As a company, we’ve been asked a lot about the impact of Brexit on UK data protection. For the boots on the ground, the changes have not felt particularly significant. The Data Protection Act, including the UK GDPR, governs our compliance in a very similar manner and we still need to ensure the integrity and security of our data all the same. The one area you may spot some changes is data transfers. As stated by the ICO, UK transfer rules “broadly mirror the EU GDPR rules”, but the UK now has sovereignty to change these rules.  

Which is exactly what the UK has done. On the 21st of March, the UK’s new International Data Transfer Agreement (IDTA) came into effect, alongside an addendum to the EU’s latest Standard Contractual Clauses (SCCs). These provisions replace the current SCCs for international transfers.  

Why do we need the IDTA?

In 2020, the ECJ announced the “Schrems II” judgement. A judgement on case C-311/18 (‘Data Protection Commissioner v Facebook Ireland and Maximillian Schrems’). The result of this case invalidated the EU-US privacy shield, and cast doubt on the use of SCCs to transfer data.  

In principle, SCCs still provide an acceptable safeguard for transfers of personal data, but they now require additional work. Since Schrems II, both the EU and the UK have been working on new safe mechanisms for data transfer. For the UK, that new mechanism is the IDTA.  

When to use the IDTA

Much like SCCs, and the now-defunct EU-US Privacy Shield, the IDTA is used when organisations want to transfer data to territories not covered by adequacy regulations, with weaker data protection provisions. The IDTA acts as a contract between the organisations sharing data. The organisation receiving data is not held to the same strict standard of privacy and security as the organisation sending the data, so they must agree to treat the data as if they were regulated by the UK Data Protection Act. This ensures that an individual’s personal data receives equal protection outside the UK, as it would inside the country.  

What does the IDTA mean for schools, colleges and trusts?

For schools, colleges and trusts, you’ll need to look at your current contracts. You’ll also need to review any new contracts you wish to enter. These changes only affect contracts with suppliers outside the EEA, without cover from an adequacy agreement. So, first of all, double check where a supplier processes and stores data.

The ICO are still publishing new guidance regarding the IDTA, but it is already available for immediate use. All contracts beginning after the 21st September 2022 will need to use the IDTA, or the IDTA addendum, so when looking at suppliers in third countries such as the USA, it’s worth implementing the IDTA (or its addendum) now, rather than using legacy SCCs.  

Additionally, schools, colleges and trusts will need to look at their current contracts, as from 21st March 2024, they’ll need to rely on the IDTA, and not “old” SCCs. It’s worth making note of when your current contracts end. That way, you have enough time to discuss and implement changes with your suppliers, without a break in service provision.

Last week, a news article popped up. “UK to overhaul privacy rules”. Naturally, it piqued some interest. The UK debated revoking the GDPR before they finished implementing it. By the time the GDPR came into effect in 2018, several years had passed since the UK announced its intention to leave the EU.

However, we have now officially left the EU and completed the transition period. We are no longer obligated to comply with EU regulations. This doesn’t mean the GDPR has disappeared,  but it does change some of the rules of the game.

 

We’ve Left The EU. Why Do We Still Have The GDPR?

As of January 2021, the Brexit transition period has ended. EU laws no longer apply to the UK. Therefore, the EU GDPR technically no longer applies to the UK.

The key word here is “technically”. According to the ICO, “The GDPR is retained in domestic law as the UK GDPR”. The UK GDPR writes the same privacy rules into UK law, with just a few minor changes. These laws remain regardless of our status within the EU.

The key difference now we have left the EU, is that we are no longer obligated to have a privacy framework identical to the GDPR, and the UK government now keeps the framework under review themselves. They also now have the power to scrap the whole thing.

What Will Change: International Data Transfers

While it is now technically possible, it’s unlikely the GDPR is going away any time soon. However, there may be changes that alter how schools and colleges handle their data.

