Code of Student Discipline Privacy Notice

B: The type of personal information we collect

C: How we get your personal information and why we collect it

D: How we store your personal information

A: Introduction

This privacy notice describes how Abertay University processes personal data for the purpose of administering the Code of Student Discipline: Academic Misconduct and the Code of Student Discipline: Non-Academic Misconduct.

The notice also explains how we use your personal data in accordance with your rights under the UK Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).

B: The type of personal information we collect

We currently collect and process the following information:

Information such as your name, status (i.e. student, staff or member of public), student ID (if applicable), email address and telephone number.
Information relating to your academic school, programme of study and year of study (if applicable).
Details of anyone you have chosen to represent you.
Information relating to the nature of the misconduct such as the relevant staff/students name, the number of incidents being reported, the type of incident (i.e. academic deceit, harassment, violent behaviour, discrimination, abusive language etc), the location, date and time and the University School, Service or Department involved.
Healthcare information and healthcare professional contact details in support of misconduct investigations and appeals - details and evidence of any advice, guidance or diagnosis provided to you by a healthcare professional.
We may also collect information including ethnic/racial origin, disability, religious belief, gender, age, sexual orientation, national (UK/EU/international) status, and criminal conviction data.

C: How we get your personal information and why we collect it

Most of the personal information we process is provided to us directly by you for the following reason(s):

To enable members of staff in the relevant University departments to investigate and make decisions on allegations of misconduct.
To respond to allegations of misconduct.
To enable support measures.
The provision of annual reports on academic and non-academic misconduct provided to University management and committees. All reports are comprised of anonymous statistical information, so your privacy is not affected.
The University has a legal requirement to monitor student information including ethnic/racial origin, disability, religious belief, gender, age, sexual orientation, and national (UK/EU/international) status, and similar, in relation to student misconduct, to ensure that no particular group is discriminated against, and to comply with equality and diversity legislation. This information is used securely and confidentially by a small number of administrative staff, for statistical monitoring and anonymised reporting only, to ensure non-discrimination.

We also receive personal information indirectly, from the following sources in the following scenarios:

Academic staff about studies.
Information including ethnic/racial origin, disability, religious belief, gender, age, sexual orientation, national (UK/EU/international) status, course and student status may be collected from University systems (if applicable).
Personal data may, exceptionally, be received from the police, or to other bodies with investigative powers, for the prevention and investigation of crime.
Support services.
Other local services (e.g. social services, criminal justice services, adult and child protection services).
Other relevant parties (i.e. responding students, reporting people and witnesses).

We may share this information with the following internal and/or external parties:

Academic staff about support and/or precautionary measures for studies.
Personal data may, exceptionally, be disclosed to the police, to the Student Award Agency for Scotland or to other bodies with investigative powers, for the prevention and investigation of crime.
Personal data may, exceptionally, be disclosed to the emergency services or to a health professional in order to protect your vital interests or those of another individual, for example in an emergency where this is a risk to a person or persons.
Some statistical and/or anonymised reporting information will be published and disclosed to relevant external regulatory bodies, as required by the Equality and Human Rights Commission and the Scottish Public Services Ombudsman.
Support services about support referrals.
Other local services (e.g. social services, criminal justice services, adult and child protection services).

Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:

We need it to perform a public task. We process your personal data to carry out our public task to provide education under the Further and Higher Education Act 1992, part of which involves us operating a suitable Student Discipline process.

Under Article 9 of the UK GDPR, the lawful bases we rely on for processing your special category information (e.g. health, ethnic/racial origin, disability, religious belief, sexual orientation, or information about your sex life) are:

Reasons of substantial public interest (with a basis in law). Your personal data is processed for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people with a view to enabling such equality to be promoted or maintained. This is enabled by the Data Protection Act 2018, Schedule 1, Part 2 – s8 – equality of opportunity or treatment and the Equality Act 2010.

We may also be required to process your special category information where this is necessary in order to properly conduct the Student Disciplinary process. This is also on the basis of substantial public interest (with a basis in law) enabled by the Data Protection Act 2018, Schedule 1, Part 2, - s6 – Statutory purpose (i.e. to deliver and manage education under the Further and Higher Education Act 1992).

We do not actively seek to collect information as part of the Student Disciplinary Process however it is on occasion provided to us. To the extent it is relevant to the Disciplinary Process, we will process it under the requirements of Article 10 of the UK GDPR. The basis we rely on for processing your criminal convictions and offences data is:

Reasons of substantial public interest (with a basis in law). Your personal data is processed in order to properly conduct the Student Disciplinary process. This is enabled by the Data Protection Act 2018, Schedule 1, Part 2, - s6 – Statutory purpose (i.e. exercising official authority laid down by law under the Further and Higher Education Act 1992).

D: How we store your personal information

Your information is securely stored using the University’s business systems. The University is obliged to protect personal data under the UK GDPR and Data Protection Act 2018 and has established protocols for the safeguarding of data.

The University will retain your personal data only as long as is necessary in accordance with the JISC record retention guidance (last action on case + 6 years).

E: Your data protection rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you, or in certain circumstances we may extend our time to respond by a further two months, considering the complexity and number of requests.

Please contact us at studentconduct@abertay.ac.uk if you wish to make a request.

F: How to contact us

If you have any concerns about our use of your personal information, you can contact the University’s Data Protection Officer (DPO):

Data Protection Officer
Abertay University
Kydd Building
Bell Street
Dundee DD1 1HG
Tel: 01382 308000 email: dataprotectionofficer@abertay.ac.uk

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

G: Changes to this Notice

We may update this notice at any time. Please check this notice regularly to be aware of any changes and should any change affect your rights and interests, we will bring this to your attention and explain any impact to you.