Privacy notice for students

This is our privacy notice for past, present and prospective students of City, University of London.

This privacy notice explains how City, University of London (City) collects, uses and shares your personal data, and your rights in relation to any of your personal data that City holds. This privacy notice concerns City’s processing of personal data of past, present and prospective students of City.

City is a data controller in terms of the Data Protection Act 1998 and the General Data Protection Regulations (GDPR) which came into effect on the 25^th May 2018. City is registered with the Information Commissioner’s Office (ICO) with the registration number Z8947127.

How City collects your information

Information about you will be collected by City in a number of ways:

• When you apply or register to study at City we will collect data to allow us to administer your studies. If you have applied via the Universities and Colleges Admissions Service (UCAS) they will share your information with us.
• If you express an interest in City we will ask you to provide us with some information so we can communicate with you effectively.
• In various other ways during the course of your studies, for example, when you interact with City services.
• City may, at times, ask third parties for information about you such as your sixth form college, funder or employer.

Information City collects

City may collect the following types of personal data about you:

• Your name and contact information such as address, email address and telephone number, as well as your date of birth and your passport number, country of domicile and your nationality. City also processes and stores CCTV footage for security and safety. For further information, please read our CCTV Policy.
• Information relating to your education and employment history including where you have worked, dates of study and examination results.
• Records relating to assessments of your work, details of examinations taken, your examination grades, personal tutor meetings, attendance records and other information in your student record.
• Sensitive personal data or special category data:
  • health and medical conditions
  • certain criminal convictions
  • racial or ethnic origin
  • religion or similar beliefs
  • sexual orientation.

Why do we process this information?

City uses the information provided by or collected from applicants and/or students (including information from application forms) to administer applications and to compile statistics about applicants and/or students that may be published or passed to government bodies or the Higher Education Statistics Agency (HESA). As of 4 October 2022, HESA merged with JISC, meaning that JISC is now the data controller of personal data previously controlled by HESA. For further information please see the HESA Student Data Protection Notice.

If your application is successful, City will also use the information provided by or collected from you:

1. to facilitate and deliver your programme of study and to provide you with teaching, research and educational services and support;
2. to administer your studies, including admissions procedures and maintenance of your academic records after admission;
3. to provide you with, and manage your use of, City’s facilities and services and your participation at events;
4. to monitor and maintain records of your performance, engagement and attendance;
5. to operate security, disciplinary, complaint and quality assurance processes and arrangements and to provide you with support;
6. to conduct research and to identify ways to enhance learning, teaching, assessment and the broader student experience;
7. to enable effective communication with you;
8. to administer the financial aspects of our relationship with you and any funders, including processing any payments made by you to City;
9. for credit scoring, credit assessment, debt tracing or fraud and money laundering prevention. City may disclose this information or data about you to credit reference agencies or other credit assessment, debt tracing and collectors, fraud prevention organisations or solicitors as appropriate;
10. for legal, personnel, administrative and management purposes including the processing of any sensitive personal data relating to you, which may include, as appropriate: information about your physical or mental health or condition in order to monitor leave from study or extenuating circumstances and take decisions as to your fitness for study or for other uses as may be required by law;
11. conduct equal opportunities monitoring and equality impact assessments using your ‘protected characteristic data’;
12. for other activities that fall within the pursuit of the City’s ‘legitimate interests’ (including the development and maintenance of an alumni programme, or in the event that City is required to terminate our contract with you and withdraw you from City in accordance our Terms and Conditions of Study); and
13. to carry out legal and regulatory duties, which may require that information be provided to others e.g. local councils, Transport for London, HESA
14. Personal data is shared with the Higher Education Statistics Agency (HESA), part of Jisc, for the purposes of conducting the Graduate Outcomes survey. More information about how Jisc processes your data can be found in the Graduate Outcomes Privacy Information.

City may share your personal data with third parties to support us in fulfilling our obligations and responsibilities to, and in managing our relationship with, you under our Terms and Conditions of Study. The third parties may include sponsors or funding organisations, professional bodies, work placement partners and foundation course providers, potential employers, local government departments, the University of London and third-party suppliers providing services to City.

In addition, in certain circumstances, City may be under a duty to disclose or share your personal data (including sensitive personal data) in order to comply with any legal or regulatory obligations, and to protect City’s rights, property, or safety of our employees, students or others. The third parties may include health professionals, Student Loans Company, UK Visas and Immigration (UKVI) and/or the Police.

You may be given further information about the processing of your personal data when you use specific services and facilities offered by City, such as our Student Health and Wellbeing Service and CitySport.

When you leave City, whether because you complete your programme of study or otherwise, your information will be retained by us for the purposes of maintaining your student record and/or where there is a legitimate business need to do so.

