Data Protection

Data Protection covers personal data. It determines how we collect it, process it, store it and share it.

Requesting information about yourself

Making requests

You can request information about yourself by contacting the School's Data Protection Officer.

You will be sent a subject access request form and will need to send it back to the Data Protection Officer. You will need to include:

  • the form.
  • a £10 fee. This can be either a cheque or money order. If you are outside the UK, it is possible to arrange for the fee to be directly transferred into the School's bank account. You will need to make it clear to the Data Protection Officer if this is how you need to pay. Unfortunately, the Data Protection Officer is not set up to take debit or credit cards.
  • proof of ID. A photocopy of a student card, staff card or passport will do, but there may be times when it will be necessary to see the originals

Once all three of these things have been received, the School has 40 days from the date of receipt to respond with what information we have that meets your request.

If you want to request that information about you is updated, changed or deleted, please contact the School's Data Protection Officer at glpd.info.rights@lse.ac.uk

The School has 21 days in which to confirm changes or explain why we can't make the changes requested. 

Requesting exam marks and comments

Before making a request to access exam-related data that are not routinely released by the School, please be advised of the following:

  • all data/comments are provided without interpretation or explanation;
  • data/comments cannot be used to negotiate a final mark(s) and/or challenge the academic judgement of any examiner(s), and are therefore inadmissible as grounds for appeal;
  • as examiners are not required to agree marks at the sub-component (e.g. question) level, individual examiner sub-component marks may not obviously correspond to the agreed final overall mark for the component (e.g. exam, essay);
  • if any comments have been written, their purpose will have been to assist the examiners in the marking process and not to provide a commentary on an individual's performance;
  • departments are only required to retain exam-related data for 1-month after the despatch of official transcripts.

When requesting exam marks and comments, tick the box b) in section 4 to ensure that is what is looked for.

Please note that not all departments require examiners to keep or make detailed comments about the examination scripts.  In some departments, only final marks are available. Please note also that scripts are exempt from release and it is the School's policy not to release them.

Examination scripts are kept for a year after the exam results are posted. 

Requesting information relating to grievances

Information relating to grievances that you are involved in can be requested, but you will only receive the parts of the information that relate to you. If a word, sentence, paragraph or document relates to another person, this will be removed from the material before it is given to you.

If you have a complaint about the way your request is handled

If you have a complaint about the way you request has been handled, you can contact Kevin Haynes, K.j.haynes@lse.ac.uk Head of Legal and Compliance and ask for a review. This is not required under the Data Protection Act, but it is something the School offers.

You can also contact the information commissioner's office directly. The Information Commissioner oversees compliance with the Data Protection Act and will investigate your complaint. 

 

Data protection

What is Data Protection?

The purpose of the 1998 Data Protection Act (DPA) is to regulate "the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information" by 'Data Controllers', like LSE.

In other words, it requires us to process, store and use your personal information in a way that is fair, proportionate, secure and justified. We uphold this commitment by adhering to the eight principles of Data Protection.

The General Data Protection Regulation will be replacing the DPA in May 2018 and the School is working towards meeting the new requirements in the Regulation.

Taking photographs

Photographs of both students and staff are considered personal information under the Data Protection Act and the data protection principles apply to them. When taking or asking for photographs, staff need to keep the following in mind:

  • Photos should only be taken or asked for when necessary.
  • The subject of the photo should be told where the photo will be used.
  • People should be given a chance to opt out when a photograph is taken. 

Getting permissions for photographs

Photographs are not sensitive personal data as defined by the Data Protection Act, but they are a very easy means by which to identify a person. Photographs of students and staff are required for two purposes: administration and publicity. Permission for each purpose can be indicated in two ways.

Administrative purposes could include:

  • proof of identification, for example, the production of the student card or staff card
  • processing of applications for entry to the School
  • showing students their classmates on photo boards within a department
  • showing students their classmates in Web CT, the School's Virtual Learning Environment (password protected)  

In general, once a student has given their photograph to the School as part of  their application, it can be used for any of the above purposes. 

Publicity purposes could include:

  • the School's official publications
  • on the website, to show potential students what life is like at the School
  • in departmental publications and newsletters  

Unlike photographs used for administrative purposes, those used for publicity purposes tend to be taken  for a particular publication or web site. As such, it is best to use the following verbal script to ensure that people know where the photograph will appear. This gives someone the chance to refuse to have the photo taken or to move out of the frame of a group photograph. The verbal script that should be used follows. Choose the option within the square brackets that most suits your situation.

