categories of data’ as described under the GDPR. Such ‘sensitive personal data’ or ‘special categories of data’ will include information about your physical or mental health and/or disability.
• When you register with the University as a student, you can decide if you wish to share with the University certain types of ‘sensitive personal data’ or ‘special categories of data’. The online registration process will provide you with more information on this. 
• When you register with Disability Services using our sign-up form, you can decide if you wish to share with Disability Services, and/or the wider University, certain types of ‘sensitive personal data’ or ‘special categories of data’. Our online sign-up form will provide you with more information on this. 

In general terms, we process your personal data for the administration of your position as a student at the University and in order to ensure access to disability-related academic support and reasonable adjustments.  

We set out the purposes for which we will process your personal data in this notice.

Disability Services will occasionally share your personal data with third parties. For example, it may share some data with third parties involved in the delivery or funding of your disability-related support, such as Student Finance. Please see the ‘Specific purposes for which we will process your personal data’ section for further information on what information we may share with other third parties. 

We also have some additional notices, guidelines and policies with further useful information about the way in which we process your personal data:

• The University of Leeds Student Privacy notice which contains additional details about the way the University processes your personal information.
• The University’s Data Protection Code of Practice – this is presently being reviewed and update ready for compliance with GDPR.  It contains a lot of useful general information on data protection and University practices.
• Our website – we use Cookies (that will collect your personal data) on our web pages.  Please see the University policy on the use of Cookies.
• HESA returns – the University is required to return important information (that will include your personal data) to HESA. Please see HESA’s collection notice, together with other supporting documentation.

This is where we automatically make decisions about you, without human intervention. We use your personal data to conduct automated individual decision making as described in the ‘Specific purposes for which we will process your personal data’ section. This section also provides details of where you can find out further information on the logic behind our decisions, as well as the significance and consequences of our decisions. If you are still finding it difficult to locate or understand this information, please email Disability Services at disability@leeds.ac.uk for further advice.

We will from time to time communicate with you by email, post and telephone. 

If, at any stage, you are concerned about the content of these communications, e.g. unwanted marketing information, or you wish to change the method of communication that we use, please email Disability Services at disability@leeds.ac.uk. 

If you are unsuccessful in unsubscribing from our communications and/or remain concerned, please email Disability Services at disability@leeds.ac.uk. 

Sometimes to achieve the purposes for which we are processing your personal data, we may need to share your personal data with other organisations based within the European Union or, if outside the European Union, based in countries that have comparable levels of protection. This is most likely to relate to students undertaking study overseas (for example, Study Abroad, Erasmus programmes, or placements overseas), where we may need to share information with host institutions in other countries in order to set up support during your studies abroad. 

When it is necessary to share your data with organisations outside of the European Union, we will ensure that appropriate safeguards are in place. 

See the University’s published guidelines for the retention of student data. 

Under GDPR, you have the right to:

• withdraw consent where that is the legal basis of our processing;
• access your personal data that we process;
• rectify inaccuracies in personal data that we hold about you;
• be forgotten, that is your details to be removed from systems that we use to process your personal data;
• restrict the processing in certain ways;
• obtain a copy of your data in a commonly used electronic form; and
• object to certain processing of your personal data by us.

Please see the International Commissioner’s Office (ICO) website for further information on the above rights. You may also contact the Data Protection Officer for further information. 

You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. Please see the ICO website.

GDPR is new law and it has not yet been applied to circumstances similar in context to our relationship with students.  The extent of lawful grounds for processing data has yet to be fully understood. The ‘Specific purposes for which we will process your personal data’ section gives the University’s present view on the grounds for processing against each specified purpose.  As legal views mature the University may change its view on its legal basis for processing. 

