12. Collection & Processing of Personal Data Relating to Disability
12.1 General
Key areas for which the University needs to collect and process sensitive data is in service provision for disabled employees and students and mandatory monitoring and reporting. The University collects student disability information at the admission stage e.g. through UCAS, reference letters and interviews and employee disability information at interview stage. However, collection of disability data may also occur throughout the period of study or employment. University procedures are in place to protect an individual's privacy and permit necessary disclosure.
12.2 Disclosure by Individuals
12.2.1 There is a close correlation between disclosure of disability status and the University's ability to ensure that as full a range of support services as possible can be supplied, in order to make any reasonable adjustments as required by the Equality Act. We also need to demonstrate that we monitor this data to ensure that our equal and diversity policies are working.
12.2.2 The University therefore encourages staff and students to provide this information when requested. It will then be processed in accordance with Data Protection Legislation, this Code of Practice, and the University's Data Protection Policy Statement and Privacy Notices for staff and students. The data will only be made available to those people who strictly need to know for the purposes of e.g. employment, teaching, examinations, or domestic facilities, including student residential accommodation, to implement any relevant reasonable adjustments. In many cases it may be sufficient simply to tell another member of staff what adjustments are required to assist a staff member or student, without explaining the nature of their disability.
12.3 Seeking and Giving Consent
Where other Special Category legal bases are applicable, the University will rely on these to process Special Category (sensitive) personal data (see the University's Data Protection Policy Statement), however, where no alternative is applicable, the Univerity will rely on explicit consent. On every occasion and before consent is sought, the individual must be provided with Privacy Notice information which includes iinformation about the nature of the information to be disclosed, the intended recipient and the purpose for the disclosure. The means by which the disclosure will be made e.g. a secure encrypted means of transfer.
Blanket, or wide-ranging definitions of purpose on consent forms are inappropriate and the use of an opt-out must not be relied on to cover the transfer of such data. The template consent form for the disclosure of sensitive personal data should be used for this purpose.
Records of consent will usually be retained for 6 years after termination of the relationship with the individual/data subject and must be carefully managed to ensure that personal data can be deleted if consent is withdrawn. If it would not be possible for consent to be withdrawn e.g. the personal data is being retained for legislative or regulatory purposes, then you must consider an alternative legal basis to consent.
12.4 Where Consent is Withheld
Although members of staff need to take steps to find out if a student or staff member is disabled in order to put reasonable adjustments in place, a disabled person may request that the existence or nature of his or her disability is treated as confidential. The University cannot guarantee that in every case such a request will be adhered to since this will depend on the circumstances. As at 12.2.2 above, in some cases this can be overcome by advising what the reasonable adjustments are but in others the disabled person must be advised that this may adversely affect them where the University is not allowed to disclose the information.
12.5 Disclosure in Exceptional Circumstances
The University's procedure for the disclosure without consent, of sensitive information which may have been given in confidence, is referred to at section 8. of this Code. The provisions of the Equality Act do not override Data Protection legislation or Health and Safety legislation. If there is a genuine overriding health and safety risk, or there are issues about duty of care to a student or member of staff then it may be appropriate to make a disclosure without consent in exceptional circumstances, e.g. where there is:
- a serious risk to the health and safety of an employee or student
- a risk of serious abuse or exploitation
- behaviour which is seriously affecting others
- a possibility that a criminal or serious disciplinary offence has been committed
- serious concern that a student's health or behaviour may compromise the University's responsibilities to outside agencies, such as partner institutions or practice placements.
The procedure for any such disclosure is given in 
Section 8.5
12.6 Disclosure in References
These are dealt with in 
Section 19 of this Code of Practice.
12.7 Disclosure to Third Parties
Where it is necessary to disclose sensitive personal data e.g. details of a disability to a third party this should be done strictly in accordance with this Code of Practice, Section 7: Security of Personal Data and Section 8: Data Sharing.
12.8 Further Information
Further information for staff and students on equality and diversity is available at: Equality and Diversity at Edinburgh Napier University and on the Disability & Inclusion information site on myNapier.
Page last updated 23 June 2022