XClose

Legal Services

Home
Menu

Student Privacy Notice

UCL General Student Privacy Notice. 21st August 2019, version 3.2

About this privacy notice

University College London ("UCL", "we", "our", "us") are committed to protecting and respecting your privacy.

This privacy notice sets out how UCL processes your personal data whilst you are a student at UCL. It should be read in conjunction with:

  • the Prospective Student (Enquirers and Applicants) Privacy Notice, which sets out in further detail how your personal data is processed during the enquiry and application stage to become a student at UCL; and
  • the Alumni Privacy Notice, which provides details of how your personal data is processed once you have graduated.

The above UCL privacy notices (and others) can be found on the Legal Services privacy page.

This notice applies to the personal data we collect from you and personal data which is passed to us by third parties. Please read the following carefully to understand how we process your personal data.

In addition to the information in this privacy notice, you may be given further information about the uses of your personal data when you sign up to use specific services and facilities we offer and, in certain situations, you may be asked whether you give your consent to us processing information about you.

Any changes we make to this privacy notice in the future will be posted on the Legal Services privacy page and, where appropriate, notified to you by e-mail.

What is 'personal data'?

‘Personal data’ means any information which identifies you as an individual. It may include your name but it may also be other information such as your date of birth, nationality and gender which when combined identify you. This information may be collected in a variety of ways, including electronically, in paper form, by telephone or in person.

UCL's data protection obligations

Under current data protection laws we are classed as a controller, which means we are legally responsible for the personal data we collect and hold about you. One of our responsibilities as a controller is to tell you about the different ways in which we use your personal data – what information we collect, our legal basis for doing so, why we collect it, where we collect it from and whether and with whom we will share it. We also need to tell you about your rights in relation to your personal data.

Personal information we collect about you

Types of personal data collected
We may collect and process the following information about you upon your enrolment at UCL and subsequently in order to manage your relationship with us as a registered student. Please note that some of the information listed below will only be collected in specific situations and will not therefore be collected in respect of all students.

Fee Status (e.g. home, EU or overseas)

Name

Date of birth (age)

Proof of Identity (e.g. passport)

Contact Info (Address, Phone, Email etc)

Disability/information relating to your health (note that this is only collected in specific situations, e.g. where it is required for UCL to comply with applicable law)

Ethnicity

Nationality/Place of Birth/Domicile

UKVI Confirmation for Acceptance to Study/Visa/Biometric Residence Permits and other immigration information (note that this is only collected in certain circumstances in relation to overseas applicants)

Academic Technology Approval Scheme (note that this is only collected in certain circumstances in relation to overseas applicants)

Date of Entry to the UK (note that this is only collected in certain circumstances in relation to overseas applicants)

Overseas police check (note that this is only collected in certain circumstances in relation to overseas applicants)

English proficiency

Literacy/Numeracy proficiency

Student status (e.g. ‘offer’, ‘accepted’ etc)

Qualification Information (provided by the applicant and external bodies e.g. UCAS)

Information about your career aspirations and work experience

Marks

Awards

Course

Programme

Fees/Payment Info

Student Funding and Finance information (including sponsor details)

Occupational Health (note that this is only collected in relation to students on specific programmes of study)

Next of kin/guardian/family etc data

Reference/Referee data

Statutory checks

Five year address history

Disqualification by association form (note that this is only collected in relation to students on specific programmes of study)

Photograph

Geodemographic Information

  • Low participation neighbourhood (note that this information is only collected in relation to specific cohorts of students)
  • Parental Higher Education
  • Time in Care (where applicable)

Information relating to any complaints that you make

Information relating to any disciplinary action in which you are involved

Data relating to your criminal convictions and offences, where appropriate

Other information relating specifically to your status as a student at UCL

Whilst you are a UCL student, both your image and voice may be recorded during our use of Lecturecast (our system for recording lectures and making them available online) as specified on the Teaching and Learning website and at teaching locations across the UCL campus.

In accordance with our CCTV Policy we may also capture your image on CCTV whilst you are on UCL premises.

Special category personal data

Some of the personal data listed above is classed as being within 'special categories of personal data' under current data protection laws, for example information relating to your ethnicity or any disability. Access to, and the sharing of, this information is controlled very carefully. You will be given more details about our use of any special category personal data when we collect it from you.

