The purpose of Data Protection legislation is to regulate "the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information" by 'Data Controllers', like LSE.

In other words, it requires us to process, store and use your personal information in a way that is fair, proportionate, secure and justified. We uphold this commitment by adhering to the six principles of Data Protection.

The General Data Protection Regulation replaced the Data Protection Act in May 2018 and the School is working towards meeting the new requirements in the Regulation.

LSE and the LSE Students' Union have signed a data sharing agreement that covers transfer of data between us. 

Please contact glpd.info.rights@lse.ac.uk if you have any queries relating to the agreement. 

Photographs of both students and staff are considered personal information under the Data Protection Act and the data protection principles apply to them. When taking or asking for photographs, staff need to keep the following in mind:

• Photos should only be taken or asked for when necessary.
• The subject of the photo should be told where the photo will be used.
• People should be given a chance to opt out when a photograph is taken. 

Getting permissions for photographs

Photographs are not sensitive personal data as defined by the Data Protection Act, but they are a very easy means by which to identify a person. Photographs of students and staff are required for two purposes: administration and publicity. Permission for each purpose can be indicated in two ways.

Administrative purposes could include:

• proof of identification, for example, the production of the student card or staff card
• processing of applications for entry to the School
• showing students their classmates on photo boards within a department
• showing students their classmates in Web CT, the School's Virtual Learning Environment (password protected)  

In general, once a student has given their photograph to the School as part of  their application, it can be used for any of the above purposes. 

Publicity purposes could include:

• the School's official publications
• on the website, to show potential students what life is like at the School
• in departmental publications and newsletters  

Unlike photographs used for administrative purposes, those used for publicity purposes tend to be taken  for a particular publication or web site. As such, it is best to use the following verbal script to ensure that people know where the photograph will appear. This gives someone the chance to refuse to have the photo taken or to move out of the frame of a group photograph. The verbal script that should be used follows. Choose the option within the square brackets that most suits your situation.

        "I'm taking this photo which will appear [in publication/on photo board/on the web site]. If you don't want to be in this photo, please [say so/leave the room/move to the side] now. By staying within the frame of the picture, you are giving consent for the photo to be used [in publication/on photo board/on the web site]."

Opt-outs

Once the photo is taken and put up somewhere public, the subject of the photo still retains the right to ask for it to be taken down. Should a request be received for a photo to be removed from the web site, a photo board or other public place, we have 21 days to respond and remove the photograph. If you are in the position of wanting to have a photograph removed from a public place, please contact the School's Data Protection Officer at glpd.info.rights@lse.ac.uk.

It is much harder to opt out of a print publication, particularly one with a large print run. Use the script above for any photographs likely to appear in a print publication and make it clear it will be fairly impossible to remove the photograph once the printing has been done. 

The following cloud based survey platforms can be used for surveys as they are GDPR compliant: 

• Qualtrics (the School's provided survey platform) 
• Microsoft Forms (avaliable as part of O365) 

If there is any other cloud based platform you wish to use, please contact the Data Protection Officer who can check the terms and conditions for you. As more platforms are checked, they will be added to this list. 

Student files

There is only one academic file per student held centrally - the green file. The green file contains application forms, references supporting application, academic records showing progress at the School, and accumulated correspondence.

Information is also held on SITS, the School's student database. This holds the same information as the green file and has for most undergraduate students replaced the green file almost entirely.

There is only one SITS entry/green file for each student, even though he or she might start as an undergraduate and finish as a postgraduate.

LSE for you (also known as LSE4U or LFY) is a portal onto student data used to record and change data from changes of address to classroom attendance.

Student information is also held by the Financial Support Office, the Fees Office, Examinations (who hold the exam scripts), and academic appeals.

Student files are for the use only of those who have bona fide reasons for consulting them. Green files must be returned by hand or in an envelope to the Student Services Centre (Ground Floor, Old Building) immediately after use. They should not be kept elsewhere unless absolutely necessary, and should never be left in unlocked rooms.

Access to SITS is controlled and only made available to staff listed below.