        "I'm taking this photo which will appear [in publication/on photo board/on the web site]. If you don't want to be in this photo, please [say so/leave the room/move to the side] now. By staying within the frame of the picture, you are giving consent for the photo to be used [in publication/on photo board/on the web site]."

Opt-outs

Once the photo is taken and put up somewhere public, the subject of the photo still retains the right to ask for it to be taken down. Should a request be received for a photo to be removed from the web site, a photo board or other public place, we have 21 days to respond and remove the photograph. If you are in the position of wanting to have a photograph removed from a public place, please contact the School's Data Protection Officer at glpd.info.rights@lse.ac.uk.

It is much harder to opt out of a print publication, particularly one with a large print run. Use the script above for any photographs likely to appear in a print publication and make it clear it will be fairly impossible to remove the photograph once the printing has been done. 

Student information

Student files

There is only one academic file per student held centrally - the green file. The green file contains application forms, references supporting application, academic records showing progress at the School, and accumulated correspondence.

Information is also held on SITS, the School's student database. This holds the same information as the green file and has for most undergraduate students replaced the green file almost entirely.

There is only one SITS entry/green file for each student, even though he or she might start as an undergraduate and finish as a postgraduate.

LSE for you (also known as LSE4U or LFY) is a portal onto student data used to record and change data from changes of address to classroom attendance.

Student information is also held by the Financial Support Office, the Fees Office, Examinations (who hold the exam scripts), and academic appeals.

Student files are for the use only of those who have bona fide reasons for consulting them. Green files must be returned by hand or in an envelope to the Student Services Centre (Ground Floor, Old Building) immediately after use. They should not be kept elsewhere unless absolutely necessary, and should never be left in unlocked rooms.

Access to SITS is controlled and only made available to staff listed below.

Statement on protection of data in students' personal files

Access to student files is restricted to those who have a direct interest in them:

  • The Director
  • Deputy Directors
  • Deans
  • The Secretary and Director of Administration
  • The staff in the Academic Registrar's Division
  • Tutors
  • Conveners
  • Departmental Tutors
  • Class teachers
  • Teachers named as referees by students
  • Teachers who have other bona fide reasons for examining a file
  • The School's medical staff
  • The Data Protection Officer
  • The Assistant Secretary, who deals with student complaints

The School does not place any reference to specific political or religious beliefs or activities in personal files except where the subject has been raised at the initiative of the student. Reference to extra-curricular activity may be included on a file where relevant to a student's academic progress.

After a student leaves the School the personal file is retained indefinitely. Access to the file continues to be tightly restricted to the categories of staff set out above.

Your personal data, as contained in your student file, will also be transferred to the Advancement Division to keep you in touch with LSE and the School's Alumni Association. Further details about how LSE Advancement manages information of alumni and other groups of individuals for engagement and fundraising purposes can be viewed in the separate Advancement Privacy Statement at: http://www.alumni.lse.ac.uk/yourdata

The medical records of students are kept entirely separate from their academic files and medical staff alone have access to them.

The School's practice in dealing with outside requests for information about current students (other than those from statutory bodies requesting eg confirmation that a named student is registered at the School) is to refer the request to the student, leaving it to him or her to decide whether to respond. 

Exam related information

Exam scripts, which includes assessed essays, dissertations and other summative assessment, are exempt from release under the DPA. However, marks or comments on or relating to the exam script are considered personal data and therefore can be released to the student.

The comments on exam scripts are transcribed by the Data Protection Officer to ensure the examiner cannot be identified, thereby keeping the double blind process secure. For further information on how data protection affects the exam process, please read this guidance note (PDF). 

Staff responsibilities under the DPA

LSE staff are responsible:

  • for raising with the Records Manager any issues relating to notification of data on which they are uncertain. While there are exemptions from certain provisions of the Act for specified types of personal data holding, these are often not as straightforward as might at first appear and it should always be assumed in the first instance that notification of all personal data is required;
  • for handling data in accordance with the 'eight Data Protection principles'. The School will seek to maintain staff awareness on this.

It cannot be emphasised too strongly that it is an offence for personal data to be held in the School, which is not covered by the School's notification to the Information Commissioner. If convicted of such an offence the School will be liable to incur substantial penalties.

Staff are therefore urged to familiarise themselves with the Act at the earliest available opportunity, since staff awareness and compliance with its provisions are the most effective deterrent to contravention.