Here is a brief explanation of the grounds referred to in the 'Specific purposes for which we will process your personal data' section:

• (Article 6 (1)(a)), Consent – on specific occasions the University will only process certain data if you consent e.g. when registering with Disability Services, you only need to provide certain ‘special categories of data’ if you agree to do so.
• (Article 6 (1)(b)), necessary for the performance of your student contract – on many occasions the University will process your data to enable it to meet its commitments to you eg those relating to teaching and assessment.
• (Article 6 (1)(d)), for the purpose of protecting the vital interest of yourself or another – sometimes in extreme circumstances the University will have to release information to protect your interests or the interests of others e.g. in medical emergencies.
• (Article 6 (1)(e)), processing necessary for the performance of a task carried out in the public interest – the University is an educational establishment and in particular its educational activity is conducted in a public interest (including your interest and the interest of others). 
• (Article 22(2)(a)), automated decision making necessary for performance of a contract – the University will sometimes automate decisions relating to its services it is providing to you.
• Article 9(1)(a)), processing ‘special categories’ of data where you have given consent – the University will process certain sensitive information about you with your consent e.g. disability information in order to arrange support.
• Article 9(1)(g)), processing ‘special categories’ of data where necessary for reasons of substantial public interest. 
• Article 9(1)(f), processing ‘special categories’ of data in connection with legal claims. 

It is recognised that some of the above grounds will overlap and that the University could rely on multiple grounds justifying its lawful processing. The University also reserves the right to rely on other grounds that are not referred to. 

If you have any concerns with regard to the way your personal data is being processed, or have a query with regard to this notice, please contact Disability Services in the first instance. Our contact details are as follows:

Email: disability@leeds.ac.uk
Phone: +44 (0)113 343 3927

Disability Services
Chemistry West Block
University of Leeds
Leeds 
LS2 9JT

Alternatively, you can email the University’s Data Protection Officer, Adrian Slater, at a.j.slater@adm.leeds.ac.uk. 

The University’s data controller registration number provided by the Information Commissioner’s Office is Z553814X.

We collect data for the following purposes. We have included the legal grounds for processing the data against each specified purpose. This refers to GDPR Article 6 unless indicated to the contrary.

1. Admission, registration and administration of their studies: (1)(b) or (1)(f)
2. Academic assessment and progression: (1)(b) or (1)(f)
3. Administration of student related policies and procedures including appeals, complaints, grievances, disciplinary matters, and matters relating to health and conduct and to cheating and plagiarism: (1)(b) or (1)(f)
4. The provision of University accommodation and other support services such as those of the Library, ISS and the Careers Centre: (1)(b) or (1)(f)
5. The granting of awards (including the publication of awards and marks and inclusion in pass lists made available via the University's website: (1)(b) or (1)(f)
6. Research and statistical analysis: (1)(b) or (1)(f)
7. Production of statistical returns required for third party government bodies e.g. the Higher Education Statistics Agency, for completion of government supported surveys e.g. the National Student Survey, the Destination of Leavers in Education Survey and the Teaching Excellence Framework student’s home department/resource centre and indeed whether an individual is or has been enrolled at the University: (1)(c) or (1)(e) or (1)(f)
8. Direct mailing of or about (i) student benefits and opportunities offered by or through the University and (ii) University activities and events organised for students: (1)(b) or (1)(f)
9. Host mailing of services or career opportunities of direct relevance to student interests: (1)(b) or (1)(f)
10. Consideration and granting of prizes, scholarships and bursaries: of discretionary funding available to students; and of other such awards: (1)(b) or (1)(f)
11. The operation of a lecture capture facility relating to the recording of educational activities e.g. lectures, by the University: (1)(b) or (1)(e) or (1)(f)
12. Personal data released to third parties for the following purposes.
13. To the Higher Education Statistics Agency, HEFCE, government departments and other authorised users for the completion of student surveys and analysis of student statistics and/or to enable them to carry out their statutory functions as applicable: (1)(e) or (1)(f)
14. To The Leeds University Students’ Union – in accordance with options given on registration (1)(a) or (1)(f)
15. To the police or other regulatory body where pursuant to the investigation or disclosure of a potential crime: (1)(f)
16. To close family and the emergency services where there is an emergency situation e.g. illness, serious injury or bereavement: (1)(f)
17. To external examiners for the purposes of assessment: (1)(b) or (1)(f)
18. To other educational institutions involved in the delivery of a student’s course or programme, eg affiliated colleges, exchange institutions, including those outside of the UK and sometimes the EEA; and to other organisations in relation to work placements: (1)(b) or (1)(f)
19. To professional bodies where registration with that body is related to or a requirement of the student’s studies eg the GMC for medical students: (1)(b) or (1)(e) or (1)(f)
20. To external agents of the University in relation to the repayment of student debts: (1)(f)
21. To Data Processors in order for them to process data on behalf of the University for any of the purposes for which the University is permitted to process the data, including the provision of academic and other services by the University: (1)(b) or (1)(f)
22. In relation to the provision of references for students or former students (1)(f)
23. To sponsors, including the UK research councils, the Student Loan Company and sponsors located overseas: (1)(b) or (1)(f)
24. To external bodies and individuals who have funded student prizes and awards: (1)(b) or (1)(f)

