In schools, responsibility surrounding children’s mental health and wellbeing is clearly documented. Legislation such as the 1989 Children’s Act, and guidance such as “Keeping Children Safe in Education,” set out responsibilities of staff and governors. Furthermore, it is made abundantly clear that data protection concerns should not prevent action from being taken to support the welfare of the child or young person.
However, these requirements only apply to those under 18. In the Keeping Safe in Education documentation, all individuals under the age of 18 are classed as children. Yet in higher and further education, most students are adults. This makes management of their welfare a more complicated puzzle.
The Statistics: Mental Health in Universities
In a 2020 survey of 1800 university students, Randstad (A human resources consulting firm) found nearly 40% of participants felt their studies were affecting their mental wellbeing. Of students considering leaving their course, 55% of them considered mental health decline a leading factor in their decision. There is plenty of evidence that attending university can create stress for students, and exacerbate mental health problems.
There is also plenty of evidence that early intervention supports recovery from mental health problems, but this can only happen if those who can intervene know that it’s needed.
One obvious source of support would be parents, or another trusted adult. Many parents want to provide that support, but if the student won’t ask for help, does the university or college have the right to get in touch and flag the concern?
To disclose, or not to disclose?
Let’s think about this from the pure approach of data protection. A data controller is in possession of special category personal data (concerns about the mental wellbeing) for an adult. Without explicit consent or a statutory duty, can the data controller disclose that personal data to a third party?
The obvious answer to this question is no. It would be a clear breach of confidentiality.
The issue is, from the perspective of the College or University, they can only go so far in providing welfare services, so surely sharing concerns with parents/guardians would be justified in the best interests of the student?
This is where everything becomes complicated. At a point of crisis, where an individual’s life is at risk, the Vital Interests lawful basis could allow an emergency contact to be made, but only to alert the contact of the emergency. Universities can only disclose additional detail if the individual is incapable of giving consent.
If mental health intervention is most effective before an emergency situation, we can’t disclose health data on the basis of Vital Interests. We also have to consider that the student may have good reasons for not wanting their parents to be contacted, even in an emergency. It’s possible the issues may relate directly to the parents or to their attitudes towards the student. In some cases, informing parents could put the student at risk of serious harm.
How can the institution know the family background of the thousands of students they deal with? Worse still, if parents were contacted when a concern was flagged, then this might put students off coming forward in the first place.
Creating a new infrastructure
Information cannot be disclosed without consent. For a person with declining mental health, getting that consent can be difficult. Depending on the particular problem being faced, that consent may not even be considered freely given.
As such, the best time to address this problem is during the process of application and enrolment. A structured opt-in scheme with very clear rules could be established at universities, so students can give their consent for concerns to be shared with a named contact. This scheme could be promoted in school during applications, and by universities during open days.
This wouldn’t be used if students miss a lecture or don’t hand work in on time. University is not school. While most students are on the younger side, they should be treated with the same respect given to any adult. However, for serious concerns about a student’s wellbeing, this opt-in mechanism would enable help to be sought before a crisis. Should a student not consent or withdraw their consent later, the university or college would follow the normal welfare process, giving students freedom of choice. For those who do consent, this scheme would act as an additional safety net, giving students and parents a level of reassurance.
A Widespread Solution
Opt-in systems are appearing at various universities, but it’s unclear whether these will be adopted more widely. UCAS, who manage most university applications, currently have nothing in place in their application process. Furthermore, the Office for Students say that “individual universities are responsible for developing their own mental health policies.”
As such, it’s unlikely there will be a standardised process across all colleges and universities. However, even if the Office for Students does not mandate an opt-in system, Universities and Colleges could implement them independently.
This is the most obvious method of balancing the issues of consent and concern. Yet, a recent Freedom of Information Request found that of 149 responses, only 32 higher education institutions had a system for students to opt-in to parent/guardian contact.
Finding the Perfect Balance
From a broader perspective, this debate raises questions about where duty of care lies at university. From a data protection perspective, it’s relatively simple. An individual’s right to consent or object to processing/sharing of data should be respected.
A consent based system gives students the choice they are entitled to. However, it also means that a student’s support system can be contacted if they are in crisis. 96% of students at the University of Bristol opted in to their welfare scheme, and the university used the scheme 36 times in the first year. By stepping back, and adding additional infrastructure designed with data privacy in mind, higher education institutions can keep both data protection and welfare as a priority.