Page: 1 2 3
8. Data Sharing
8.9 Disclosures to Employees under Discrimination Legislation
The nature of the disclosures required by the University as an employer under e.g. the Equality Act 2010 will raise data protection issues for employees other than the employee making the enquiry. Advice and guidance must be sought from the Director of Human Resources or his/her Depute, or the University's Diversity Partner before any disclosures are made.
8.10 Verification of Attendance, Employment and Qualifications
8.10.1 The University will often be contacted by employment agencies, prospective employers and other third parties to verify details about a student or to ask if a member of staff is employed at the University. For the avoidance of doubt, enquiries such as these are distinguished from a request for a reference, for which separate guidance is provided.
8.10.2 As referred to in 8.6.1 ii) above, requests for verification of personal data will be dealt with under FOISA and should be submitted as required in 8.6.4 and 8.6.5 above. On receipt, the following will be considered:
i) whether an exemption should be applied under s.38 of FOISA; and
ii) any notice received from the individual under Data Protection legislation asking the University not to process their data
However, in circumstances where the University has already fairly and lawfully publicly disclosed the information requested e.g. by publication of award results by student name in the media or by inclusion of the member of staff’s name in an external staff directory and in the absence of an objection notice from the subject, then the exemption should not be applied.
8.10.3 Obtaining written consent from the individual concerned is the best way to proceed on this, but it is possible to provide confirmation without seeking consent. Data Protection legislation allows disclosure of data to a third party if it is for the purposes of a legitimate interest pursued by the third party and only if disclosure would not prejudice the “rights and freedoms or legitimate interests of the data subject”. E.g. confirming a student’s attendance to a formal financial sponsor, provided that there is evidence of a contractual arrangement, could be considered as a “legitimate interest” pursued by the sponsor and at the same time confirmation would also be in the legitimate interests of the student.
8.10.4 Where there is a legal right for the third party to receive confirmation, a disclosure would be justified. Under these circumstances, a bona fide third party requesting the confirmation should be prepared to explain the legal basis for their enquiry. If in doubt the University’s 
Information Governance Manager should be consulted before any disclosure is made.
8.10.5 If the subject is not known to the University, Data Protection legislation does not apply since no personal data is being held by the University and therefore this can be confirmed to the requester.
8.11 False Qualifications Claims
From time to time University staff may be asked to confirm the award or qualifications of a student, former student or member of staff, which may have been falsely claimed. As referred to in 8.6.1 ii) above, these requests should be handled under FOISA. Relevant staff must check first that any such enquiry is bona fide and in the legitimate interests of the enquirer to make by asking the enquirer to:
- submit the request in a letter on headed notepaper, which has been signed by an authorised representative of the organisation and addressed to a named member of University staff
- provide details of the personal data sought and the purpose and justification for the request, so that the University can consider whether the request is necessary and proportionate
Once these requirements have been met, the request should then be handled as follows:
8.11.1 In cases where the individual has never had a relationship with the University, it is permissible to confirm that the University holds no record of that individual.
8.11.2 If the individual has studied at the University and e.g. they failed a programme of study but are claiming that they were given an award, the enquiry should be directed to the Head of Student Administration, who will confirm only that the student has not achieved the award claimed and no disclosure will be made about any other award.
8.11.3 Where the qualifications of a member of staff are questioned, this should be directed to the relevant Head of School or Service who should seek advice where necessary from the Director of Human Resources or his/her Depute.
8.11.4 In all cases where it is established that a false claim has been made, the University will consider any appropriate action to be taken with regard to the claimant. This may include: requesting, where address details are held, that the claimant ceases to make incorrect and false claims, notifying other institutions from which the individual claims to have received an award or taking legal action where an individual persists in their false claim.
8.12 Further Information on Data Sharing
The UK Information Commissioner has published a 
Data Sharing Code of Practice.
Page: 1 2 3
Page last updated 04 September 2018