General enquiries about releasing personal information should be sent to the School’s Data Protection Officer. Requests made by law enforcement agencies should be forwarded to the Head of Security Paul Thornbury for processing.
Staff requiring letters on the management of research data requested by funders or data providers should provide the Records Manager with the details about the research proposal.

HESA Collection notice for staff

Note: Reference in this notice to “we” and “us” refers to the higher education provider by whom you are employed. 

Staff Collection Notice

Submission of your information to the Higher Education Statistics Agency (HESA) 

Every year, we send some of the information we hold about you to HESA (“your HESA information”). HESA is the official source of data about UK universities and higher education colleges www.hesa.ac.uk. Your HESA information does not contain your name or contact details, but may contain your Open Researcher and Contributor ID (ORCID.org) number if you have one. If you leave your current employment and move to another higher education provider we may pass your HESA Staff ID number to your new employer to enable research into employment in the higher education sector. 

It is not intended to use your HESA information to make decisions about you.

HESA collects, and is responsible for, the database in which your HESA information is stored.  HESA is a registered charity and operates on a not-for-profit basis. HESA uses your HESA information itself for its own purposes. HESA also shares information from your HESA information with third parties. It may charge other organisations to whom it provides services and data. HESA information is retained indefinitely by HESA for statistical research purposes. All uses of your HESA information must comply with the Data Protection Act 1998 www.legislation.gov.uk/ukpga/1998/29/contents.

Sensitive information

If you give us information about your disability status, ethnicity, sexual orientation, gender reassignment, parental leave or religion these may be included in your HESA information and used to assist with monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act. Your sensitive information will not be used to make decisions about you.

Purposes for collecting your HESA information

Your HESA information is used for four broad purposes:

Purpose 1 - Public functions

Your HESA information is used by some organisations to help carry out public functions connected with education in the UK. These organisations are data controllers in common of your HESA information under the terms of the Data Protection Act (this link explains what this means ico.org.uk/for-organisations/guide-to-data-protection/key-definitions/ ). Such organisations may include:

  • Department for Business, Innovation and Skills
  • Welsh Government
  • Scottish Government
  • Department for the Economy, Northern Ireland
  • Higher Education Funding Council for England
  • Higher Education Funding Council for Wales
  • Scottish Further and Higher Education Funding Council
  • Research Councils
  • Department for Education
  • Quality Assurance Agency for Higher Education
  • National Health Service bodies and organisations working with them e.g. Health Education England

and any successor bodies. These bodies may retain HESA information indefinitely for statistical research purposes, or for fixed terms depending on the terms of their data sharing agreements with HESA.

Your HESA information may also be used by some organisations who are also data controllers in common to help carry out public functions that are not connected with education such as monitoring of public expenditure by the National Audit Office.

HEFCE will link information about academic staff to Research Excellence Framework submissions in order to monitor equal opportunities in relation to that exercise.

Purpose 2 - HESA publications

HESA uses your HESA information to produce and publish information and statistics. This includes some National Statistics publications (www.statisticsauthority.gov.uk/national-statistician/types-of-official-statistics) and online business intelligence and research services. HESA will take precautions to ensure that individuals are not identified from any information which is processed for Purpose 2.

Purpose 3 - Equal opportunity, research, journalism and other processing in which there is a legitimate interest

HESA and the other data controllers in common listed under Purpose 1 may also supply information to third parties where there is a legitimate interest in doing so. Examples of use for this purpose include:

  • Equal opportunities monitoring
  • Research - This may be academic research, commercial research or other statistical research where this is in the public interest
  • Journalism - Where the relevant publication would be in the public interest e.g. league tables
  • Provision of information to students and prospective students

Users to whom information may be supplied for Purpose 3 include:

  • Higher education sector bodies
  • Higher education providers
  • Academic researchers and students
  • Commercial organisations
  • Unions
  • Non-governmental organisations and charities
  • Local, regional and national government bodies
  • Journalists

Information supplied by HESA to third parties within Purpose 3 is supplied under contracts which require that individuals shall not be identified from the supplied information. A copy of HESA’s current agreement for the supply of information is available at www.hesa.ac.uk/bds-details#e

Purpose 4 - Clinical academic staff and health professionals only

If you work in a clinical or health-related role or department the following organisations may use your HESA information for the additional purposes described below:

The Medical Schools Council and Universities UK through the activities of its Dental Schools Council – for the purposes of:

  • Monitoring trends in clinical academic staffing as a basis for partnership between the NHS and universities.
  • Promoting, maintaining and improving high quality education, research and clinical practice in the UK.
  • Publishing results of research into clinical academic staffing at a detailed statistical level from which there may be a risk of identification of individuals through combinations of characteristics.

