What is Data Protection?
Falmouth University is committed to meeting its responsibilities to current and former students under the Data Protection Act, General Data Protection Regulation and related legislation such as the Human Rights Act. Falmouth University's Data Protection Policy at www.falmouth.ac.uk/dataprotection specifies the steps which Falmouth University is taking to meet its Data Protection obligations, and is binding on all staff and students.
This statement is designed to highlight the areas of Data Protection which are of particular concern to students, and to help students understand how information about them will be used. It applies to all students regardless of age, so if you are under 18 you will be treated in the same way as students who are over 18 for Data Protection purposes.
While you are a student at Falmouth University and after you cease to be a student, Falmouth University needs to collect, store, use and disclose certain data about you. We require this information for our normal business purposes, such as services to applicants, current students and alumni. If you do not provide any information requested, you may not be able to confirm your enrolment as a student at the University.
Falmouth University is the 'controller' of this information. The University's Information Officer is the institution's Data Protection Officer and can be contacted at firstname.lastname@example.org The University's contact details are listed below.
Penryn Campus: Falmouth University, Penryn Campus, Treliever Road, Penryn, Cornwall, TR10 9FE, 01326 370400
Falmouth Campus: Falmouth University, Falmouth Campus, Woodlane, Falmouth, Cornwall, 01326 211077
When we process data about you, we have to observe the requirements of the Data Protection Act and from 25 May 2018 the requirements of the General Data Protection Regulation.
Under the General Data Protection Regulation our legal bases for processing this information about you as a student will be that processing is necessary:
- "For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller." This means the information is needed for the delivery and administration of your studies at the University.
- "For compliance with a legal obligation." This means the University is legally required to share some information about you, for example with the Higher Education Statistics Agency (HESA) or the UK Border Agency if you require a visa to enter the UK. More information on this is covered in section 4 below.
- "To protect the vital interests of a data subject or another person." This means that in some rare circumstances it may be necessary to share information about you, for example to the emergency services.
If you go on to be an alumna or alumnus of the University the legal basis for continuing to process your personal information would then be:
- "Necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject." This means it is reasonable to expect that the University would contact you once you have finished your studies. You can find out more about this in section 8 below.
- The Data Protection Act established a framework within which information about living individuals can be legally gathered, stored, used and disseminated. At its core are eight Data Protection Principles which Falmouth University and other organisations must abide by. These specify that personal information must be:
- Processed fairly and lawfully, and only if certain conditions are met
- Obtained for specified and lawful purposes, and not used for purposes other than those for which it was gathered
- Adequate, relevant and not excessive
- Accurate and where necessary kept up to date
- Kept for no longer than necessary
- Processed in accordance with individuals' rights
- Kept secure
- Not transferred outside the European Economic Area unless certain conditions are met
The General Data Protection Regulation builds on these requirements and states that from 25 May 2018 personal information must be:
a) processed lawfully, fairly and in a transparent manner in relation to individuals;
b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals;
f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
The General Data Protection Regulation also requires that:
- "the controller shall be responsible for, and be able to demonstrate, compliance with the principles."
These protections apply to information in electronic form and also many types of data in paper form. Further information about the Data Protection Act and the General Data Protection Regulation is available from the Information Commissioner's Office at www.ico.org.uk, an independent body that monitors compliance.
What information does Falmouth University hold about me?
Falmouth University will collect data about you in the course of our dealings with you as a current or former student, for example when you apply, when you enrol, and as you progress through your course. We may also receive data about you from outside Falmouth University, such as information from UCAS relating to undergraduates' UCAS applications and information supplied by referees. Data about you will be gathered and held in both digital and paper form.