Personal data relating to criminal convictions and offences

In certain circumstances, we may process data relating to your criminal convictions and offences. Access to, and the sharing of, this information is also controlled very carefully. Where we process criminal records data, we will inform you separately and provide you with further information.

Information that we receive from third parties

We work closely with third parties (including, for example, funding and sponsorship partners, educational institutions, examination boards, overseas agents, UCAS, and clearing houses, business partners and compliance services e.g. UKVI, Disclosure and Barring Service) and may receive information about you from them (including, in certain cases, special category personal data or criminal convictions data). In particular, we may receive any of the following information from third parties: examination or test results, evidence of sponsorship (e.g. scholarship, bursary, loan), updates on your CAS status, DBS certificate number and other information in connection with your activities as a UCL student.

Purposes for which we process your personal data and the legal bases for processing

Overall, we will use your personal data to manage your relationship with us as a student at UCL. The main purposes for which we process your personal data as a student at UCL are set out in the table below.

Data protection laws require us to meet certain conditions before we are allowed to use your personal data in the manner described in this notice, including having a "legal basis" for the processing. Where we process special category personal data or criminal convictions data, we are required to establish an additional legal basis for processing that data.

We take our responsibilities under data protection laws extremely seriously, including meeting these conditions. The main legal bases on which your personal data are processed for a particular purpose are also explained in the table below.

PurposeLegal Basis

To process and manage your UCL enrolment

We will use your personal information to:

  • Enrol you as a student, where your application is successful and you accept our offer; and
  • Communicate with you about the enrolment process.

This will include asking all offer holders to disclose relevant criminal convictions (further information on this topic will be provided at the point when this question is asked).

In some cases, the information processed will include special category personal data.

We will also process criminal convictions data where you are working with children or vulnerable adults, and/or because of fitness to practise requirements in certain regulated professions. For example, certain courses such as Medicine will require a DBS check to be carried out as part of the assessment of eligibility. You will be notified prior to the processing if this is a requirement for enrolment on your course.

For all personal data

Performance of a task in the public interest

UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information.

Performance of contract

The processing of your personal data may be necessary in relation to the contract we have entered into with you as a student at UCL.

For special category personal data

Equality of opportunity or treatment

We process special category personal data in order to monitor equality of opportunity/treatment.

For criminal convictions data

Regulatory requirements relating to unlawful acts and dishonesty

We may process your criminal convictions data in order to assist a third party to comply with a regulatory requirement that requires the taking of steps to establish whether another person has: (i) committed an unlawful act, or (ii) been involved in dishonesty, malpractice or other seriously improper conduct do so.

Safeguarding of children and of individuals at risk

We may process your criminal convictions data in order to safeguard children or individuals at risk.

Protecting the public against dishonesty

We may process your criminal convictions data in order to protect the public against dishonesty, malpractice or other seriously improper conduct; and unfitness or incompetence.

Where we are relying on a legal basis other than those set out above in processing your criminal convictions data, we will inform you of the legal basis before we start processing your criminal convictions data based on that legal ground.

To deliver and administer your education

We will use your personal information to:

  • Facilitate your education;
  • Record the details of your previous academic studies (including any placements with external organisations);
  • Determine your examination achievements; and
  • Communicate with you about your education.

Special category personal data and criminal convictions data may be processed in certain circumstances, for example if you are on a course such as Medicine or a speech and language therapy programme, where NHS healthcare placements are undertaken. This processing will generally be to ensure that you are fit to practise and to work with persons in healthcare situations. You will be notified prior to the processing if this is a requirement for your course.

For all personal data

Performance of a task in the public interest

UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information.

Performance of contract

The processing of your personal data may be necessary in relation to the contract we have entered into with you as a student at UCL.

For special category personal data

Management of health care systems/services

We may process your special category personal data where this is necessary for health and social care purposes with respect to the management of health care systems and services.

Establishment, exercise or defence of legal claims

It may be necessary to process your special category personal data in relation the establishing, exercising or defending legal claims.

Employment and social security and social protection law

Where obligations or rights exist in the field of employment or social protection law we may rely on this condition.

Equality of opportunity or treatment and/or consent

There may be occasions when we need to process your personal data relating to health to facilitate your education, e.g. administering our extenuating circumstances procedures, or ensure the equality of opportunity/treatment.

For criminal convictions data

Management of health care systems/services

We may process your criminal convictions data where this is necessary for health and social care purposes with respect to the management of health care systems and services.

