Viv Adams, Principal Policy Adviser : Sharing personal data in an emergency – a guide for universities and colleges
The ICO often provides us very beneficial posts about the newest regulation updates and what would we need to be careful for. There are certain situation that might happen during data sharing processes, so we are sharing one of the most important blogs shared recently about sharing personal data in an emergence for universities and colleges.
A blog by Viv Adams, Principal Policy Adviser in the ICO Parliament and Government Affairs team
Starting university or further education can be an exciting time, but for some it can also be a difficult and anxious transition.
We know that universities and colleges work hard to provide support to students who are struggling. That means that universities often have to handle sensitive personal information about them. And we are aware that, sometimes, universities are hesitant to share students’ personal data in an urgent or emergency situation, citing data protection as the problem. That should not be the case.
Put simply, university staff should do whatever is necessary and proportionate to protect someone’s life. Data protection law allows organisations to share personal data in an urgent or emergency situation, including to help them prevent loss of life or serious physical, emotional or mental harm.
The ICO’s approach has always been to be a pragmatic and proportionate regulator. That means the ICO does not seek to penalise organisations for acting in good faith and in the public interest in an urgent or emergency situation.
To help universities and colleges feel confident they can share people’s information lawfully, we have set out some practical steps:
- Plan ahead. Having an emergency plan in place that takes into account data sharing can help prevent any delays in a crisis. As a start, universities should consider in advance the types of data they currently hold and that are likely to be shared in an emergency. They also need to consider how they will share the data securely. The best way to do this is through a Data Protection Impact Assessment.
- Have a data sharing agreement in place. When there is a need for universities to share students’ data on a more frequent basis, for example with health and wellbeing organisations, having a data sharing agreement in place can help so information is shared in a safe and timely way.
- Staff training. Staff are more confident in using and sharing personal data appropriately when they have clear guidance and training around their roles and responsibilities. This includes specific advice for staff on how to handle personal information in an emergency situation.
- Access our data sharing resources. Our data sharing code of practice provides practical guidance for organisations to share data fairly, lawfully and proportionately. Alongside the code, our data sharing information hub has many helpful resources including myth-busting facts, case studies, FAQs and checklists.
We recognise that this does not resolve all the issues around students’ personal data where there is a mental health concern, but we hope it will go some way towards it by busting data sharing myths.
We will continue to work with universities, educational bodies and parents to reassure them that data protection law enables data sharing to save lives and protect young people.
Check this blog and share your thoughts about it.
Hope you find this useful. If you need an EU Rep, have any GDPR questions, or have received a SAR or Regulator request and need help then please contact us anytime. We are always happy to help...
Zlatko, Adam, Hristina, Marin.
As your Article 27 Representative we will always help if you receive a SAR, RTE, or other data prot
We have said this previously but we are still seeing a huge number of Subject Access Requests [
Summary: The Right to Be Forgotten is one of the fundamental rights defined in GDPR. Also