If you are a current or former student, examples of the data which Falmouth University may hold about you include:
- Your name
- Your contact details
- Details of your emergency contacts
- Your date of birth
- Your nationality
- Your ethnic origins
- Your gender identity
- Any disabilities which you have disclosed to us
- A digital photograph used to produce your student ID, and for security and identification purposes
- Medical information, such as information held by Student Services
Course related data:
- Information from your application process
- Your academic background and qualifications
- Your academic record while at Falmouth University
- Details of any degrees which you are awarded
- Fee information
- Bursary or sponsorship details
- Any disciplinary action taken against you
- Information relating to any academic appeals or complaints raised by you
- Attendance warnings issued to you
- Official letters requested by you during your studies, for example Council Tax exemption
- Your use of Falmouth University's facilities, such as the Library
- Online identifiers, such as your Falmouth University username that is used to access our systems
Some of this information, such as your ethnic origins, medical information and information about disabilities, is classed as "sensitive" personal data under the Data Protection Act. Under the General Data Protection Regulation sensitive data covers information consisting of racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person's sex life or sexual orientation. Sensitive personal data is subject to extra legal protection and we have to meet an additional set of conditions in order use the data fairly and lawfully.
Sensitive data about you, for example relating to your health, may be shared with restricted departments within the University to ensure that you have access to appropriate services and support. Sensitive personal data may also be used to monitor equality of opportunity and access to higher education, but will not be used to make decisions about you. For further information about sensitive personal data, see the University's Data Protection Policy at www.falmouth.ac.uk/dataprotection
How will my data be used?
By commencing or enrolling as a Falmouth University student, you agree to Falmouth University collecting, storing, using and otherwise processing data, including sensitive personal data, about you for any purposes connected with your studies and your health and safety while you are a student. We will also use your data for certain legitimate purposes after you cease to be student, see section 8 below for further information on this.
Falmouth University will only use your data fairly and lawfully in accordance with our obligations under the Data Protection Act or the General Data Protection Regulation. This means that we will process your data in a way which respects the Data Protection Principles set down and your rights under the Act or Regulation. Under the current Data Protection Act, any use by Falmouth University of your data must also be covered by our registration with the Information Commissioner. This is available on the Information Commissioner's Office website, www.ico.org.uk, and describes in a general way how we process personal data about students and other individuals.
The Data Protection Act and the General Data Protection Regulation require us to keep your data secure. This means that your confidentiality will be respected and all appropriate measures will be taken to prevent unauthorised disclosure. Only members of staff who need access to relevant parts or all of your data will be authorised to do so. Information about you in electronic form will be subject to password and other security restrictions, while paper files will be stored in secure areas with controlled access.
Although it is not possible to state every individual purpose for which your information will be used, the following are examples of how it is likely to be used while you are a student:
- To administer and support your studies and record academic achievements, e.g. your course choices, attendance, assessments and the publication of any graduation programmes
- To assist in pastoral and welfare needs, e.g. the counselling service and services to students with disabilities
- To administer financial aspects of your registration as a student, e.g. payment of fees, debt collection
- To manage course facilities, such as computing facilities and the Library
- To produce management statistics and to conduct research into the effectiveness of our courses
- To monitor our equal opportunities policies, e.g. compliance with the Race Relations Act
- To administer employment processes, if you choose to work for Falmouth University
- For security and disciplinary purposes
- For internal and external audits and quality assurance exercises
- For alumni relations purposes
We may also disclose your data to certain outside organisations, please see section 4 for more information on this.
We may use copies of the data, including sensitive personal data, which we hold about you for the purpose of testing our IT systems. If your data is used for system testing, it will be copied to a test environment and used with data on other students to test changes to our IT systems in a realistic way. This is done to ensure that changes will be effective and will not cause loss or damage to data. The data about you which we hold in our live systems will not be affected. Your data will not be kept in the test environment for longer than is necessary for testing purposes. Data in that environment will not be used for purposes other than testing. We will also apply appropriate security precautions to the data.
Who receives my data?
Falmouth University will only disclose information about you with your consent, or where disclosure without your consent is required or permitted by law. This section outlines the major organisations and the most common circumstances in which we disclose data about students.
If this disclosure involves the transfer of your data outside the European Economic Area (EEA), we will inform you of this in advance, along with information about the safeguards in place. The data will only be transferred outside the EEA if one of the conditions set down in the Data Protection Act has been met, or in compliance with the conditions of transfer outlined in the General Data Protection Regulation.
Your data may also be sent to different departments within Falmouth University where this is necessary for our day to day administration. If you are a student with a partner organisation, any information you share with Falmouth University will also be shared with the partner organisation.
