Student Casework Privacy Notice

Student Casework Privacy Notice

This privacy notice tells you what to expect us (the University of South Wales) to do with your personal data when you:

  1. Bring a case forward to the Student Casework Unit
  2. Are subject of a Student Casework investigation
  3. Are related to a Student Casework investigation

The University is the ‘controller’ of the personal data and the University’s Data Protection Officer can be contacted at [email protected].

How is personal data used and what legal basis allows us to process the personal data for these purposes?

The Student Casework Unit processes personal data in order to be able to apply the below regulations, to operate their associated procedures and to determine case outcomes:

  • Student Complaints Regulations
    • Student Complaints Procedure
  • Academic Appeals Regulations
    • Academic Appeals Procedure for Taught Courses
  • Student Code of Conduct
  • Non-academic Misconduct Regulations
    • Sexual Misconduct and Violence Policy
    • Procedure for Stage 1: Cause for Concern (for students on courses leading to professional registration e.g. Nursing)
    • Procedure for Stage 1: Non-major misconduct
    • Procedure for concerns for post-reg students
    • Procedure for investigations into student misconduct
    • Procedure for disciplinary hearings
    • Procedure for requests for review
    • Procedure for requests for legal representation
    •  Risk Assessment Procedure
  • Extenuating Circumstances Regulations and Procedure (Review stage only)

Our purpose is to carry out investigations in accordance with academic and misconduct regulations.

The lawful basis we rely on to process personal data relating to reporting and responding students is article 6(1)(b) of the UK GDPR, which allows us to process personal data when this is necessary for the performance of a contract with the student.

For students bringing cases to the University and student disciplinary matters, it is the student’s decision how much personal data to provide.

For staff of the University, staff are expected (as part of their employment contract) to provide information that is relevant to cases on request, for the University to be able to conduct its procedures. However, staff would not be expected to provide personal information about themselves, aside from their name and contact details and any relevant personal information contained within their version of events. In the case of student complaints under Student Casework where a staff member has been named, this is not a disciplinary investigation; although should information arise through the investigation that indicates there has been serious misconduct, this would be referred to HR to assess.

The lawful basis we rely on to process personal data relating to staff and other individuals relating to cases is article 6(1)(e) of the UK GDPR, which allows us to process personal data where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. As a higher education corporation, the University’s powers derive from the Education Reform Act 1988 (“the Act”). The primary power conferred on the University under the Act (by section 124(1)(a)) is the provision of higher education. However, in accordance with section 124(2) of the Act, the University has the “power to do anything which appears to the corporation to be necessary or expedient for the purpose of or in connection with the exercise of any of the powers conferred on the corporation by [the Act]. This lawful basis applies when the processing is necessary for the purposes of providing higher education services to students in a safe environment.

We may need to process ‘Special Category’ personal data for the purposes of a Student Casework investigation. If the information we collect or otherwise process contains special category data, such as health, religious, sexuality or ethnicity information, the lawful basis we rely on to process it is article 9(2)(g) of the UK GDPR, which relates to reasons of substantial public interest with a basis in law and the safeguarding of your fundamental rights, and where a condition from Schedule 1 of the DPA2018 applies. We will only process information relating to criminal offences where a condition from Schedule 1 of the DPA 2018 applies. We will only collect this type of information where it is relevant to the investigation or case, or where we are legally obliged to record it.

What information do we collect for these purposes?

When a case is opened with the Student Casework Unit, under any of the listed procedures, we will create a case file. This file will store all the information and data gathered in the process of carrying out that procedure and determining an outcome.

The Student Casework Unit gathers HESA data for students who bring forward or are the subject of a case. HESA data is information provided by students to the University at the beginning of each year specifying protected characteristics, such as religion or disability. However, this is for annual reporting purposes only and is not otherwise shared or used. On reporting, HESA data is always presented anonymously, meaning that it is not possible to identify any individual.