To manage the student experience at UCL

We will use your personal information to:

  • Manage your use of facilities and participation at events (e.g. computing, libraries, accommodation, functions, graduation, careers);
  • Support your training, health, safety and welfare requirements;
  • Operate security, disciplinary, complaint, and quality assurance processes and arrangements;
  • Monitor compliance by you with UCL's policies and your other contractual and legal obligations. Please see UCL's Policy on Monitoring Computer and Network Use for further guidance on the monitoring that we may carry out;
  • Monitor your use of our networks to protect the security and integrity of UCL's IT network and information and electronic communications systems. Please see UCL's Policy on Monitoring Computer and Network Use for further guidance on the monitoring that we may carry out; 
  • Allow your achievements via the UCLU to be accredited, for example by inclusion in the Higher Education Achievement Report; and
  • Tell you about the opportunities and support that are available to you, such as funding streams or events.

We may process special category personal data, such as data relating to your health and your religious beliefs for this purpose. For example, we may use disability information to help us make reasonable adjustments to meet your health and welfare requirements.

For all personal data

Performance of a task in the public interest

UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information.

Performance of contract

The processing of your personal data may be necessary in relation to the contract we have entered into with you as a student at UCL.

Vital interests

Your personal data may be processed by UCL and transferred to the emergency services where this is required to protect your vital interests.

Consent

In relation to managing participation at events, where we cannot rely upon public interest or performance of a contract legal bases we will generally seek to obtain your consent to the processing of your personal data.

For special category personal data

Vital interests

Your special category personal data may be processed by UCL and transferred to the emergency services where this is required to protect your vital interests.

Consent

Where we cannot rely upon protecting your vital interests, we will generally seek to obtain your consent to the processing of your special category personal data, e.g. data relating to your health, in this context.

Where we are relying on a legal basis that is not consent or your vital interests in processing your special category personal data, we will inform you of the legal basis before we start processing your special category personal data based on that legal ground.

Internal and statutory reporting and other legal obligations, including compliance with health and safety law and monitoring equality of opportunity or treatment

We will use your personal information to:

  • Comply with our legal obligations. For example, we may process your personal data in the context of arranging and/or providing student accommodation, for the purpose of complying with health and safety and other applicable tenancy and housing legislation;
  • Produce statistics and research for internal and statutory reporting purposes; and
  • Monitor our compliance with our responsibilities under equalities legislation.

This may include the processing of special category personal data, e.g. information about disabilities or ethnicity.

For all personal data

Compliance with a legal obligation

Much of our processing of your personal data in this context will be in order to comply with our legal obligations, e.g. health and safety legislation and UK equal opportunities monitoring.

Performance of a task in the public interest

UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information.

For special category personal data

Equality of opportunity or treatment

We process special category personal data in order to monitor equality of opportunity/treatment.

Fees and funding

We will use your personal information to administer the financial aspects of your relationship with us and any funders/sponsors.

We will not generally process special category personal data or criminal convictions data in this context.

Performance of a task in the public interest

UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information.

Performance of contract

The processing of your personal data may be necessary in relation to the contract we have entered into with you as a student at UCL.

Alumni

Before you graduate, the Office of the Vice Provost (Development) (OVPD) creates an outline record for you from the UCL Student database with name, department, preferred gender, date of birth, "UCL Person ID", Student Number and your UCL email address. This is to enable OVPD to run careers mentoring registration and record touchpoints.

Following your graduation, your personal data will be used by the OVPD to keep you in touch with UCL and the Alumni Network. UCL's role in your education does not stop on graduation and UCL views its Alumni programme as an essential tool in providing you with ongoing educational support. Further details about how OVPD may use your information can be viewed in the separate OVPD data protection statement.

We will not generally process special category personal data or criminal convictions data in this context.

Performance of a task in the public interest

For some of our alumni activities, UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education, research and innovation. Please see our Statement of Tasks in the Public Interest for further information.

Legitimate interests

For some of our alumni activities, we rely upon our legitimate interests in communicating with our alumni as part of the extended UCL community.

Consent

In certain limited circumstances, where we cannot rely upon our legitimate interests or performance of a task in the public interest, we will seek to obtain your consent to the processing of your personal data for our alumni programme.

Please see the separate OVPD data protection statement for further information.