About the HESA Staff Collection Notice

The HESA Staff Collection Notice is regularly reviewed.  The most up to date version can be found at www.hesa.ac.uk/fpn.  Minor updates to the Staff Collection Notice (including organisation name changes and clarification of previously specified purposes) may be made at any time. Major updates (such as a new purpose) will be made no more than once per year.

Your rights

For further information about data protection and your HESA information please see www.hesa.ac.uk/dataprot. If you have questions about how your HESA information is used please contact data.protection@hesa.ac.uk. Under the Data Protection Act 1998 you have rights of access to the information HESA holds about you. You will have to pay a small fee for this. If you think there is a problem with the way HESA are handling your data you have the right to complain to the Information Commissioner's Office: https://ico.org.uk/

HESA Collection notice for students

Note: Reference in this notice to “we” and “us” refers to the higher education provider which you attend. 

Student Collection Notice

Student and leaver surveys

Your contact details may be passed to survey contractors to carry out the National Student Survey (NSS) and surveys of student finances, on behalf of some of the organisations listed below under Purpose 1. These organisations and their contractors will use your details only for that purpose, and will then delete them.

After you graduate we may contact you to ask you to complete one or more surveys into the outcomes of higher education and your activities after graduation. These surveys may be undertaken by us or by another specialist organisation contracted for that purpose. If a specialist organisation is used that organisation will receive your contact details, but will only use your details for the purpose of asking you to complete the survey, and will then delete them. You may also be contacted as part of an audit to check that we or any contracted organisation have undertaken these surveys properly.

If you do not want to take part in any of these surveys, please let us know. 

Submission of your information to the Higher Education Statistics Agency (HESA) [1]

Every year we will send some of the information we hold about you to HESA (“your HESA information”). HESA is the official source of data about UK universities, higher education colleges, alternative HE providers, and recognised higher education courses taught at further education institutions in Wales www.hesa.ac.uk. HESA collects, and is responsible for, the database in which your HESA information is stored.  HESA is a registered charity and operates on a not-for-profit basis.

HESA uses your HESA information itself for its own purposes. HESA also shares information from your HESA information with third parties. It may charge other organisations to whom it provides services and data.  HESA's use of your HESA information may include linking information from it to other information, as described further below. HESA information is retained indefinitely by HESA for statistical research purposes. All uses of HESA information must comply with the Data Protection Act 1998 www.legislation.gov.uk/ukpga/1998/29/contents

Sensitive information

If you give us information about your disability status, ethnicity, sexual orientation, gender reassignment or religion these may be included in your HESA information and used to assist with monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act.  Some other sensitive information is used to enable research into the provision of fair access to higher education, for example information as to whether you are a care leaver.

If you are enrolled at a higher education provider in England regulated by the Higher Education Funding Council for England your HESA information will include details of any financial support you may receive from us.

Your sensitive information will not be used to make decisions about you. 

Purposes for collecting your HESA information

Your HESA information including linked data is used for four broad purposes: 

1. Public functions

Education statistics and data

Your HESA information is used by some organisations to help carry out public functions connected with education in the UK. These organisations are data controllers in common of your HESA information under the terms of the Data Protection Act (this link explains what this means ico.org.uk/for-organisations/guide-to-data-protection/key-definitions/ ). Such organisations may include:

  • Department for Business, Innovation and Skills
  • Welsh Government 
  • Scottish Government
  • Department for the Economy, Northern Ireland
  • Higher Education Funding Council for England
  • Higher Education Funding Council for Wales
  • Scottish Further and Higher Education Funding Council
  • Department for Education
  • Research Councils
  • Education Funding Agency
  • Skills Funding Agency
  • National College for Teaching and Leadership
  • National Health Service bodies and organisations working with them e.g. Health Education England
  • General Medical Council
  • Office For Fair Access
  • Quality Assurance Agency for Higher Education

and any successor bodies. These bodies may retain HESA information indefinitely for statistical research purposes, or for fixed terms depending on the terms of their data sharing agreements with HESA.

Other uses

Your HESA information may also be used by some organisations who are also data controllers in common to help carry out public functions that are not connected with education. Such uses may include the following:

  • Measurement of population levels and migration by the Office for National Statistics, National Records of Scotland and the Northern Ireland Statistics and Research Agency
  • Monitoring of public expenditure by the National Audit Office
  • Monitoring of the accuracy of electoral registers by Electoral Registration Officials. 