Firstly, updates to current international adequacy agreements would affect bringing on new suppliers.

As part of choosing a data processor, schools and colleges must assess whether personal data leaves the UK.  If a company holds data in a country where data protection laws are not as stringent as ours, this puts undue risk on that data. These data processors should implement additional protections for personal data such as Standard Contractual Clauses.

Adequacy agreements negate the need for these additional protections. The UK has agreed with multiple countries that any data moving from the UK to those countries will be treated with the same security as if it were still in the UK. Upon leaving the EU, the UK government has announced plans to strike new adequacy agreements with additional countries. As the UK begins discussions with various nations, and adequacy agreements shift and change, the suitability of different data processors will also vary. Schools and colleges will need to keep an eye on policy changes regarding international data transfers, to make sure they have all the appropriate safeguards in place. should the UK remove a country from the list of “adequate” countries, schools and colleges should either terminate any contracts with data processors there, or ensure there are additional measures to protect any transferred data.

What Will Change: The Bigger Picture

Secondly, the UK government have stated that they intend to “improve the UK’s data protection regime to make it even more ambitious and innovation friendly.” To break this down into layman’s terms, the UK government want to ease the path to data sharing where they believe it could fuel growth for the country. It’s not entirely clear what this will mean in terms of specific changes to the current privacy rules. However, the UK are unlikely to entirely revoke the GDPR.

The UK already has adequacy agreements with over 30 countries, via the EU’s GDPR framework. If the UK were to massively reduce the data protection regulations, they would no longer be in line with the GDPR, and we would lose our adequacy agreements with these EU countries. Seeing as the UK government are keen to increase the number of adequacy agreements and data partnerships, it feels unlikely they’ll sacrifice agreements with the entire European Union, in order to relax data protection regulations.

Is the GDPR Here to Stay?

It certainly looks that way. The rumoured “overhaul” is currently more of a renovation. The GDPR will still be providing a framework for data protection and providing individuals with important data related rights.

So, as we start a new year of education and innovation, lets keep data protection at the core of it all. Responsible use of data builds trust between your organisation and your staff, students, clients and customers. It’s worth keeping that confidence. Without trust, it’s far harder to flourish.

For today’s post, we’re taking a quick dive into the murky depths of Subject Access Requests.

Imagine this scenario. One of your students, staff members, or anyone you might have information about is standing at the front desk, and they’re asking for all of their data. What do you do? What happens next? For many organisations, it’s a daunting thought.

In reality, answering a Subject Access Request can be reasonably simple. However, the process is easier to understand with a little background knowledge:

What is a Subject Access Request?

 

Every individual is entitled to know what information you are holding about them. Individuals have a range of rights, including the right to rectification and the right to be forgotten, but the right most commonly exercised is the right to access.

Individuals exercise this right by submitting a Subject Access Request. Through this process, individuals can ask you to provide them with a copy of the personal data you hold about them.

An individual has been able to submit a Subject Access Request (SAR) since before the GDPR. Although the process was slightly different, you could request your data under the 1998 Data Protection Act. The GDPR has simplified the process for individuals, so they can exercise their rights with more ease.

Receiving a Subject Access Request

Back to the situation at hand, you’re manning the front desk and you’re face-to-face with a SAR. What comes next?

The first thing to note is that a Subject Access Request can come to anyone within an organisation, and can come in any format. Your organisation may have a specified route for Subject Access Requests such as an email address or phone number, but individuals are not obligated to use these methods.

A Subject Access Request can be verbal or written and can be sent through mechanisms like social media. You can receive a Subject Access Request via tweet. When you receive a request via one of these routes, it’s best to make a written record of the request, but you can’t force the individual to do so.

In this scenario, the first thing you’ll want to do is gather a little more information. You can ask the individual for their name, and whether they have any other information such as a reference number to help locate their records.