Personal data relating to students who are bringing a case forward to the University (Reporting Students):

This usually includes students who are reporting misconduct against another student, and students who are raising a complaint, appeal or requesting a review of an Extenuating Circumstances decision.

The data we gather includes:

  • Name;
  • Contact details;
  • Course information and, where relevant, academic data;
  • Information about reasonable adjustments;
  • Relevant background / details including the evidence, information and representations put forward in respect of the case.

Personal data relating to students who are the subject of a case (Responding Students):

This usually includes students who have had an allegation of misconduct raised against them, or are subject to precautionary actions under the Risk Assessment Procedure.

The data we gather includes:

  • Name;
  • Contact details;
  • Course information and, where relevant, academic data;
  • Information about reasonable adjustments;
  • Relevant background / details including the evidence, information and representations put forward in respect of the case.

Personal data relating to students who are related to a case:

This is usually students who are invited to provide input on a case; for example, if they witnessed an incident of alleged misconduct by another student.

The data we gather includes:

  • Name;
  • Basic contact details;
  • If relevant to the case, course information and academic data;
  • Information about reasonable adjustments;
  • The relationship of the individual to the case;
  • Relevant background / details including the evidence, information and representations put forward in respect of the case.

Personal data relating to staff members who are related to a case:

This usually includes the staff member who has raised an allegation of non-academic misconduct, staff members who have witnessed non-academic misconduct, or staff members who are relevant to, but not the subject of, a complaint.

The data we gather includes:

  • Name;
  • Professional role;
  • University contact details;
  • Relevant background / details including the evidence, information and representations put forward in respect of the case.

Personal data relating to staff members who are the subject of a complaint:

This is where a student has raised a complaint that names a particular member of staff as central to their complaint.

The data we gather includes:

  • Name;
  • Professional role;
  • University contact details;
  • Relevant background / details including the evidence, information and representations put forward in respect of the case.

What information does the University receive from third parties?

We may request information from any third party who might be able to provide information that is relevant to our investigation.

For example, if someone is a witness to an incident, or if they can provide further information that is relevant to a case under our procedures. This could be a member of the University (staff or student) or, on occasion, it will be necessary to invite someone external to the University to provide their account.

Who might your personal data be shared with?

Personal data relating to students who are bringing a case forward to the University (Reporting Students):

Where a complaint or academic appeal is raised, the form, background and evidence will be shared with the Investigating Officer to allow them to carry out their investigation. This information may also be shared with other relevant and/or named members of staff, to allow them to respond and provide further information for the purposes of the investigation.

Information provided by students on their form regarding reasonable adjustments will be redacted, unless it is required as part of the Procedure and/or if it is appropriate to have a case conference with the Disability Service.

If it is necessary for an external party to provide an account in respect of a complaint, they will receive the basic information required for that account to be given. For example, if a student is on a course leading to professional registration, it may be appropriate to invite a member of placement staff to be interviewed.

Where misconduct is being alleged by one student against another student, the form and evidence submitted by the reporting student will be shared with the responding student and the relevant members of staff. The reporting student's academic data, personal contact details and information about reasonable adjustments will not be shared with the responding student.

Information on the form regarding reasonable adjustments will only be shared with members of staff where it is required as part of the Procedure and/or if it is appropriate to have a case conference with the Disability Service.

If the allegation raised by the reporting student proceeds to a hearing, the information provided by the reporting student would be shared with the committee; and, if applicable, with an external representative from the responding student's professional body. Where an impact statement is provided, this will be shared with the committee if the allegation is upheld.  

Where a review of an extenuating circumstances claim is requested, the form and evidence may be shared with other members of staff as necessary to consider the case.

Personal data relating to students who are the subject of a case (Responding Students):

Where an allegation of misconduct is raised against a student, the background of the case will be shared with the Investigating Officer to allow them to carry out an investigation. This information may also be shared with relevant staff members of the University e.g. if they are invited to be interviewed about the case, or form part of the committee at a disciplinary hearing.

If another student is invited to provide an account about the case, they will receive the basic information required for the account to be given.

