Data Protection - Subject Access question
Discussion
A quick question about the Data Protection Act.
I've made a request from my former university for the minutes of the examiners' meeting where they discussed my academic performance.
I've recently received the minutes, but they've redacted the names of the members of academic staff who discussed my case. This is potentially very relevant as it potentially affects the accuracy of the data. However according to the university, the names of other people are "not my data".
I was just wondering if anyone here is clued up enough on Data Protection Act to know whether they are allowed to do this or not?
Cheers.
I've made a request from my former university for the minutes of the examiners' meeting where they discussed my academic performance.
I've recently received the minutes, but they've redacted the names of the members of academic staff who discussed my case. This is potentially very relevant as it potentially affects the accuracy of the data. However according to the university, the names of other people are "not my data".
I was just wondering if anyone here is clued up enough on Data Protection Act to know whether they are allowed to do this or not?
Cheers.
I've had a longish think on the concepts here. I'm by no means an expert, but a few years ago I did delve in depth to SARs.
I'm looking at this this way:
The Uni are holding data about the OP. That data that they've opted to hold about him, is what particular people have said about him. My guess is that this caused the Uni to take a particular course of action.
Of course, the fact that someone's name is mentioned has a limited affect to their own rights, but, unless Professor Jones was talking about himself, the subject of the information is the OP.
My thinking is if the Uni want to defend the legitimacy of their right to hold data about what Professor Jones has said in a meeting about the OP, and specifically keep on those master documents the fact that he has said it, then that 'is' a fundamental part of the the data that is held about the OP and same information should be disclosed to the OP.
Have you tried the ICO for guidance?
I'm looking at this this way:
The Uni are holding data about the OP. That data that they've opted to hold about him, is what particular people have said about him. My guess is that this caused the Uni to take a particular course of action.
Of course, the fact that someone's name is mentioned has a limited affect to their own rights, but, unless Professor Jones was talking about himself, the subject of the information is the OP.
My thinking is if the Uni want to defend the legitimacy of their right to hold data about what Professor Jones has said in a meeting about the OP, and specifically keep on those master documents the fact that he has said it, then that 'is' a fundamental part of the the data that is held about the OP and same information should be disclosed to the OP.
Have you tried the ICO for guidance?
Devil2575 said:
Does it matter who said what? Surely what was said was either fair or not. The identity of who said it doesn't matter unless you are going to attempt to discredit what they said by attacking that individual.
I would guess from the OP's post that he may feel that a specific individual may have reason not to be impartial when commenting on his academic performance.JustinP1 said:
I've had a longish think on the concepts here. I'm by no means an expert, but a few years ago I did delve in depth to SARs.
I'm looking at this this way:
The Uni are holding data about the OP. That data that they've opted to hold about him, is what particular people have said about him. My guess is that this caused the Uni to take a particular course of action.
Of course, the fact that someone's name is mentioned has a limited affect to their own rights, but, unless Professor Jones was talking about himself, the subject of the information is the OP.
My thinking is if the Uni want to defend the legitimacy of their right to hold data about what Professor Jones has said in a meeting about the OP, and specifically keep on those master documents the fact that he has said it, then that 'is' a fundamental part of the the data that is held about the OP and same information should be disclosed to the OP.
Have you tried the ICO for guidance?
Pages 17 & 18 : https://ico.org.uk/media/for-organisations/documen...I'm looking at this this way:
The Uni are holding data about the OP. That data that they've opted to hold about him, is what particular people have said about him. My guess is that this caused the Uni to take a particular course of action.
Of course, the fact that someone's name is mentioned has a limited affect to their own rights, but, unless Professor Jones was talking about himself, the subject of the information is the OP.
My thinking is if the Uni want to defend the legitimacy of their right to hold data about what Professor Jones has said in a meeting about the OP, and specifically keep on those master documents the fact that he has said it, then that 'is' a fundamental part of the the data that is held about the OP and same information should be disclosed to the OP.
Have you tried the ICO for guidance?
Deal with minutes of meetings.
A relevant paragraph (I think) from page 17 : "The fact that an individual attended the meeting will be personal
data about that person. However, this does not mean that everything in the minutes of that meeting is personal data about each of the attendees. "
Following that, the University is right to redact the names of those present, but not what they said.
JustinP1 said:
I've had a longish think on the concepts here. I'm by no means an expert, but a few years ago I did delve in depth to SARs.
I'm looking at this this way:
The Uni are holding data about the OP. That data that they've opted to hold about him, is what particular people have said about him. My guess is that this caused the Uni to take a particular course of action.
Of course, the fact that someone's name is mentioned has a limited affect to their own rights, but, unless Professor Jones was talking about himself, the subject of the information is the OP.
My thinking is if the Uni want to defend the legitimacy of their right to hold data about what Professor Jones has said in a meeting about the OP, and specifically keep on those master documents the fact that he has said it, then that 'is' a fundamental part of the the data that is held about the OP and same information should be disclosed to the OP.
Have you tried the ICO for guidance?
The default position is that other people's personal data should not be disclosed unless they've given their permission or it would be reasonable for the data controller to disclose it without permission. See subsection 5 (below) in particular.I'm looking at this this way:
The Uni are holding data about the OP. That data that they've opted to hold about him, is what particular people have said about him. My guess is that this caused the Uni to take a particular course of action.
Of course, the fact that someone's name is mentioned has a limited affect to their own rights, but, unless Professor Jones was talking about himself, the subject of the information is the OP.
My thinking is if the Uni want to defend the legitimacy of their right to hold data about what Professor Jones has said in a meeting about the OP, and specifically keep on those master documents the fact that he has said it, then that 'is' a fundamental part of the the data that is held about the OP and same information should be disclosed to the OP.
