Student to degree mismatch privacy notice

Privacy notice for 'Student to degree mismatch: the role of schools, and the impact of disruption from COVID-19' research project.

Contents

• Introduction
• About us
• Personal data that we process
• How we use your personal data
• Who we share your personal data with
• Lawful basis for processing
• International transfers
• Information security
• Data retention
• Your rights
• Contacting us
• Complaints

Introduction

The Centre for Education Policy and Equalising Opportunities (“we” “us”, or “our”) respects your privacy and is committed to protecting your personal data. 

Please read this privacy notice carefully – it describes why and how we collect and use personal data and provides information about your rights. It applies to personal data provided to us, both by individuals themselves or by third parties and supplements the following wider UCL privacy notice(s):

• General privacy notice when you visit UCL’s website
• Student privacy notice
• Staff privacy notice
• Research participants for health and care purposes privacy notice

We keep this privacy notice under regular review. It was last updated September 2018.

About us

The Centre for Education Policy and Equalising Opportunities is part of UCL IOE.

UCL, a company incorporated by Royal Charter (number RC 000631), is the entity that determines how and why your personal data is processed. This means that UCL is the ‘controller’ of your personal data for the purposes of data protection law.

Personal data that we process

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We will not collect any data about you, but we may process personal data about you, e.g., National Pupil Database (NPD) data and Higher Education Statistics Agency (HESA) data, which we access from the Department of Education (DfE), via the Office for National Statistics (ONS) Secure Research Service.

This may include:

• Your name and contact details
• ‘Special category’ data about you (this may include details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about your health etc.) 
• The names and other details about third parties who are involved in the issues we are helping you with
• Your educational attainment (e.g., GCSE and A level or equivalent results and degree classification) and educational choices (e.g., school and university course attended).

How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• To register you as a client and to manage our relationship with you
• To help you with your enquiry: depending on the circumstances, this may include special category personal data. Here, the processing of your information is carried out on the basis of your explicit consent
• For research purposes: where the processing is based on your consent, you have the right to withdraw your consent at any time by contacting us using the details set out below. Please note that this will not affect the lawfulness of processing based on consent before its withdrawal.

We may also use anonymised data, meaning data from which you cannot be identified, for the purposes of:

• Service evaluation
• Education and research
• Fundraising and promotional purposes. 

Anonymised data may also be used in published reports or journals and at conferences.

Who we share your personal data with

Your personal data will be processed primarily by our staff and UCL (Access to your personal information is limited to staff who have a legitimate need to see it for the purpose of carrying out their job at UCL.)

Lawful basis for processing

Data Protection Legislation requires that we meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a "lawful basis" for the processing. The basis for processing will be as follows: 

• Public task. The processing of your personal data may be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us
• GDPR Article 9(j) ‘Archiving, research and statistics’; and GDPR article 10 and Part 1 of the Data Protection Act (DPA) 2018 for sensitive/special category personal data

For special category personal data, the following lawful bases for processing will be used:

• GDPR Article 9(j) ‘Archiving, research and statistics’; and GDPR article 10 and Part 1 of the DPA 2018 for sensitive/special category personal data.

International transfers

We do not transfer your personal data outside the European Economic Area (EEA).

Information security

We will access your data only through the Office for National Statistics Secure Research Service (SRS). The SRS gives accredited or approved researchers secure access to de-identified, unpublished data in order to work on research projects for the public good. ONS have been accredited as a Digital Economy Act (DEA) 2017 processor by the UK Statistics Authority for the preparation and provision of data for research purposes.

The SRS provides a safe setting, as part of the Five Safes Framework to protect data confidentiality. The framework is a set of principles adopted by a range of secure labs, including the ONS. 

See accessing secure research data as an accredited researcher (Office for National Statistics website).

We will access the relevant datasets through remote access to the SRS or through an ONS “safe room” within UCL.

Data retention

We wont ever store your personal data since we will only access the data through the ONS Secure Research Service (see Information security above).

Your rights

Under certain circumstances, you may have the following rights under data protection legislation in relation to your personal data:

• Right to request access to your personal data.
• Right to request correction of your personal data.
• Right to request erasure of your personal data.
• Right to object to processing of your personal data.
• Right to request restriction of the processing your personal data.
• Right to request the transfer of your personal data.
• Right to withdraw consent.

If you wish to exercise any of these rights, please contact the Data Protection Officer at data-protection@ucl.ac.uk 

Contacting us

You can contact UCL by telephoning +44 (0)20 7679 2000 or by writing to: University College London, Gower Street, London WC1E 6BT.

Please note that UCL has appointed a Data Protection Officer. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact our Data Protection Officer using the details set out below:

Data Protection & Freedom of Information Officer
data-protection@ucl.ac.uk 

Complaints

If you wish to complain about our use of personal data, please send an email with the details of your complaint to the Data Protection Officer at data-protection@ucl.ac.uk so that we can look into the issue and respond to you. 

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) (the UK data protection regulator). For further information on your rights and how to complain to the ICO, please refer to the ICO website.