Statement on protection of data in students' personal files

Access to student files is restricted to those who have a direct interest in them:

• The Director
• Deputy Directors
• Deans
• The Secretary and Director of Administration
• The staff in the Academic Registrar's Division
• Tutors
• Conveners
• Departmental Tutors
• Class teachers
• Teachers named as referees by students
• Teachers who have other bona fide reasons for examining a file
• The School's medical staff
• The Data Protection Officer
• The Assistant Secretary, who deals with student complaints

The School does not place any reference to specific political or religious beliefs or activities in personal files except where the subject has been raised at the initiative of the student. Reference to extra-curricular activity may be included on a file where relevant to a student's academic progress.

After a student leaves the School the personal file is retained indefinitely. Access to the file continues to be tightly restricted to the categories of staff set out above.

Your personal data, as contained in your student file, will also be transferred to the Advancement Division to keep you in touch with LSE and the School's Alumni Association. Further details about how LSE Advancement manages information of alumni and other groups of individuals for engagement and fundraising purposes can be viewed in the separate Advancement Privacy Statement at: http://www.alumni.lse.ac.uk/yourdata. 

The medical records of students are kept entirely separate from their academic files and medical staff alone have access to them.

The School's practice in dealing with outside requests for information about current students (other than those from statutory bodies requesting eg confirmation that a named student is registered at the School) is to refer the request to the student, leaving it to him or her to decide whether to respond. 

Exam related information

Exam scripts, which includes assessed essays, dissertations and other summative assessment, are exempt from release under the DPA. However, marks or comments on or relating to the exam script are considered personal data and therefore can be released to the student.

The comments on exam scripts are transcribed by the Data Protection Officer to ensure the examiner cannot be identified, thereby keeping the double blind process secure. For further information on how data protection affects the exam process, please read this guidance note. 

LSE staff are responsible:

• for raising with the Records Manager any issues relating to notification of data on which they are uncertain. While there are exemptions from certain provisions of data protection legislation for specified types of personal data holding, these are often not as straightforward as might at first appear and it should always be assumed in the first instance that notification of all personal data is required;
• for handling data in accordance with the 'six Data Protection principles'. The School will seek to maintain staff awareness on this.

It cannot be emphasised too strongly that it is an offence for personal data to be held in the School, which is not covered by the School's records of processing. If convicted of such an offence the School will be liable to incur substantial penalties.

Staff are therefore urged to familiarise themselves with the legislation at the earliest available opportunity, since staff awareness and compliance with its provisions are the most effective deterrent to contravention.

General enquiries about releasing personal information should be sent to the School’s Data Protection Officer. Requests made by law enforcement agencies should be forwarded to the Head of Security Paul Thornbury for processing.
Staff requiring letters on the management of research data requested by funders or data providers should provide the Data Protection Officer with the details about the research proposal.

Note: Reference in this notice to “we” and “us” refers to the higher education provider by whom you are employed. 

Staff Collection Notice

Submission of your information to the Higher Education Statistics Agency (HESA) 

Every year, we send some of the information we hold about you to HESA (“your HESA information”). HESA is the official source of data about UK universities and higher education colleges www.hesa.ac.uk. Your HESA information does not contain your name or contact details, but may contain your Open Researcher and Contributor ID (ORCID.org) number if you have one. If you leave your current employment and move to another higher education provider we may pass your HESA Staff ID number to your new employer to enable research into employment in the higher education sector. 

It is not intended to use your HESA information to make decisions about you.

HESA collects, and is responsible for, the database in which your HESA information is stored.  HESA is a registered charity and operates on a not-for-profit basis. HESA uses your HESA information itself for its own purposes. HESA also shares information from your HESA information with third parties. It may charge other organisations to whom it provides services and data. HESA information is retained indefinitely by HESA for statistical research purposes. All uses of your HESA information must comply with the Data Protection Act 1998 www.legislation.gov.uk/ukpga/1998/29/contents.

Sensitive information

If you give us information about your disability status, ethnicity, sexual orientation, gender reassignment, parental leave or religion these may be included in your HESA information and used to assist with monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act. Your sensitive information will not be used to make decisions about you.