Have you tried the ICO for guidance?
See here;
Data Protection Act s7 said:
(4) Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless—
(a) the other individual has consented to the disclosure of the information to the person making the request, or
(b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.
(5) In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.
(6) In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to—
(a) any duty of confidentiality owed to the other individual,
(b) any steps taken by the data controller with a view to seeking the consent of the other individual,
(c) whether the other individual is capable of giving consent, and
(d) any express refusal of consent by the other individual.
(a) the other individual has consented to the disclosure of the information to the person making the request, or
(b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.
(5) In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.
(6) In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to—
(a) any duty of confidentiality owed to the other individual,
(b) any steps taken by the data controller with a view to seeking the consent of the other individual,
(c) whether the other individual is capable of giving consent, and
(d) any express refusal of consent by the other individual.
marshalla said:
JustinP1 said:
I've had a longish think on the concepts here. I'm by no means an expert, but a few years ago I did delve in depth to SARs.
I'm looking at this this way:
The Uni are holding data about the OP. That data that they've opted to hold about him, is what particular people have said about him. My guess is that this caused the Uni to take a particular course of action.
Of course, the fact that someone's name is mentioned has a limited affect to their own rights, but, unless Professor Jones was talking about himself, the subject of the information is the OP.
My thinking is if the Uni want to defend the legitimacy of their right to hold data about what Professor Jones has said in a meeting about the OP, and specifically keep on those master documents the fact that he has said it, then that 'is' a fundamental part of the the data that is held about the OP and same information should be disclosed to the OP.
Have you tried the ICO for guidance?
Pages 17 & 18 : https://ico.org.uk/media/for-organisations/documen...I'm looking at this this way:
The Uni are holding data about the OP. That data that they've opted to hold about him, is what particular people have said about him. My guess is that this caused the Uni to take a particular course of action.
Of course, the fact that someone's name is mentioned has a limited affect to their own rights, but, unless Professor Jones was talking about himself, the subject of the information is the OP.
My thinking is if the Uni want to defend the legitimacy of their right to hold data about what Professor Jones has said in a meeting about the OP, and specifically keep on those master documents the fact that he has said it, then that 'is' a fundamental part of the the data that is held about the OP and same information should be disclosed to the OP.
Have you tried the ICO for guidance?
Deal with minutes of meetings.
A relevant paragraph (I think) from page 17 : "The fact that an individual attended the meeting will be personal
data about that person. However, this does not mean that everything in the minutes of that meeting is personal data about each of the attendees. "
Following that, the University is right to redact the names of those present, but not what they said.
That said, there is nothing stopping the Uni having in their terms with the staff the request to hold personal data about them, and where necessary reveal attendance at meetings where those staff act within an official capacity.
In fact, I would say that this would be sensible - otherwise, who could actually read the minutes without the personal data about the attendance being wrongly revealed?
abc2011 said:
as it potentially affects the accuracy of the data.
I'm curious about this. From my experience at various universities, the data comes from the central database and is simply the numbers which you will have seen during your course. There is little to no scope for "professional judgment" to be exercised except to give a student the benefit of the doubt - and even then it takes a protracted discussion and a lot of mitigating circumstances forms to get them promoted to the next classification.marshalla said:
abc2011 said:
as it potentially affects the accuracy of the data.
I'm curious about this. From my experience at various universities, the data comes from the central database and is simply the numbers which you will have seen during your course. There is little to no scope for "professional judgment" to be exercised except to give a student the benefit of the doubt - and even then it takes a protracted discussion and a lot of mitigating circumstances forms to get them promoted to the next classification.Devil2575 said:
marshalla said:
abc2011 said:
as it potentially affects the accuracy of the data.
I'm curious about this. From my experience at various universities, the data comes from the central database and is simply the numbers which you will have seen during your course. There is little to no scope for "professional judgment" to be exercised except to give a student the benefit of the doubt - and even then it takes a protracted discussion and a lot of mitigating circumstances forms to get them promoted to the next classification.That said, I sense that there is something more to this instance that the OP is quite rightly tactfully avoiding which would mean his request is relevant for some reason.
The Surveyor said:
I would guess from the OP's post that he may feel that a specific individual may have reason not to be impartial when commenting on his academic performance.
That's what I'm alluding to, yes. The person whose judgement was under discussion at the meeting wasn't present, but the minutes tell me that "[redacted] reinforced their view" and thus a specific course of action was taken/not taken.marshalla said:
Pages 17 & 18 : https://ico.org.uk/media/for-organisations/documen...
Deal with minutes of meetings.
A relevant paragraph (I think) from page 17 : "The fact that an individual attended the meeting will be personal
data about that person. However, this does not mean that everything in the minutes of that meeting is personal data about each of the attendees. "
Following that, the University is right to redact the names of those present, but not what they said.
In this case they've done the opposite. They've listed those present at the meeting, but redacted the names of those making pertinent comments.Deal with minutes of meetings.
A relevant paragraph (I think) from page 17 : "The fact that an individual attended the meeting will be personal
data about that person. However, this does not mean that everything in the minutes of that meeting is personal data about each of the attendees. "
Following that, the University is right to redact the names of those present, but not what they said.
abc2011 said:
In this case they've done the opposite. They've listed those present at the meeting, but redacted the names of those making pertinent comments.
Oh dear.... I'd suggest they don't know what they're doing then.
I originally thought they were doing things in an informed, methodical jobsworth fashion, and relying on the fact that at that date and time Professor X could be geolocated.
If they've revealed that anyway, my previous comments regarding that the data held about you, and that who said something is a fundamental part of that data would be my argument.
Gassing Station | Speed, Plod & the Law | Top of Page | What's New | My Stuff