Higher Education Statistics Agency (HESA)
Falmouth University is usually required to send some of the information which we collect about students to HESA, where it forms part of the student's HESA record.
If your data is supplied to HESA, HESA may then pass all or some of the data to various government departments and agencies to enable them to carry out their statutory functions. These bodies and HESA will mainly use your data to produce anonymised statistics. Your contact details will not be passed to HESA and recipients of HESA data will not be able to contact you. HESA and the recipients of HESA data will also take precautions to reduce the risk that you may be identified from information which is published and released. Further information and links to the HESA website are available on the Falmouth University website www.falmouth.ac.uk/hesa-notices.
If you are an undergraduate or postgraduate student, about six months after you complete your programme the Employability Service will contact you about HESA's Destinations of Leavers from Higher Education (DLHE) questionnaire, or Graduate Outcomes Record from 2018. For more information about this, please see https://www.falmouth.ac.uk/DLHE-survey-information. To opt out, please contact the Employability Service at email@example.com.
The Employability Service will receive data about you from Falmouth University for the purpose of carrying out the DLHE/Graduate Outcomes Record and for other purposes connected with operating the Employability Service. The Employability Service also receives certain data about you from HESA if you have a HESA record.
National Students Survey (NSS)
The NSS is an annual survey of undergraduate students who are in the final stages of their programmes of study. It is designed to gather students' views on the quality of the teaching, assessment and support which they have experienced. This information is used to produce statistics and provide summary feedback to individual institutions and student unions. The survey has been commissioned by the Higher Education Funding Council for England (HEFCE) in association with other funding councils.
If you are eligible for the NSS, Falmouth University will pass your contact details to HEFCE or the organisation which has been contracted by HEFCE to carry out the survey, unless you tell us that you do not wish to participate. To opt out of the NSS, please contact Falmouth University's Information Officer at firstname.lastname@example.org.
Sponsors and funding bodies
Falmouth University will send data relating to you to sponsors and funding bodies where we are required to do so by law or where you have consented to the transfer of data, e.g. in the contract between you and the funding organisation. For example, we have a statutory duty to disclose data to the Student Loans Company and to local education authorities for students eligible for fee and loan payments. Where students are in receipt of a US Federal loan, Falmouth University may be required to release personal data pertinent to the loan to relevant parties as required by the US Department of Education. Students receiving such loans have to sign a statement, on the Master Promissory Note, consenting to the release of such information.
In other cases, Falmouth University will not release data about you to bodies or individuals who have funded your education, such as your parents or employer, unless you tell us that we can do so.
If your course involves spending a period of time at an institution outside Falmouth University, or you have come to Falmouth University as a visiting, exchange or junior year abroad student, we may need to share information about you with the other institutions involved in the exchange, within or outside the European Economic Area. This will be done for the administration of the visit, exchange or study abroad and so that the other institution can carry out its duties in regard to your studies. If you are involved in a visit, exchange or study abroad, you agree to Falmouth University transferring data about you as necessary for purposes connected with your studies.
Details of successful degree candidates are included in programmes and other information connected with graduation ceremonies. If you do not want your information to be made available in this way, please contact Student Administration at email@example.com.
In order to facilitate gown hire for graduation ceremonies, your student number, name, Falmouth email address and graduation ceremony details will be shared securely with the gown hire provider. If you do not wish this information to be shared, please contact firstname.lastname@example.org. Please note that if your information is not shared with the gown hire provider you may find it more difficult to order a gown for your graduation ceremony.
References and confirmation of qualifications
Falmouth University may release data about you in response to a request for a reference or for confirmation of your qualifications.
The FXU Students' Union
Falmouth & Exeter Students' Union (FXU) is the students' union at Falmouth University and University of Exeter (Cornwall campuses).
As covered by the 1994 Education Act, at the point of registration students automatically become a member of the FXU. Sharing certain basic information helps the Union provide membership services to you and other FXU students as efficiently as possible. This membership provides you with rights, such as having a say in what FXU does and how FXU works, as well as full access to the range of support, advice, representation, entertainment and other activities.
When FXU receives your data, the information is transferred securely by FXU to the Students' Union's website provider (MSL) and is used to pre-register you with the Students' Union. This means you don't need to re-enter this information when registering on the Students' Union website.
