Guidance for staff who receive an enquiry from the police or other agency requesting the University shares personal data about a student or staff membe The Police or other agencies such as the Department for Work and Pensions (DWP) or HMRC may contact staff with requests to share information about identifiable living individuals. Staff members should: Not confirm or deny any information about any individual student on the spot. Confirm the enquirer is who they say they are. Beaware there are people who will try to "blag" personal information about individuals. Ask for the enquiry to be provided to the University in writing. If the enquiry comes from the Police they should provide a form citing Data Protection Act 2018 – Schedule 2, Part 1(2) counter signed by a senior officer (the form must have a wet signature). Please note, however, that this only applies while the investigation is still ongoing. If the police ask for somebody’s personal data with a warrant for an arrest and show you the required paperwork, then you must comply. Note that this situation will likely only occur in out-of-hours times in Student Accommodation: if the Police do not have a counter signed Schedule 2, Part 1(2) form and claim urgency, you must insist that they fill in the the University's Emergency Form for the Disclosure of Personal Data and sign the form. A senior staff member will then decide whether to release the data or not. A paper copy of the Form should be available to all frontline staff members. In all situations, if the Police have no counter-signed Schedule 2, Part 1(2) form and cannot provide evidence for the urgency of the situation, then you should not comply with their request. Emergency form for the disclosure of personal data: University log-in required Direct the request to the Director or Head of Service responsible for the requested information. Responsibilities for student data These are the key staff who are responsible for decision making Type of information Name of Director Student or staff use of University computing equipment or login details Director of IT Infrastructure Student or staff library use / borrowing history / library fines Director of Library User Services Student’s status / centrally held academic records Academic Registrar Datasets about groups of students Academic Registrar Information held only by the student’s school Head of School Student's Counselling service use Director of Student Counselling Service The Director or Head of Service's responsibilities The Director or Head of Service must: decide whether to disclose the information consider whether the student or staff member should be told about disclosure make sure the request is answered in an appropriate way Guidance for decision makers is available from Data Protection Officer (dpo@ed.ac.uk), who may involve Legal Services where appropriate. This article was published on 2023-11-09