Purposes for collecting your HESA information

Your HESA information is used for four broad purposes:

Purpose 1 - Public functions

Your HESA information is used by some organisations to help carry out public functions connected with education in the UK. These organisations are data controllers in common of your HESA information under the terms of the Data Protection Act (this link explains what this means ico.org.uk/for-organisations/guide-to-data-protection/key-definitions/ ). Such organisations may include:

• Department for Business, Innovation and Skills
• Welsh Government
• Scottish Government
• Department for the Economy, Northern Ireland
• Higher Education Funding Council for England
• Higher Education Funding Council for Wales
• Scottish Further and Higher Education Funding Council
• Research Councils
• Department for Education
• Quality Assurance Agency for Higher Education
• National Health Service bodies and organisations working with them e.g. Health Education England

and any successor bodies. These bodies may retain HESA information indefinitely for statistical research purposes, or for fixed terms depending on the terms of their data sharing agreements with HESA.

Your HESA information may also be used by some organisations who are also data controllers in common to help carry out public functions that are not connected with education such as monitoring of public expenditure by the National Audit Office.

HEFCE will link information about academic staff to Research Excellence Framework submissions in order to monitor equal opportunities in relation to that exercise.

Purpose 2 - HESA publications

HESA uses your HESA information to produce and publish information and statistics. This includes some National Statistics publications (www.statisticsauthority.gov.uk/national-statistician/types-of-official-statistics) and online business intelligence and research services. HESA will take precautions to ensure that individuals are not identified from any information which is processed for Purpose 2.

Purpose 3 - Equal opportunity, research, journalism and other processing in which there is a legitimate interest

HESA and the other data controllers in common listed under Purpose 1 may also supply information to third parties where there is a legitimate interest in doing so. Examples of use for this purpose include:

• Equal opportunities monitoring
• Research - This may be academic research, commercial research or other statistical research where this is in the public interest
• Journalism - Where the relevant publication would be in the public interest e.g. league tables
• Provision of information to students and prospective students

Users to whom information may be supplied for Purpose 3 include:

• Higher education sector bodies
• Higher education providers
• Academic researchers and students
• Commercial organisations
• Unions
• Non-governmental organisations and charities
• Local, regional and national government bodies
• Journalists

Information supplied by HESA to third parties within Purpose 3 is supplied under contracts which require that individuals shall not be identified from the supplied information. A copy of HESA’s current agreement for the supply of information is available at www.hesa.ac.uk/bds-details#e. 

Purpose 4 - Clinical academic staff and health professionals only

If you work in a clinical or health-related role or department the following organisations may use your HESA information for the additional purposes described below:

The Medical Schools Council and Universities UK through the activities of its Dental Schools Council – for the purposes of:

• Monitoring trends in clinical academic staffing as a basis for partnership between the NHS and universities.
• Promoting, maintaining and improving high quality education, research and clinical practice in the UK.
• Publishing results of research into clinical academic staffing at a detailed statistical level from which there may be a risk of identification of individuals through combinations of characteristics.

About the HESA Staff Collection Notice

The HESA Staff Collection Notice is regularly reviewed.  The most up to date version can be found at www.hesa.ac.uk/fpn.  Minor updates to the Staff Collection Notice (including organisation name changes and clarification of previously specified purposes) may be made at any time. Major updates (such as a new purpose) will be made no more than once per year.

Your rights

For further information about data protection and your HESA information please see www.hesa.ac.uk/dataprot. If you have questions about how your HESA information is used please contact data.protection@hesa.ac.uk. Under the Data Protection Act 1998 you have rights of access to the information HESA holds about you. You will have to pay a small fee for this. If you think there is a problem with the way HESA are handling your data you have the right to complain to the Information Commissioner's Office: https://ico.org.uk/. 

Note: Reference in this notice to “we” and “us” refers to the higher education provider which you attend. 

Student Collection Notice

Student and leaver surveys

Your contact details may be passed to survey contractors to carry out the National Student Survey (NSS) and surveys of student finances, on behalf of some of the organisations listed below under Purpose 1. These organisations and their contractors will use your details only for that purpose, and will then delete them.

After you graduate we may contact you to ask you to complete one or more surveys into the outcomes of higher education and your activities after graduation. These surveys may be undertaken by us or by another specialist organisation contracted for that purpose. If a specialist organisation is used that organisation will receive your contact details, but will only use your details for the purpose of asking you to complete the survey, and will then delete them. You may also be contacted as part of an audit to check that we or any contracted organisation have undertaken these surveys properly.

If you do not want to take part in any of these surveys, please let us know. 