Under the 1994 Education Act, all students also have the right not to be a member of their students' union. If you wish to exercise this right, please email the FXU Chief Executive on email@example.com or contact Falmouth University's Information Officer at firstname.lastname@example.org.
The Students' Union is separately responsible under the Data Protection Act and the General Data Protection Regulation for the processing of data relating to its members. FXU and the Students' Union have an appropriate data sharing agreement in place with Falmouth University. For more information please see https://www.fxu.org.uk/tac/membershipdata/ and https://www.fxu.org.uk/tac/datasharing/.
UK Border Agency
This section applies to students who require a visa to enter the UK to study at Falmouth University.
To assist in preventing immigration fraud, Falmouth University is required to report to the UK Border Agency, www.bia.homeoffice.gov.uk, details of students subject to immigration control who fail to enrol, who discontinue their studies or who fail to maintain contact with Falmouth University. We may also be required to provide the Border Agency with other information about students. From time to time, Falmouth University also receives enquiries from UK immigration officials regarding the status of applicants or students, e.g. to check whether an offer of a place has been made or whether a student has enrolled.
Falmouth University will normally provide information about applicants and students when requested to do so by UK immigration officials. Failure to do so, in some cases, could lead to the University's removal from the list of institutions approved to receive overseas students. We will maintain the records about students, e.g. attendance, which we are required to maintain to meet the Border Agency's requirements.
Examples of some of the other situations in which we may disclose information about you include:
- Disclosure to law enforcement agencies, where necessary for crime prevention or detection
- Disclosure to local authorities, for purposes connected with electoral registration, council tax or the investigation of benefit fraud
- Disclosure to the Quality Assurance Agency, during institutional audits and other quality assessment exercises
- If you leave Falmouth University owing money to the University, we may at our discretion pass this information to a debt collection agency
- We may disclose information for the purpose of verifying data about you held by Falmouth University, held by another higher education institution, or held by government agencies
- We may disclose information if there are concerns regarding student vulnerability and susceptibility to radicalisation as part of our responsibilities under the Counter Terrorism and Security Act 2015
What are my rights?
You have a number of rights under the Data Protection Act in respect of the information which Falmouth University holds about you and how we can use that information. These include:
- The right to prevent us from using your data for direct marketing purposes
- The right to prevent us from processing your data in a way which causes or is likely to cause you substantial damage or distress. You can do this by serving us with a notice under section 10 of the Data Protection Act. However, we may refuse to accept such a notice in certain circumstances, for example if doing so would prevent us from processing data which is necessary for your enrolment as a student
- The right to require us to correct, erase or destroy inaccurate data
- The right to get access to the data which we hold about you
From 25 May 2018 your rights under the General Data Protection Regulation include:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling.
For further information on how to exercise these rights, please contact the University's Information Officer at email@example.com.
You also have the right to lodge a complaint with the Information Commissioner's Office if you have any concerns about the way the University handles your personal information. Please refer to https://ico.org.uk/for-the-public/ for further information on this.
What are my responsibilities?
Falmouth University will make every reasonable effort to keep your details up to date. However, it is your responsibility to provide us with accurate information about yourself when you apply and when you enrol. It is also your responsibility to let us know of any subsequent changes to your details, such as changes to your name or address – see section 9 below. Any information which you supply to Falmouth University about your emergency contacts will only be used in an emergency and will only be disclosed in your immediate health or safety interests. By enrolling, you agree to inform your emergency contacts that their data are being held by Falmouth University for these purposes. It is very important that you notify Falmouth University of any changes to your emergency contacts.
All Falmouth University staff and students must abide by the University's Data Protection Policy when handling personal data for which Falmouth University is responsible. This is most likely to happen if you choose to work for Falmouth University while studying here. However, very occasionally, students may use personal data for which Falmouth University is responsible in the course of their study or research. See the Data Protection Policy at www.falmouth.ac.uk/dataprotection for further information.
What if I need a reference/confirmation of qualifications?