Marketing/publicity materials

While you are at UCL, we may take photographs or videos at an event or while you are participating in student life which may include images of you. These images will generally be used for UCL's marketing/publicity materials.

Legitimate interests

When using your personal data for the purpose of marketing or publicity materials, we will generally rely on our legitimate interests in promoting UCL, including our courses, our activities and our overall aims and objectives.

Research

As an established research institution, we may use your personal information for research purposes.

Performance of a task in the public interest

UCL will be processing personal data in its capacity as a public authority in connection with its core purposes of education or research. Please see our Statement of Tasks in the Public Interest for further information.

For special category personal data and criminal convictions data

Research

We may process special category data and criminal convictions data for the purposes of research.

Please note that where the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, and you do not provide us with the personal data required, UCL may not be able to process your application or provide you with the programme for which you have applied.

We do not generally process your personal data based on your consent (as we can usually rely on another legal basis). Where we do process your personal information based on your consent, you have the right to withdraw your consent at any time. See the "Your Rights" section below.

Third parties with whom we may share your personal data

Your personal data may be disclosed to other organisations as required by law, for crime prevention, investigation or detection purposes or in order to protect your vital interests. Disclosures may also be made by UCL as outlined below:

To UCLU to enable it to manage your student union membership. UCLU will only use this information for running the Union, for example communications regarding your membership rights, including for example, notice of general meetings, referenda and election of trustees, as well as information about the Union's activities;

To sponsors, government agencies and present or potential employers. One such body is the Higher Education Statistics Agency (HESA); further information about the uses for which HESA processes personal data can be found on the HESA website;

Your contact details may also be passed to the Office for Students (OfS) and its agents, including for the purpose of administering the national student survey;

To our agents for the purpose of administering our own surveys;

Where a programme of study leads to a qualification recognised by a professional body we will disclose relevant information to that body (e.g. General Medical Council);

Statements of student status will be provided on request to Council Tax Registration Officers;

To the Student Loans Company;

To debt collection agencies acting on our behalf in the event that you owe money to us;

Release of results to former schools/colleges;

If you decide to make on-line payments to us, limited information (date of birth and student numbers) will be disclosed to our service provider for validation purposes;

To the Office of the Independent Adjudicator (OIA);

To providers of anti-plagiarism software;

As a College of the University of London, we provide student personal data to the University of London for administration of examinations and for the award of degrees;

To NHS services, where necessary  in order to protect your health and welfare;

If you undertake a placement or complete a period of study with a third party organisation or institution in the UK or in another country, personal data relating to you may be shared with the partner organisation/institution for the purposes of administering the placement. Special category personal data relating to your health or a disability will not be shared without your express consent unless required by law or in your vital interests in an emergency situation.

If you apply to attend a graduation ceremony your first name, initials, surname and degree title will be printed in the souvenir programme. It may also appear on some UCL merchandise. You must inform the Student Support and Events Team in writing before the ticket application deadline if you wish to opt out of this (grad_ceremonies@ucl.ac.uk); and

Your basic contact details may be made available through the UCL online staff and student directory, which is publically accessible via the Internet, unless you opt out of this. The process for becoming ex-directory is available on the ISD website.

We use the services of various external service providers to help us run our university efficiently, particularly in relation to our IT systems. Some of these services (such as email hosting and data backups) involve the service provider holding and using your personal data. In each case where we share your information with one of our service providers, the service provider is required to keep it safe and secure. They are also not permitted to use your information for their own purposes.

And if you are an Undergraduate Degree Student:
To GradIntel, the service through which the Higher Education Achievement Record will be delivered;
If you do not complete your programme, to the organisers of the "Back on Course" scheme - the Open University and UCAS; and
From the 2016/17 academic year, we, along with a consortium of other universities, are participating in a 'Learning Gain' project sponsored by HEFCE. Your level of work experience and self-evaluation about how prepared you are for your future career will be passed to HEFCE to allow them to conduct further research into learning gain, including combining with data from similar work at other Universities and Colleges. These data may be linked to other data that they hold about you including prior, current or future educational records and records on earnings and employment. These data will not be used in any way that will affect you personally and any analysis published will take steps to ensure that you cannot be identified from it. If you have any questions about the use of your data for this purpose please email foi@hefce.ac.uk or learninggain@hefce.ac.uk.

For further information on how we manage disclosures to parents and other third parties, including information about what disclosures we make in the case of emergencies, please see our guidance on 'handling confidential information from students'.

