Privacy notice for students

This is our privacy notice for past, present and prospective students of City, University of London.

This privacy notice explains how City, University of London (City) collects, uses and shares your personal data, and your rights in relation to any of your personal data that City holds. This privacy notice concerns City’s processing of personal data of past, present and prospective students of City.

City is a data controller in terms of the Data Protection Act 1998 and the General Data Protection Regulations (GDPR) which came into effect on the 25^th May 2018. City is registered with the Information Commissioner’s Office (ICO) with the registration number Z8947127.

How City collects your information

Information about you will be collected by City in a number of ways:

• When you apply or register to study at City we will collect data to allow us to administer your studies. If you have applied via the Universities and Colleges Admissions Service (UCAS) they will share your information with us.
• If you express an interest in City we will ask you to provide us with some information so we can communicate with you effectively.
• In various other ways during the course of your studies, for example, when you interact with City services.
• City may, at times, ask third parties for information about you such as your sixth form college, funder or employer.

Information City collects

City may collect the following types of personal data about you:

• Your name and contact information such as address, email address and telephone number, as well as your date of birth and your passport number, country of domicile and your nationality. City also processes and stores CCTV footage for security and safety. For further information, please read our CCTV Policy.
• Information relating to your education and employment history including where you have worked, dates of study and examination results.
• Records relating to assessments of your work, details of examinations taken, your examination grades, personal tutor meetings, attendance records and other information in your student record.
• Sensitive personal data or special category data:
  • health and medical conditions
  • certain criminal convictions
  • racial or ethnic origin
  • religion or similar beliefs
  • sexual orientation.

How City uses your information

City uses your information to:

• administer your studies
• give access to and ensure the security of City Facilities (Buildings, Libraries and IT)
• provide student support services (careers, learning support and Students’ Union)
• carry out legal duties, providing information to others (Local Councils, Transport for London)
• provide other activities within City’s business including developing and maintaining our alumni programme
• conduct equal opportunities monitoring and equality impact assessments using your ‘Protected Characteristic data’.

The legal basis for processing your information

City relies on several different legal basis depending on the processing being performed:

(Article 6(1)(a)), Consent – on specific occasions City will only process certain data if you consent e.g. on registration you only need to provide certain “special categories” of data if you agree to that.

(Article 6 (1)(b)), necessary for the performance of your student contract – on many occasions City will process your data to enable it to meet its commitments to you e.g. those relating to education and assessment.

(Article 6 (1)(c)), necessary to comply with a legal obligation – City may have legal obligations to provide your personal data to others e.g. HESA.

(Article 6 (1)(d)), for the purpose of protecting the vital interest of yourself or another – sometimes in extreme circumstances City will have to release information to protect your interests or the interests of others e.g. in medical emergencies.

(Article 6 (1)(e)), processing necessary for the performance of a task carried in the public interest – City is an educational and research establishment and in particular its educational and research activity is conducted in a public interest (including your interest and the interest of others).

(Article 6 (1)(f)), processing is necessary for the purposes of the legitimate interest of City or a third party subject to overridden interests of the data subject – the University (and sometimes third parties) has a broad legitimate interest in activities that connect to the activities and education of students. Subject to those interests not being overridden by the interests of fundamental rights and freedoms of students, it will pursue those interests. A good example of this legitimate interest would be Alumni activities.

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which it is collected.

Others City shares your information with

Where necessary City will disclose, outside the institution, relevant items of your personal data as set out below.

• Sponsors or funding organisations (including the Student Loans Company) where a contract exists, in accordance with the terms of the contract (which usually relate to attendance and progress reports).This does not include third parties (such as parents) who may be paying for your studies but with whom no formal contract exists.
• Professional bodies (e.g. Law Society, Nursing and Midwifery Council).
• For the purposes of confirming your qualifications and the accreditation of your course.
• NHS Trusts in England and Wales where this is necessary for the purposes of your study.
• Work Placement sites or other educational partners involved in joint course provision where this is necessary for the purposes of your study.
• The Office for Students (OfS) and its agents, such as the Higher Education Statistics Agency (HESA) and the Quality Assurance Agency. You are also advised to refer to the collection notices on the HESA website for further details.
• Potential employers or providers of education whom you have approached for the purposes of confirming your qualifications.
• Local Government Departments, including Council Tax, Electoral Services and Transport for London for the purpose of assessing and collecting Council Tax and or supporting your registration to vote in elections.
• UK Agencies with duties relating to the prevention and detection of crime, apprehension and prosecution of offenders, collection of a tax or duty, or safeguarding national security.
  For example: Benefit or Tax Inspectors, the Police, the UK Border Agency (UKBA) or the Foreign and Commonwealth Office, as necessary, and with consideration of your rights and freedoms.
• The University of London for the purposes of allowing you access to shared facilities.
• The Students Union to provide support services for students.
• Foundation course partners for the administration of those courses.
• Providers supplying learning analytics services (Jisc) to support students in their studies.

In addition City employs the services of various suppliers and agents as data processors. In each case your information will only be shared with these third parties in accordance with the data protection principles.

Data retention

City retains personal information it collects from you where there is an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

When there is no ongoing legitimate business need to process your personal information, City will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then City will securely store your personal information and isolate it from any further processing until deletion is possible.

Your rights

You have rights to your personal data held by City as set out in the GDPR. These include:

• Rights to access your personal data to be provided by City within one calendar month – known as a Subject Access Requests (Article 15). This includes information on:
  • A description of your data
  • The Recipients of your data
  • A copy of your data.
• Rights to rectification and erasure. You have the right to correct any inaccurate personal data held by City. Once information City has collected is no longer necessary for the purpose for which it was collected and processed, you sometimes have the right to have your data erased.
• Rights to restriction of processing.
  • You sometimes have the right to restrict the processing of your personal data or object to the processing of your data.
  • If you wish to withdraw consent for the processing of your personal data or otherwise restrict or object to the processing of your personal data please contact the Information Compliance Team.
• Rights to data portability. You have the right to receive your personal data City holds in a structured, commonly used and machine-readable format and have the right to transmit that data to another controller without hindrance from City.

Changes to this notice

City may amend this privacy notice and will occasionally update to reflect customer feedback and enhance its accessibility.

In that case, City will post notice of the change on its website and you will be deemed to have accepted such changes.

City encourages you to periodically review this notice to be informed of how the institution is protecting your privacy.

Contact details

As a public body, City has appointed Dr Emma White as the Data Protection Officer (DPO). Should you have any concerns about your personal data at City please contact the DPO by email.

Additional guidance can be sought from the Information Governance team by telephone +44 0)20 70 40 4000 or email dataprotection@city.ac.uk.