Academic institutions and employers may seek confirmation of the qualifications which Falmouth University graduates claim to hold. If you have received a Falmouth University degree, the University will normally confirm your qualifications, but not the fact that you have failed an award, in response to a genuine request from an employer or another academic institution. Before responding to the request we may seek a signed form of authority from you if the request is from a third party. We will not respond if you have told us not to do so or we have reason to believe that the request is not legitimate. If you do not want us to provide confirmation of your qualifications, please contact Student Administration at firstname.lastname@example.org.
Where you have provided the name of a member of staff as a referee, we will assume that this means that you have given your consent for the disclosure of personal information in the form of a reference. You should ensure that any Falmouth University staff whom you wish to cite as referees are aware that they may receive reference requests for you and have agreed to provide you with a reference. Failure to do so could delay our response to a request if we need to check that a request is legitimate.
8 What happens after I finish/graduate?
After you leave Falmouth University we will continue to hold data about you in digital and paper form. Some information, such as your dates of attendance and your degree, will be retained permanently. Other data will be disposed of from time to time in accordance with the University's data retention policies. For example:
- Data relating to your application – retained for 6 years after you leave the university
- Anonymised records which don't identify you which are used for data analyses purposes – retained indefinitely
- Records relating to applications for Extenuating Circumstances – retained for 1 year after the end of the academic year in which the application is made
- Data relating to your assessment and degree outcome – retained indefinitely to be able to provide academic transcripts
By enrolling as a Falmouth University student, you agree to Falmouth University processing data relating to you after you leave Falmouth University for any purposes connected with your studies, your status as a former student and for other legitimate reasons.
Examples of how we may use your data after you finish or graduate include:
- To provide evidence of your academic achievements when requested to do so: e.g. transcripts, confirmation of qualifications and references
- To provide information to regulatory bodies and other agencies to whom we are legally required to supply data
- To produce management statistics
- To maintain contact with you as a Falmouth University alumnus/alumna
- For audit and quality assurance purposes
We may contact you for a limited range of research purposes after you leave Falmouth University.
We may contact you on other occasions to carry out surveys which we are required to conduct by HESA, HEFCE or other official agencies. We may also contact you to carry out our own research into your experiences at Falmouth University and after leaving the University, in order to evaluate the effectiveness of our courses and improve our services to students. If you do not want to be contacted for these purposes, please notify the Information Officer at email@example.com.
Falmouth University graduates automatically become members of the Falmouth University Alumni Network as the University would like to stay in contact with you. As a Falmouth University graduate you can also join our exclusive alumni-only website, Falmouth Connect www.falmouthconnect.com. For further information about this service or to opt out of the Alumni Network, please see the Alumni section of our website www.falmouth.ac.uk/alumni or contact firstname.lastname@example.org.
What if my details change?
If you are a current student, you can update your own details at http://myfalmouth.falmouth.ac.uk
If you are an alumnus/alumna, you can register changes of address and other details by contacting the Alumni Office by email at email@example.com
Can I get access to my data?
Current or former undergraduate or postgraduate students can get a transcript of their academic results by contacting Student Administration. To get access to other data which Falmouth University holds about you, you should submit a subject access request under the Data Protection Act or General Data Protection Regulation. This involves completing our Subject Access Request form and sending it with proof of ID to the Information Officer. Until 25 May 2018 and the introduction of the General Data Protection Regulation, this should also be accompanied with a £10 fee. For further information on how to submit a request and the form which you need to use, please refer to the Data Protection section of the website www.falmouth.ac.uk/dataprotection.
Where can I get advice/further information?
The Information Officer is responsible for Falmouth University's compliance with Data Protection regulations and can provide general advice on Data Protection issues. The Information Officer can be contacted by email at firstname.lastname@example.org, or by writing to: Information Officer, Falmouth University, Falmouth Campus, Woodlane, Falmouth, Cornwall, TR11 4RH, United Kingdom. For assistance on more specific issues, please contact the departments below:
Your student record or your academic record: please contact Student Administration by email at email@example.com
Alumni enquiries, including changes of address for alumni: please contact the Alumni Office by email at firstname.lastname@example.org
Computing accounts/usage of facilities: please contact the IT Service Desk by email at email@example.com
Library usage/membership: please contact the Library's membership desk by email at firstname.lastname@example.org