Transfers outside the European Economic Area

We display students' UCL email addresses in the UCL online staff and student directory (subject to any opt outs). This directory is publically accessible to Internet users, including those in countries outside the European Economic Area (EEA). Please note that many countries outside the EEA do not have data protection legislation, or have different data protection or privacy regimes, and so may not always protect personal data to the same standard as within the EEA. If you are uncomfortable with this then you should use the opt out from the directory.

There are also many other circumstances in which we may transfer your personal data outside the EEA, e.g. where we use a third party cloud services provider based outside the EEA to store personal data.

Where we transfer your personal information across national boundaries to a third party, such as one of our service providers, we will protect your personal information by ensuring that those transfers are made in compliance with all relevant data protection laws. Generally, this means where we transfer your personal information to a third party that is located in a country which does not have adequate privacy protection, we will put in place a contract with the third party that includes the standard international data transfer contractual terms approved by the European Commission. For further information on the measures in place, please contact us using the details set out in the 'Who do I contact with questions?' section below.

Principles

When processing your personal data, UCL is required by relevant data protection laws to comply with the following principles.

PrinciplePersonal Data shall be:
Lawfulness, fairness and transparencyprocessed lawfully, fairly and in a transparent manner in relation to the data subject.
Purpose limitationcollected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
Data minimisationadequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
Accuracyaccurate and, where necessary, kept up to date.
Storage limitationkept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
Integrity and confidentialityprocessed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

In accordance with the separate 'Accountability' principle under relevant data protection laws, UCL must also be able to demonstrate compliance with each of the above principles.

Retention periods

Your personal data will be retained in accordance with UCL’s central Data Retention Schedule. After you leave UCL certain parts of your data may be retained as a permanent archival record for research purposes and to confirm your award and period of study.

Your rights

Subject to certain conditions, you have the following rights in relation to your personal data:

Right 1: A right to access personal data held by us about you (please see section entitled "How can I access my personal information" below).

Right 2: A right to require us to rectify any inaccurate personal data held by us about you.

Right 3: A right to require us to erase personal data held by us about you.  This right will only apply where, for example, we no longer need to use the personal data to achieve the purpose we collected it for; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with Right 6 below).

Right 4: A right to restrict our processing of personal data held by us about you.  This right will only apply where, for example, you dispute the accuracy of the personal data held by us; or where you would have the right to require us to erase the personal data but would prefer that our processing is restricted instead; or where we no longer need to use the personal data to achieve the purpose we collected it for, but we require the data for the purposes of dealing with legal claims.

Right 5: A right to receive personal data which you have provided to us in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal data to another organisation.

Right 6: A right to object to our processing of personal data held by us about you.

Right 7: A right to withdraw your consent where we are relying on it to use your personal data. Note that a withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Right 8: A right to ask us not to use information about you in a way that allows computers to make decisions about you and ask us to stop.

In certain circumstances, we may need to restrict your rights in order to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege).

Keeping personal data up-to-date

Data protection law requires us to take reasonable steps to ensure that any personal data we process is accurate and up-to-date. Please help us to do this by advising us of any changes to your personal data.

How can I access my personal data?

As noted above, you have the right to access information held about you. Details are set out on the University's Data Protection policy  Your right of access can be exercised at any time by contacting us or Data Protection Officer, UCL Gower Street, London WC1E 6BT. 

Automated processing

UCL does not use automated processing and decision making without manual intervention.

Who regulates the use of my personal information?

The University maintains a data protection registration with the Information Commissioner's Office, the independent authority which oversees compliance with the Data Protection Laws. The University's registration number is Z6364106 and sets out, in very general terms, the full range of purposes for which we use student, staff and all other personal information. Please see the Information Commissioner's Office website for details.

Who do I contact with questions?

If you have any questions about your personal data and UCL that are not answered by this privacy notice then please consult UCL's data protection web pages, where further guidance and relevant UCL policy documentation can be found.

If you need further assistance, please contact UCL's Data Protection Officer: data-protection@ucl.ac.uk or Data Protection Officer, UCL Gower Street, London WC1E 6BT.

If we are unable to adequately address any concerns you may have about the way in which we use your data, you have the right to lodge a formal complaint with the data protection authority in your country or our main data protection regulator, the Information Commissioner's Office. Full details may be accessed on the complaints section of the Information Commissioner's Office website.