Information Commissioner's Office
Blog: Sharing personal data in an emergency – a guide for universities and colleges
A blog by Viv Adams, Principal Policy Adviser in the ICO Parliament and Government Affairs team
Starting university or further education can be an exciting time, but for some it can also be a difficult and anxious transition.
We know that universities and colleges work hard to provide support to students who are struggling. That means that universities often have to handle sensitive personal information about them. And we are aware that, sometimes, universities are hesitant to share students’ personal data in an urgent or emergency situation, citing data protection as the problem. That should not be the case.
Put simply, university staff should do whatever is necessary and proportionate to protect someone’s life. Data protection law allows organisations to share personal data in an urgent or emergency situation, including to help them prevent loss of life or serious physical, emotional or mental harm.
The ICO’s approach has always been to be a pragmatic and proportionate regulator. That means the ICO does not seek to penalise organisations for acting in good faith and in the public interest in an urgent or emergency situation.
To help universities and colleges feel confident they can share people’s information lawfully, we have set out some practical steps:
- Plan ahead. Having an emergency plan in place that takes into account data sharing can help prevent any delays in a crisis. As a start, universities should consider in advance the types of data they currently hold and that are likely to be shared in an emergency. They also need to consider how they will share the data securely. The best way to do this is through a Data Protection Impact Assessment.
- Have a data sharing agreement in place. When there is a need for universities to share students’ data on a more frequent basis, for example with health and wellbeing organisations, having a data sharing agreement in place can help so information is shared in a safe and timely way.
- Staff training. Staff are more confident in using and sharing personal data appropriately when they have clear guidance and training around their roles and responsibilities. This includes specific advice for staff on how to handle personal information in an emergency situation.
- Access our data sharing resources. Our data sharing code of practice provides practical guidance for organisations to share data fairly, lawfully and proportionately. Alongside the code, our data sharing information hub has many helpful resources including myth-busting facts, case studies, FAQs and checklists.
We recognise that this does not resolve all the issues around students’ personal data where there is a mental health concern, but we hope it will go some way towards it by busting data sharing myths.
We will continue to work with universities, educational bodies and parents to reassure them that data protection law enables data sharing to save lives and protect young people.
Latest News from
Information Commissioner's Office
We Buy Any Car, Sports Direct and Saga fined £495,000 after sending millions of ‘frustrating and intrusive’ nuisance messages.15/09/2021 13:20:00
The ICO has today announced fines totalling £495,000 to well-known companies that between them sent more than 354 million nuisance messages.
G7 data protection and privacy authorities’ meeting: communiqué13/09/2021 09:10:00
The UK Information Commissioner’s Office (ICO) brought together data protection and privacy authorities from G7 countries, as well as guests from the Organisation for Economic Cooperation and Development (OECD) and the World Economic Forum (WEF), for a discussion this week on shared emerging challenges that need closer international collaboration.
Statement in response to DCMS consultation into proposed data protection reform10/09/2021 14:10:00
Statement given yesterday in response to DCMS consultation into proposed data protection reform.
ICO to call on G7 countries to tackle cookie pop-ups challenge07/09/2021 14:10:00
The UK Information Commissioner’s Office (ICO) will today call on fellow G7 data protection and privacy authorities to work together to overhaul cookie consent pop-ups, so people’s privacy is more meaningfully protected and businesses can provide a better web browsing experience.
ICO fines Glasgow company for making half a million nuisance calls05/09/2021 09:10:00
The Information Commissioner’s Office (ICO) has fined Glasgow-based company DialADeal Scotland Ltd (DDSL) for making more than half a million nuisance marketing calls.
Statement on DCMS announcement of next Information Commissioner26/08/2021 12:10:00
The Department for Culture, Media and Sport has today announced that John Edwards is the Government's preferred nominee to be the next Information Commissioner.
Blog: As the Children’s code comes in – what’s next?25/08/2021 12:25:00
A blog by Stephen Bonner, ICO’s Executive Director of Regulatory Futures and Innovation.
ICO fines company for illegal pensions calls20/08/2021 14:20:00
The ICO has fined Halifax-based company Parkin Beacher Ltd (PBL) £50,000 for making illegal marketing calls to people about their pensions.