Sharing Student Personal Data and Consent

Generally, staff members do not need to and should not ask for a student’s consent to share relevant information with relevant staff. Additionally, if a student is not asked for their consent, and instead pro-actively says that they do not consent to their information being shared, it should be explained to them that their consent is not required, and their refusal of consent cannot be complied with. This applies to personal data, special category data and criminal offence data. The reason that consent isn’t needed is because BCU is relying on different legal reasons. More information about those legal reasons is below.

There is one exception to this approach. BCU staff do need consent from a transgender person to pass on information to someone else about that person’s gender identity or gender reassignment. This is required under the Gender Recognition Act 2004. An organisation does not need the permission of a person to process (collect, store, use and delete) information about their gender identity or gender reassignment, it’s only the passing on of that information between staff or to external organisations that needs consent. Staff should bear this is mind if they are moving email between email accounts or adding this information to a case management system, if someone else has access to that email account or case management system. Consent does not have to be in written form, but it’s good practice to receive it in writing.

Whether a BCU staff member needs consent to share student personal data to people / organisations external to BCU will depend on the context. Usually, BCU needs to rely on a student’s consent to share any information with a student’s relatives / guardians / friends. It’s good practice to receive consent in writing. You can read information about this in section 7.3 of the Data Protection Policy or on this Student Services iCity page (What to do if a student’s parent or guardian wants information).

In most situations BCU staff don’t need a student’s consent to share relevant personal data with relevant external organisations, such as placement providers, or other organisations listed in the Privacy Notice for Enquirers, Applicants and Students and in other privacy notices including the Privacy Notice for Student Inclusion.

The term in the law for ‘legal reasons’ for processing personal data is ‘Article 6 lawful bases’. BCU must choose at least one of them as the reason they are processing personal data. ‘Processing’ in this sense means collecting, storing, using, sharing or destroying. They are:

- For performance of a contract (often the student contract)

- For compliance with a legal obligation

- For vital interests (to protect someone’s life)

- For a task in the public interest (see question 4)

- For legitimate interests

- Consent

You can read more about these lawful bases on the Lawful Basis and Conditions of Processing iCity page and on this Information Commission’s webpage. BCU will only rely on the lawful basis of consent if none of the other lawful bases are applicable.

Where special category data is processed, as well as choosing a legal reason, BCU must also choose a relevant condition. The term in the law for these is ‘Article 9 conditions of processing’. These are:

(a) Archiving, research and statistics
(b) Employment, social security and social protection
(c) Explicit consent
(d) Health or social care
(e) Legal claims or judicial acts
(f) Made public by the data subject
(g) Not-for-profit bodies
(h) Public health
(i) Reasons of substantial public interest (see question 4)
(j) Vital interests

You can read more about these conditions on this Information Commission’s webpage. BCU will only rely on explicit consent if none of the other conditions of processing apply.

These terms mean that it’s within the scope of BCU’s tasks as an organisation, or that it’s in the good of society (i.e. it’s in the public good) that organisations such as BCU can use this personal data / special category data. They do not mean that the information is made available to the public.

For further information, please contact the Information Management team at informationmanagement@bcu.ac.uk.