2. Administrative uses

Fraud detection and prevention - Your HESA information may be used to audit claims to public funding and student finance, and to detect and prevent fraud.

Previous study - If you are enrolled at a higher education provider in England: The Higher Education Funding Council for England (HEFCE) may share your previous education records with us, including HESA information submitted by other institutions, to determine the nature of any prior higher education study, including your current qualifications. This may be used to make decisions about the fees you are required to pay, the support available to you or the availability of a place for you to study with us.

Your HESA information will not be used to make decisions about you other than for those uses outlined under Purpose 2

3. HESA publications

HESA uses your HESA information to produce and publish information and statistics. This includes some National Statistics publications (www.statisticsauthority.gov.uk/national-statistician/types-of-official-statistics) and online business intelligence and research services. HESA will take precautions to ensure that individuals are not identified from any information which is processed for Purpose 3.

4. Equal opportunity, research, journalism and other processing in which there is a legitimate interest

HESA and the other data controllers in common (see Purpose 1) may also supply information to third parties where there is a legitimate interest in doing so. Examples of use for this purpose include:

  • Equal opportunities monitoring
  • Research - This may be academic research, commercial research or other statistical research where this is in the public interest
  • Journalism - Where the relevant publication would be in the public interest e.g. league tables
  • Provision of information to students and prospective students

Users to whom information may be supplied for Purpose 4 include:

  • Higher education sector bodies
  • Higher education providers
  • Academic researchers and students
  • Commercial organisations (e.g. recruitment firms, housing providers, graduate employers)
  • Unions
  • Non-governmental organisations and charities
  • Local, regional and national government bodies
  • Journalists

Information supplied by HESA to third parties within Purpose 4 is supplied under contracts which require that individuals shall not be identified from the supplied information. A copy of HESA’s current agreement for the supply of information is available at www.hesa.ac.uk/bds-details#e.

HESA student information may be linked to school and/or further education college information and supplied to researchers. A copy of the Agreement for the supply of linked data about pupils from schools in England is available at www.gov.uk/government/collections/national-pupil-database


Linking of your HESA information to other information

As indicated above, where HESA and organisations covered by Purpose 1 use HESA information this may include linking HESA information to other information for example:

Where HESA provides information from your HESA information to third parties under Purpose 4, the permitted uses of the information by a third party may include linking HESA information to other information held by the third party.  Permission for such use is considered on a case by case basis. It is only given where the linking is for the purposes outlined in Purpose 4 and subject to the requirement not to carry out linking to identify individuals.

Destinations information for schools and colleges 

If you attended a school or college in England linked data may be disclosed to the last school or college you attended (or its successor body) and to Ofsted to enable them to assess the outcomes of secondary education.

The HESA Initial Teacher Training Record (“ITT”)

If you are on an ITT or EYITT course at a higher education provider in England, HESA will collect additional information about you and provide this to The National College for Teaching and Leadership (NCTL).

ITT or EYITT courses are those that lead to Qualified Teacher Status (QTS) or Early Years Teacher Status (EYTS)

NCTL is an executive agency of the Department for Education (DfE) and for the purposes of the Data Protection Act 1998 DfE and HESA are data controllers in common of the ITT record. NCTL will process your personal data for the administration and monitoring of initial teacher training schemes, including the allocation of teacher reference numbers (TRNs).

NCTL will contact you to provide confirmation of your TRN and any subsequent award of qualified teacher status. NCTL may share personal data with us, its partners and contractors, including employers, employment agencies, Ofsted, Capita Teachers’ Pensions and the Department for Business, Innovation and Skills (BIS), for this purpose and may link it to other sources of information about you.

About the HESA Student Collection Notice

The HESA Student Collection Notice is regularly reviewed.  The most up to date version can be found at www.hesa.ac.uk/fpn. Minor updates to the Student Collection Notice (including organisation name changes and clarification of previously specified purposes) may be made at any time. Major updates (such as a new purpose or administrative use) will be made no more than once per year. 

Your rights

For further information about data protection and your HESA information please see www.hesa.ac.uk/dataprot. If you have questions about how your HESA information is used please contact data.protection@hesa.ac.uk. Under the Data Protection Act 1998 you have rights of access to the information HESA holds about you. You will have to pay a small fee for this. If you think there is a problem with the way HESA are handling your data you have the right to complain to the Information Commissioner's Office: https://ico.org.uk/