Right to Be Informed

The University must provide ‘privacy notices’ to individuals describing the information the University collects about them.

In principle, the information must be provided in writing (e.g. via a privacy notice) and where appropriate by electronic means (for example through our website).

The privacy notice must be made available either when we collect information about them (if collected directly) or at the earliest opportunity (if collected via a third party).

A privacy notice must contain the following information:

Additional Information

If the University envisages to further process personal data for a purpose other than the purposes for which it is initially collected, the University must provide the data subject information on such purpose(s) together with any other relevant information, prior to the further processing takes place.

If personal data is collected directly from the data subject, the information obligations do not apply if the data subject already has the information – privacy notice only has to be provided once).

If personal data is not collected directly from the data subject, the information obligations do not apply if:

a) the data subject already has the information;

b) the provision of information is impossible or requires a disproportionate effort, provided that the controller takes appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including by making the information publicly available;

c) if there is an EU or Member State law obligation to obtain/disclose the personal data and which provides appropriate measure to protect the data subject’s legitimate interests; or

d) if the personal data must remain confidential pursuant to an obligation of professional secrecy regulated by EU or Member State law (e.g. legal or physician-patient privilege).

There are statutory timescales for providing privacy notices to individuals:

Information to be provided when personal data are collected from the data subject

The information should be given to the data subject at the time of collection from the data subject.

Information to be provided when personal data are not collected directly from the data subject

The information must be given to the data subject:

• within a reasonable period of having obtained the personal data (maximum one month);

• if the data is to be used to communicate with the data subject, at the latest when the first communication takes place; or

• if disclosure to another recipient is envisaged, at the latest, before the personal data is disclosed.

• The University must identify all personal data processing activates that we conduct and identify the legal basis for processing data for those activities.

• We must then ensure that appropriate Privacy Notices are in place to inform the relevant data subjects (Staff. Students, business contacts etc) as these will be used fulfil the requirement to inform.

• This may require new privacy notices to be created for new processing areas or data subjects

• The University must review on an annual basis (or sooner if required) to ensure that privacy notices remain accurate and up to date.

If personal data is collected directly from the data subject, the information obligations do not apply if the data subject already has the information – privacy notice only has to be provided once).

If personal data is not collected directly from the data subject, the information obligations do not apply if:

a) the data subject already has the information;

b) the provision of information is impossible or requires a disproportionate effort, provided that the controller takes appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including by making the information publicly available;

c) if there is an EU or Member State law obligation to obtain/disclose the personal data and which provides appropriate measure to protect the data subject’s legitimate interests; or

d) if the personal data must remain confidential pursuant to an obligation of professional secrecy regulated by EU or Member State law (e.g. legal or physician-patient privilege).

Failure to provide accurate privacy notices to individuals would mean that the individuals can request the ICO to undertake the judicial review of our actions:

• If the ICO finds again the University, this may result in a fine or a requirement to undertake corrective actions.