After that, it’s best to enquire if there is anything specific the individual is looking for. Sometimes an individual is looking for specific information, or data from a specific time-period. They’re under no obligation to narrow the scope of their request, but it can sometimes save them from sifting through hundreds of records and save time for your organisation.

 

A Note About Identification

It is important that the person making the request is who they claim to be. This process requires some common sense. Identity verification must not be used to block access to information. In the case of requestors such as students or staff, you already hold information about their identity, and their presence at your organisation on a daily basis means that further checking is not required.

When requestors are less well known, verification of identity is required. This is easiest to do in person. The requestor can show identification documents such as:

• Passport
• Current Drivers Licence
• Utility Bill
• Bank or Building Society Statement
• Letters from the Benefits Agency
• Letter from Professional

In the scenario used here, you might not be absolutely certain of the requestor’s identity. You could ask to see identification when they first make the request. If they didn’t have any, you could advise them to return with ID when possible, but that you’ll start processing their request immediately.

 

Moving down the chain

Once you’ve taken this information, the next step depends on how your organisation works. For larger organisations, you might have a designated data protection team. For smaller organisations, you may have a single point of contact, or you might be the data protection lead. In particularly small organisations, it’s not unusual for employees to have more than one hat to wear.

Regardless of size, your next step will involve recording the request, and setting the data discovery process in motion. Your organisation has a calendar month to respond to a Subject Access Request, and this begins when anyone in the organisation receives a request, not when the designated data protection lead receives it, so it’s important you get the ball rolling quickly.

You should have somewhere to record any Subject Access Requests your organisation receives. It might be an cloud-based system like ours. You should record the request, along with the date requested and any additional details. If someone makes a written request or sends a tweet, you should record that request verbatim so there can’t be any confusion.

Data Discovery

The request has been recorded and passed on to the correct team. If you’re in a large organisation, that might be the last you hear of the request. If your organisation is smaller, you are more likely to be involved in data discovery.

At this stage you’ll need to look through all your records for any personal data of the requestor. If the scope has been narrowed down, you may not need to locate all the personal data for an individual. When searching for data, make sure to search using any identifiers that might be used in your organisation. If customers have a reference number, or if individuals are referred to by initials, these should be searched for too, as well as searching for the requestor’s name. It’s also worth noting that something can be personal data, even if none of these identifiers are used. For instance, sometimes a cursory glance through all relevant emails might turn up one or two results that were missed by a filtered search done previously.

This can be quite a complex process, and if you’re struggling to hit the deadline, it might be worth looking at extensions.

Redact and Return

The data has been found and it’s been collated. Now you need to provide it to the individual. In general, SARs are sent out in electronic format, but a general rule of thumb would be to respond to a request in the format you received it. In this case, the request was verbal, and it wouldn’t make sense to try and provide the response verbally. Instead, the data protection team are using the contact details you collected at the start of the process and will be emailing out the response. Good for the bees, good for the trees, and easily accessible to the requestor.

However, before this data can be sent out, it must be redacted. An individual only has the right to access their own data, so anybody else’s personal data needs to be removed.

There are a few different methods to redact information, either in hard copy or in digital format. A quick scribble in black pen seems to suffice in the movies, but it’s not a reliable form of redaction. To ensure you don’t give away data you shouldn’t, have a look into electronic redaction, which covers the data and then deletes it from underneath so it cannot be recovered.

The end of the line

A month has passed, and your student or staff member has received an email with the personal data they requested. They’re happy, you’re happy, and there have been no inadvertent data breaches.

Subject Access Requests might seem daunting to begin with, but they just require a little teamwork and some forward planning. With a step-by-step process you can solve a SAR with ease.

 

In schools, responsibility surrounding children’s mental health and wellbeing is clearly documented. Legislation such as the 1989 Children’s Act, and guidance such as “Keeping Children Safe in Education,” set out responsibilities of staff and governors. Furthermore, it is made abundantly clear that data protection concerns should not prevent action from being taken to support the welfare of the child or young person.