Submission of your information to the Higher Education Statistics Agency (HESA) ^[1]

Every year we will send some of the information we hold about you to HESA (“your HESA information”). HESA is the official source of data about UK universities, higher education colleges, alternative HE providers, and recognised higher education courses taught at further education institutions in Wales www.hesa.ac.uk. HESA collects, and is responsible for, the database in which your HESA information is stored.  HESA is a registered charity and operates on a not-for-profit basis.

HESA uses your HESA information itself for its own purposes. HESA also shares information from your HESA information with third parties. It may charge other organisations to whom it provides services and data.  HESA's use of your HESA information may include linking information from it to other information, as described further below. HESA information is retained indefinitely by HESA for statistical research purposes. All uses of HESA information must comply with the Data Protection Act 1998 www.legislation.gov.uk/ukpga/1998/29/contents. 

Sensitive information

If you give us information about your disability status, ethnicity, sexual orientation, gender reassignment or religion these may be included in your HESA information and used to assist with monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act.  Some other sensitive information is used to enable research into the provision of fair access to higher education, for example information as to whether you are a care leaver.

If you are enrolled at a higher education provider in England regulated by the Higher Education Funding Council for England your HESA information will include details of any financial support you may receive from us.

Your sensitive information will not be used to make decisions about you. 

Purposes for collecting your HESA information

Your HESA information including linked data is used for four broad purposes: 

1. Public functions

Education statistics and data

Your HESA information is used by some organisations to help carry out public functions connected with education in the UK. These organisations are data controllers in common of your HESA information under the terms of the Data Protection Act (this link explains what this means ico.org.uk/for-organisations/guide-to-data-protection/key-definitions/ ). Such organisations may include:

• Department for Business, Innovation and Skills
• Welsh Government 
• Scottish Government
• Department for the Economy, Northern Ireland
• Higher Education Funding Council for England
• Higher Education Funding Council for Wales
• Scottish Further and Higher Education Funding Council
• Department for Education
• Research Councils
• Education Funding Agency
• Skills Funding Agency
• National College for Teaching and Leadership
• National Health Service bodies and organisations working with them e.g. Health Education England
• General Medical Council
• Office For Fair Access
• Quality Assurance Agency for Higher Education

and any successor bodies. These bodies may retain HESA information indefinitely for statistical research purposes, or for fixed terms depending on the terms of their data sharing agreements with HESA.

Other uses

Your HESA information may also be used by some organisations who are also data controllers in common to help carry out public functions that are not connected with education. Such uses may include the following:

• Measurement of population levels and migration by the Office for National Statistics, National Records of Scotland and the Northern Ireland Statistics and Research Agency
• Monitoring of public expenditure by the National Audit Office
• Monitoring of the accuracy of electoral registers by Electoral Registration Officials. 

2. Administrative uses

Fraud detection and prevention - Your HESA information may be used to audit claims to public funding and student finance, and to detect and prevent fraud.

Previous study - If you are enrolled at a higher education provider in England: The Higher Education Funding Council for England (HEFCE) may share your previous education records with us, including HESA information submitted by other institutions, to determine the nature of any prior higher education study, including your current qualifications. This may be used to make decisions about the fees you are required to pay, the support available to you or the availability of a place for you to study with us.

Your HESA information will not be used to make decisions about you other than for those uses outlined under Purpose 2. 

3. HESA publications

HESA uses your HESA information to produce and publish information and statistics. This includes some National Statistics publications (www.statisticsauthority.gov.uk/national-statistician/types-of-official-statistics) and online business intelligence and research services. HESA will take precautions to ensure that individuals are not identified from any information which is processed for Purpose 3.

4. Equal opportunity, research, journalism and other processing in which there is a legitimate interest

HESA and the other data controllers in common (see Purpose 1) may also supply information to third parties where there is a legitimate interest in doing so. Examples of use for this purpose include:

• Equal opportunities monitoring
• Research - This may be academic research, commercial research or other statistical research where this is in the public interest
• Journalism - Where the relevant publication would be in the public interest e.g. league tables
• Provision of information to students and prospective students

Users to whom information may be supplied for Purpose 4 include:

• Higher education sector bodies
• Higher education providers
• Academic researchers and students
• Commercial organisations (e.g. recruitment firms, housing providers, graduate employers)
• Unions
• Non-governmental organisations and charities
• Local, regional and national government bodies
• Journalists

Information supplied by HESA to third parties within Purpose 4 is supplied under contracts which require that individuals shall not be identified from the supplied information. A copy of HESA’s current agreement for the supply of information is available at www.hesa.ac.uk/bds-details#e.