The legal basis for processing your information

City relies on several different legal basis depending on the processing being performed:

(Article 6(1)(a)), Consent – on specific occasions City will only process certain data if you consent e.g. on registration you only need to provide certain “special categories” of data if you agree to that.

(Article 6 (1)(b)), necessary for the performance of your student contract – on many occasions City will process your data to enable it to meet its commitments to you e.g. those relating to education and assessment.

(Article 6 (1)(c)), necessary to comply with a legal obligation – City may have legal obligations to provide your personal data to others e.g. HESA.

(Article 6 (1)(d)), for the purpose of protecting the vital interest of yourself or another – sometimes in extreme circumstances City will have to release information to protect your interests or the interests of others e.g. in medical emergencies.

(Article 6 (1)(e)), processing necessary for the performance of a task carried in the public interest – City is an educational and research establishment and in particular its educational and research activity is conducted in a public interest (including your interest and the interest of others).

(Article 6 (1)(f)), processing is necessary for the purposes of the legitimate interest of City or a third party subject to overridden interests of the data subject – the University (and sometimes third parties) has a broad legitimate interest in activities that connect to the activities and education of students. Subject to those interests not being overridden by the interests of fundamental rights and freedoms of students, it will pursue those interests. A good example of this legitimate interest would be Alumni activities.

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which it is collected.

Others City shares your information with

Where necessary City will disclose, outside the institution, relevant items of your personal data as set out below.

• Sponsors or funding organisations (including the Student Loans Company) where a contract exists, in accordance with the terms of the contract (which usually relate to attendance and progress reports).This does not include third parties (such as parents) who may be paying for your studies but with whom no formal contract exists.
• Professional bodies (e.g. Law Society, Nursing and Midwifery Council).
• For the purposes of confirming your qualifications and the accreditation of your course.
• NHS Trusts in England and Wales where this is necessary for the purposes of your study.
• Work Placement sites or other educational partners involved in joint course provision where this is necessary for the purposes of your study.
• The Office for Students (OfS) and its agents, such as the Higher Education Statistics Agency (HESA) and the Quality Assurance Agency. You are also advised to refer to the collection notices on the HESA website for further details.
• Potential employers or providers of education whom you have approached for the purposes of confirming your qualifications.
• Local Government Departments, including Council Tax, Electoral Services and Transport for London for the purpose of assessing and collecting Council Tax and or supporting your registration to vote in elections.
• UK Agencies with duties relating to the prevention and detection of crime, apprehension and prosecution of offenders, collection of a tax or duty, or safeguarding national security.
  For example: Benefit or Tax Inspectors, the Police, the UK Border Agency (UKBA) or the Foreign and Commonwealth Office, as necessary, and with consideration of your rights and freedoms.
• The University of London for the purposes of allowing you access to shared facilities.
• The Students Union to provide support services for students.
• Foundation course partners for the administration of those courses.
• Providers supplying learning analytics services (Jisc) to support students in their studies.

In addition City employs the services of various suppliers and agents as data processors. In each case your information will only be shared with these third parties in accordance with the data protection principles.

Data retention

City retains personal information it collects from you where there is an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

When there is no ongoing legitimate business need to process your personal information, City will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then City will securely store your personal information and isolate it from any further processing until deletion is possible.

Your rights

You have rights to your personal data held by City as set out in the GDPR. These include:

• Rights to access your personal data to be provided by City within one calendar month – known as a Subject Access Requests (Article 15). This includes information on:
  • A description of your data
  • The Recipients of your data
  • A copy of your data.
• Rights to rectification and erasure. You have the right to correct any inaccurate personal data held by City. Once information City has collected is no longer necessary for the purpose for which it was collected and processed, you sometimes have the right to have your data erased.
• Rights to restriction of processing.
  • You sometimes have the right to restrict the processing of your personal data or object to the processing of your data.
  • If you wish to withdraw consent for the processing of your personal data or otherwise restrict or object to the processing of your personal data please contact the Information Compliance Team.
• Rights to data portability. You have the right to receive your personal data City holds in a structured, commonly used and machine-readable format and have the right to transmit that data to another controller without hindrance from City.

Changes to this notice

City may amend this privacy notice and will occasionally update to reflect customer feedback and enhance its accessibility.

In that case, City will post notice of the change on its website and you will be deemed to have accepted such changes.

City encourages you to periodically review this notice to be informed of how the institution is protecting your privacy.

Contact details

As a public body, City has appointed Dr Emma White as the Data Protection Officer (DPO). Should you have any concerns about your personal data at City please contact the DPO by email.

Additional guidance can be sought from the Information Governance team by telephone +44 0)20 70 40 4000 or email dataprotection@city.ac.uk.