12. Collection & Processing of Personal Data Relating to Disability
Download this section as a print-friendly PDF document.
Key areas for which the University needs to collect and process sensitive data is in service provision for disabled employees and students and mandatory monitoring and reporting. The University collects student disability information at the admission stage e.g. through UCAS, reference letters and interviews and employee disability information at interview stage. However, collection of disability data may also occur throughout the period of study or employment. University procedures are in place to protect an individual's privacy and permit necessary disclosure.
12.2.1 There is a close correlation between disclosure of disability status and the University's ability to ensure that as full a range of support services as possible can be supplied, in order to make any reasonable adjustments as required by the Equality Act. We also need to demonstrate that we monitor this data to ensure that our equal and diversity policies are working.
12.2.2 The University therefore encourages staff and students to provide this information when requested. It will then be processed in accordance with the DPA 1998, this Code of Practice, and the University's Data Protection statements for staff and students. The data will only be made available to those people who strictly need to know for the purposes of e.g. employment, teaching, examinations, or domestic facilities, including student residential accommodation, to implement any relevant reasonable adjustments. In many cases it may be sufficient simply to tell another member of staff what adjustments are required to assist a staff member or student, without explaining the nature of their disability.
Explicit consent from the individual is normally required when processing sensitive personal data, including disability. This means that on every occasion and before consent is sought, the individual must be informed about the nature of the information to be disclosed, the intended recipient and the purpose for the disclosure. The means by which the disclosure will be made e.g. password protected or encrypted email must also be considered.
Blanket, or wide-ranging definitions of purpose on consent forms are therefore inappropriate and the use of an opt-out must not be relied on to cover the transfer of such data. The template consent form for the disclosure of sensitive personal data should be used for this purpose.
Although members of staff need to take steps to find out if a student or staff member is disabled in order to put reasonable adjustments in place, a disabled person may request that the existence or nature of his or her disability is treated as confidential. The University cannot guarantee that in every case such a request will be adhered to since this will depend on the circumstances. As at 12.2.2 above, in some cases this can be overcome by advising what the reasonable adjustments are but in others the disabled person must be advised that this may adversely affect them where the University is not allowed to disclose the information.
The University's procedure for the disclosure without consent, of sensitive information which may have been given in confidence, is referred to at section 8. of this Code. The provisions of the Equality Act do not override the Data Protection Act or Health and Safety legislation. If there is a genuine overriding health and safety risk, or there are issues about duty of care to a student or member of staff then it may be appropriate to make a disclosure without consent in exceptional circumstances, e.g. where there is:
- a serious risk to the health and safety of an employee or student
- a risk of serious abuse or exploitation
- behaviour which is seriously affecting others
- a possibility that a criminal or serious disciplinary offence has been committed
- serious concern that a student's health or behaviour may compromise the University's responsibilities to outside agencies, such as partner institutions or practice placements.
The procedure for any such disclosure is given in Section 8.5
These are dealt with in Section 19 of this Code of Practice.
Where it is necessary to disclose sensitive personal data e.g. details of a disability to a third party this should be done strictly in accordance with this Code of Practice, Section 7: Security of Personal Data and Section 8: Data Sharing.
Further information for staff and students on equality and diversity is available at: Equality and Diversity at Edinburgh Napier University and on the Disability & Inclusion information site on myNapier.