HESA student information may be linked to school and/or further education college information and supplied to researchers. A copy of the Agreement for the supply of linked data about pupils from schools in England is available at www.gov.uk/government/collections/national-pupil-database

Linking of your HESA information to other information

As indicated above, where HESA and organisations covered by Purpose 1 use HESA information this may include linking HESA information to other information for example:

• UCAS data
• National Student Survey data
• School and Further Education data
• Student Loans Company data
• Qualification Awarding Bodies data
• Tax, Benefits, and Employment data. (Guidance on the use of HESA records matched to Tax, Benefits and Employment data is available at: https://www.gov.uk/government/publications/longitudinal-education-outcomes-study-how-we-use-and-share-data)

Where HESA provides information from your HESA information to third parties under Purpose 4, the permitted uses of the information by a third party may include linking HESA information to other information held by the third party.  Permission for such use is considered on a case by case basis. It is only given where the linking is for the purposes outlined in Purpose 4 and subject to the requirement not to carry out linking to identify individuals.

Destinations information for schools and colleges 

If you attended a school or college in England linked data may be disclosed to the last school or college you attended (or its successor body) and to Ofsted to enable them to assess the outcomes of secondary education.

The HESA Initial Teacher Training Record (“ITT”)

If you are on an ITT or EYITT course at a higher education provider in England, HESA will collect additional information about you and provide this to The National College for Teaching and Leadership (NCTL).

ITT or EYITT courses are those that lead to Qualified Teacher Status (QTS) or Early Years Teacher Status (EYTS)

NCTL is an executive agency of the Department for Education (DfE) and for the purposes of the Data Protection Act 1998 DfE and HESA are data controllers in common of the ITT record. NCTL will process your personal data for the administration and monitoring of initial teacher training schemes, including the allocation of teacher reference numbers (TRNs).

NCTL will contact you to provide confirmation of your TRN and any subsequent award of qualified teacher status. NCTL may share personal data with us, its partners and contractors, including employers, employment agencies, Ofsted, Capita Teachers’ Pensions and the Department for Business, Innovation and Skills (BIS), for this purpose and may link it to other sources of information about you.

About the HESA Student Collection Notice

The HESA Student Collection Notice is regularly reviewed.  The most up to date version can be found at www.hesa.ac.uk/fpn. Minor updates to the Student Collection Notice (including organisation name changes and clarification of previously specified purposes) may be made at any time. Major updates (such as a new purpose or administrative use) will be made no more than once per year. 

Your rights

For further information about data protection and your HESA information please see www.hesa.ac.uk/dataprot. If you have questions about how your HESA information is used please contact data.protection@hesa.ac.uk. Under the Data Protection Act 1998 you have rights of access to the information HESA holds about you. You will have to pay a small fee for this. If you think there is a problem with the way HESA are handling your data you have the right to complain to the Information Commissioner's Office: https://ico.org.uk/. 

The School’s Appropriate Policy Document sets out how and why the School processes certain special categories and criminal related personal data. 

Please contact glpd.info.rights@lse.ac.uk for a copy of this document. 

LSE Statement of Tasks in the Public interest

Why a statement

To make clear what the School’s public tasks are for when we process data under Article 5(1)(e) of the UK GDPR.

Most public authorities have their public tasks set by legislation. This is not the case for universities.

Where do the School’s public tasks come from

Our public tasks come from our Articles of Association. In particular, Section 2 Object, ‘The Object of the School is to advance education, learning and research for the public benefit’ sets out the School’s tasks in the public interest.

As such, when processing personal data for education, learning and publicly funded research, task in the public interest will be at least one of the lawful bases.

Where does the School apply legitimate interests

We are considered hybrid public authorities by the Information Commissioner’s Office as we have marketing and other activities that most public authorities do not. As such, while most public authorities cannot use legitimate interests (article 5(1)(f) of the GDPR), universities can for marketing, commercial research and alumni related activities.