However, these requirements only apply to those under 18. In the Keeping Safe in Education documentation, all individuals under the age of 18 are classed as children. Yet in higher and further education, most students are adults. This makes management of their welfare a more complicated puzzle.

 

The Statistics: Mental Health in Universities

In a 2020 survey of 1800 university students, Randstad (A human resources consulting firm) found nearly 40% of participants felt their studies were affecting their mental wellbeing. Of students considering leaving their course, 55% of them considered mental health decline a leading factor in their decision. There is plenty of evidence that attending university can create stress for students, and exacerbate mental health problems.

There is also plenty of evidence that early intervention supports recovery from mental health problems, but this can only happen if those who can intervene know that it’s needed.

One obvious source of support would be parents, or another trusted adult. Many parents want to provide that support, but if the student won’t ask for help, does the university or college have the right to get in touch and flag the concern?

To disclose, or not to disclose?

Let’s think about this from the pure approach of data protection. A data controller is in possession of special category personal data (concerns about the mental wellbeing) for an adult. Without explicit consent or a statutory duty, can the data controller disclose that personal data to a third party?

The obvious answer to this question is no. It would be a clear breach of confidentiality.

The issue is, from the perspective of the College or University, they can only go so far in providing welfare services, so surely sharing concerns with parents/guardians would be justified in the best interests of the student?

This is where everything becomes complicated. At a point of crisis, where an individual’s life is at risk, the Vital Interests lawful basis could allow an emergency contact to be made, but only to alert the contact of the emergency. Universities can only disclose additional detail if the individual is incapable of giving consent.

If mental health intervention is most effective before an emergency situation, we can’t disclose health data on the basis of Vital Interests.  We also have to consider that the student may have good reasons for not wanting their parents to be contacted, even in an emergency. It’s possible the issues may relate directly to the parents or to their attitudes towards the student. In some cases, informing parents could put the student at risk of serious harm.

How can the institution know the family background of the thousands of students they deal with? Worse still, if parents were contacted when a concern was flagged, then this might put students off coming forward in the first place.

 

Creating a new infrastructure

Information cannot be disclosed without consent. For a person with declining mental health, getting that consent can be difficult. Depending on the particular problem being faced, that consent may not even be considered freely given.

As such, the best time to address this problem is during the process of application and enrolment. A structured opt-in scheme with very clear rules could be established at universities, so students can give their consent for concerns to be shared with a named contact. This scheme could be promoted in school during applications, and by universities during open days.

This wouldn’t be used if students miss a lecture or don’t hand work in on time. University is not school. While most students are on the younger side, they should be treated with the same respect given to any adult. However, for serious concerns about a student’s wellbeing, this opt-in mechanism would enable help to be sought before a crisis. Should a student not consent or withdraw their consent later, the university or college would follow the normal welfare process, giving students freedom of choice. For those who do consent, this scheme would act as an additional safety net, giving students and parents a level of reassurance.

 

A Widespread Solution

Opt-in systems are appearing at various universities, but it’s unclear whether these will be adopted more widely. UCAS, who manage most university applications, currently have nothing in place in their application process. Furthermore, the Office for Students say that “individual universities are responsible for developing their own mental health policies.”

As such, it’s unlikely there will be a standardised process across all colleges and universities. However, even if the Office for Students does not mandate an opt-in system, Universities and Colleges could implement them independently.

This is the most obvious method of balancing the issues of consent and concern. Yet, a recent Freedom of Information Request found that of 149 responses, only 32 higher education institutions had a system for students to opt-in to parent/guardian contact.

 

Finding the Perfect Balance

From a broader perspective, this debate raises questions about where duty of care lies at university. From a data protection perspective, it’s relatively simple. An individual’s right to consent or object to processing/sharing of data should be respected.