If it is necessary for an external party to provide an account about the case, they will receive the basic information required for the account to be given. For example, if a student is on a course leading to professional registration, it may be appropriate to invite a member of placement staff to be interviewed.

Where a reporting student attends a disciplinary hearing, they will receive the documentation for consideration to allow them to represent their account fairly. A decision on the information to be provided to the reporting student on outcome and sanctions will be made on a case by case basis, supported by the Data Protection Officer.

Where an allegation proceeds to hearing for a student on a course leading to professional registration, this information will be shared with the external committee member whose role it is to provide input for that professional field.

If the outcome decided means the student can no longer continue on the professionally registered course, their professional body will be notified of the relevant details.

Where a risk assessment panel is convened to consider whether precautionary action should be put in place (e.g. suspension from campus), the relevant case details will be shared with the members of staff in attendance at the panel. Relevant details about precautionary action may be shared with reporting students, where this affects them (e.g. no contact agreements).

Student Casework will always make appropriate redactions before information is shared to ensure that only relevant and necessary information is provided.

Information regarding activity under the listed regulations and procedures may be shared with the Office of Independent Adjudicator (OIA), insurers or legal advisors if necessary. We will only share personal data with legal advisors if it is necessary for the exercise or defence of legal claims. 

Personal data relating to students who are related to a case:

Where students are invited to provide an account in respect of another student's case, this will form part of the case file and may be referenced in the findings of an investigation. The student who is the subject of the case will be entitled to request this information directly as part of the case file; redacted where detail is disclosed that is not relevant to them.

Where students give an account in respect of an allegation of misconduct that proceeds to a hearing, the account and evidence provided as part of the investigation will be shared with the committee, the responding student and, if applicable, the reporting student.

Personal data relating to staff members who are related to a case:

Where staff members are invited to provide an account in respect of a student's case, this will form part of the case file and as such may be referenced in the findings of an investigation and/or at a disciplinary hearing and be shared with the committee, the responding student and, if applicable, the reporting student. Personal data will not be shared with the parties unless it is necessary and relevant.

Personal data relating to staff members who are subject of a complaint:

Where a staff member is the subject of the complaint, the complaint form and evidence will be shared with HR to allow a case conference to take place and for it to be determined whether the case should be considered through Student Casework or referred to HR.

The complaint file will be shared with the Investigating Officer whose role it is to investigate the complaint.

The complaint form will be shared with the named staff member's line manager when inviting that staff member to be interviewed.

The report produced in respect of the complaint will be shared with the student(s) bringing forward the complaint and the Dean's nominee.

Where a complaint against a staff member is upheld and relates to possible misconduct, the report produced may be shared with HR for consideration.

Witnesses and reporting parties will usually not be able to remain anonymous, unless there is independent evidence corroborating their account and/or consideration of anonymous evidence/statements is deemed appropriate by the Head of Student Casework (or nominee).

NB. Where a student is studying at a partner institution, it may be required that data is also shared with that partner for the University to conduct a procedure. The sharing of data will be in line with the purposes stated in this Privacy Notice. 

We do not use any sub-processors to process data in relation to Student Casework investigations, other than Microsoft.

We may share personal data with other agencies if there is a lawful basis, for example - if it is necessary for the purposes of a legal claim or a police or regulatory investigation.

How long will personal data be held for?

Student Casework files are held for six years from the last date of action on the case. If action is ongoing, or continues after the case has closed, the date for deletion of the case file will extend in line with this.

Individual Data Protection Rights

Individuals have the right to access their personal information, to object to the processing of their personal data, to rectify, to erase, to restrict and to port personal information. Further detail can be found on the Information Commissioner's website.

Any requests or objections should be made in writing to the Data Protection Officer – [email protected].

Where individuals are not satisfied with the University’s response, or believe that the University is not processing personal data in accordance with the law then they may complain to the Data Protection Officer at the above address.

If the matter is not resolved and you remain dissatisfied, you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

www.ico.org.uk