WIREDGOV

A blog by Viv Adams, Principal Policy Adviser in the ICO Parliament and Government Affairs team

Starting university or further education can be an exciting time, but for some it can also be a difficult and anxious transition.

We know that universities and colleges work hard to provide support to students who are struggling. That means that universities often have to handle sensitive personal information about them. And we are aware that, sometimes, universities are hesitant to share students’ personal data in an urgent or emergency situation, citing data protection as the problem. That should not be the case.

Put simply, university staff should do whatever is necessary and proportionate to protect someone’s life. Data protection law allows organisations to share personal data in an urgent or emergency situation, including to help them prevent loss of life or serious physical, emotional or mental harm.

The ICO’s approach has always been to be a pragmatic and proportionate regulator. That means the ICO does not seek to penalise organisations for acting in good faith and in the public interest in an urgent or emergency situation.

To help universities and colleges feel confident they can share people’s information lawfully, we have set out some practical steps:

• Plan ahead. Having an emergency plan in place that takes into account data sharing can help prevent any delays in a crisis. As a start, universities should consider in advance the types of data they currently hold and that are likely to be shared in an emergency. They also need to consider how they will share the data securely. The best way to do this is through a Data Protection Impact Assessment.
• Have a data sharing agreement in place. When there is a need for universities to share students’ data on a more frequent basis, for example with health and wellbeing organisations, having a data sharing agreement in place can help so information is shared in a safe and timely way.
• Staff training. Staff are more confident in using and sharing personal data appropriately when they have clear guidance and training around their roles and responsibilities. This includes specific advice for staff on how to handle personal information in an emergency situation.
• Access our data sharing resources. Our data sharing code of practice provides practical guidance for organisations to share data fairly, lawfully and proportionately. Alongside the code, our data sharing information hub has many helpful resources including myth-busting facts, case studies, FAQs and checklists.

We recognise that this does not resolve all the issues around students’ personal data where there is a mental health concern, but we hope it will go some way towards it by busting data sharing myths.

We will continue to work with universities, educational bodies and parents to reassure them that data protection law enables data sharing to save lives and protect young people.