A consent based system gives students the choice they are entitled to. However, it also means that a student’s support system can be contacted if they are in crisis. 96% of students at the University of Bristol opted in to their welfare scheme, and the university used the scheme 36 times in the first year. By stepping back, and adding additional infrastructure designed with data privacy in mind, higher education institutions can keep both data protection and welfare as a priority.

 

When you purchase a product or use a service, at some point you will probably receive a feedback form. It’s almost an inevitability.

It might be a form that arrives on email, or an irritating pop-up in an app. Recently, if you use a smart speaker you may get a notification which proceeds to tell you “Two months ago, you bought cat food, how many stars would you give this product?” It’s easy to answer the question. Although, depending on how irritating the distraction is, the validity of the feedback is questionable!

Whenever these pop-ups appear, you’re told “Your responses will remain anonymous”. It’s such a common appearance that most of us probably don’t even notice. With the smart speakers, there is no privacy information at all. We all assume our feedback is anonymous. Maybe it’s worth taking a step back and asking ourselves “What is anonymisation anyway?”

 

What is Anonymisation?

Anonymous data is defined in recital 26 of the GDPR as “Information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable”.

Anonymous data is, therefore, not subject to the provisions of the UK GDPR. However, anonymisation is not as simple as removing names and addresses, particularly with the new definition of personal data. The UK GDPR defines personal data as data relating to an identified or identifiable natural person.

 

Understanding Identifiability

To understand the breadth of identifiability, let’s look at a stock image.

This image is from Adobe Stock, a website where you pay a licence fee to use images in commercial works. If I hadn’t told you where the image came from, you could find out quickly with a reverse image search. We’re not going to get into the debate here about invasion of privacy by the photographer and whether publishing the image for sale, truly puts into the public domain.

If we go on the Stock image website, we’ll find the name of the photographer who took the picture. We could then contact the photographer and ask about this particular photo. The photographer might say that it was a candid photo, without any models, but that they took it at 6.40am on the 5^th October 2020.

You could then canvas around this station at the same time of day the photographer took the picture. Given how many people use the tube for their daily commute, there’s a distinct possibility you’ll find some of the people in the photograph.

In three or four steps, you can identify the individuals in the photograph. The individuals are identifiable, so this picture could be defined as personal data. It’s easy to see from here why anonymisation is a harder task than it used to be.

 

True Anonymisation

So, are our responses to those rating questions anonymous? The answer to that question is “maybe.”

If the data is requested and collected in a way that provides the rating to the company with no other details, then we could say the feedback was anonymous.

However, lets take an experience that many of us are familiar with. You download an app on your phone and happily set about completing puzzles, building civilisations or destroying aliens. After a while a request pops up asking for a review.

For Apple users this is all provided by the Appstore. Interestingly, an application provider must only request this information three times year. The application provider must therefore record how many times they’ve sent a pop-up notification. So, it’s clear they must store some personal data.

Seeing as the App Store handles ratings and reviews, you could consider Apple as a data processor, running the review process on behalf of the App developer. So, maybe they are processing personal data after all.

Let’s think about a simpler example. You run an event in a school and you ask for feedback afterwards. Let’s say you send out a link to a Google Form and someone answered about the lack of wheelchair access, or rapidly flashing lights without a warning. If you have one person who uses a wheelchair or one person with photo-sensitive epilepsy then the anonymity of the feedback is very much weakened.

 

Managing Anonymisation

The bigger question is ‘Do you actually need to have perfectly anonymous data?”

For the education sector, feedback is essential to improve teaching, educational resources and student wellbeing. Educational organisations often need to show their commitment to progress and equality. The publication of statistical data can support that.

The UK Data Service provides advice on anonymising both Quantitative Data (numbers and statistics) and Qualitative Data (opinions, statements and written responses).

However, if you take sensible anonymisation measures (or use sensible alternatives such as pseudonymisation measures) and you protect the data you gather as personal data, any risks can be cut substantially, and you can get on with driving improvements based on the results of your feedback.