All students agree to the University processing their “sensitive personal data”/“special categories of data” for the following purposes and for release to the following third parties:

25. To the Higher Education Statistics Agency, HEFCE, government departments and other authorised users for the analysis of student statistics and/or to enable them to carry out their statutory functions as applicable. This includes the ESFA, Ofsted, and the Office for Students in relation to Degree Apprentices: Article 9(1)(a)
26. To professional bodies where registration with that body is related to or a requirement of the student’s studies e.g. the GMC for medical students: Article 9(1)(g)
27. To other bodies involved in the delivery of the course or programme e.g. affiliated colleges, for the purpose of statistical analysis and programme administration:   Article 9(1)(a)
28. For the assessment and provision of services to disabled students: Article 9(1)(a)
29. For admission to and the administration of student programmes: Article 9(1)(a)
30. Where required, to the police or other agencies in connection with particular programmes of study or prior to certain placements: Article 9(1)(a) or (g)
31. To the University’s external lawyers, insurers in respect of accidents occurring within the institution and external auditors: Article 9(1)(f)

Recruitment data 

Expressions of interest in disability support and open day information

Minimum period: none

Maximum period: six months after cessation of relationship

Application data

Application forms, sign-up information, case notes relating to pre-applicants or applicants

Minimum period: none

Maximum period: six months after cessation of relationship (unsuccessful applicants only),
six years after student leaves (successful applicants)

Financial data

Information relating to Disabled Students’ Allowances

Minimum period: six years after student leaves

Maximum period: six years after student leaves

Reference data in addition to core academic data

Contents of student record e.g. Needs Assessment Reports, evidence, case notes, emails etc

Minimum period: one year after student leaves

Maximum period: six years after student leaves

Audit/professional/statutory data

Verification data required by professional body or HEFCE audit. Contents of student records held by Disability Services and required by DSA-QAG audit, including entitlement letters, case notes and emails, student support ILPs, timesheets and associated invoices.

Minimum period: six years after student leaves

Maximum period: none

Appeals and complaints/anticipated or ongoing legal action

Academic and disciplinary appeals, student complaints and litigation

Minimum period: one year after student leaves for all students

Maximum period: for cases - six years after exhaustion of internal process or after the student leaves

Course information

Programme and Module specifications

Minimum period: perpetuity

Maximum period: perpetuity

Quality Assurance

Student surveys, module reviews, programme reviews, minutes of meetings, Exam papers etc

Minimum period: current academic year plus 1

Maximum period: none

Student assessments and evidence submitted for mitigation, disability notification

Assessments, exam scripts, and any item that identifies the student eg mitigating circumstances minutes, exam board minutes

Minimum period: one year after student leaves

Maximum period: six years after student leaves

Learning resources that identify students

Minimum period: current academic year plus one

Maximum period: none

Learning resources that don’t identify students

Lecture slides, recordings and hand-outs

Minimum period: In accordance with systems policy, based on available space and system performance

Maximum period: In accordance with systems policy, based on available space and system performance