cyber security

Privacy notice for external examiners

policy info

  • Last revised: November 2022

Contents

body

1. Introduction

1.1 This notice is for all external examiners working with University of West London (UWL) courses to explain the purposes for which we hold information about you (your personal data).

1.2 From 25 May 2018, your data will be held in accordance with the General Data Protection Regulation (GDPR).

1.3 UWL is registered as a Data Controller with the Information Commissioner. The University Secretary and Chief Compliance Officer is the Data Protection Officer. If you wish to obtain further information about the University's registration, it can be viewed on the ICO website. (University registration number: Z4666761).

1.4 All data is held and processed in line with the University’s Data Protection Policy which can be accessed here. All data which we receive from you, or from our Partner Institutions is kept securely and only used for legitimate purposes in connection with your contract as an external examiner.

2. How does the University collect your data?

2.1 Through the application process, you will be asked to confirm various personal, financial and academic details to the University. Further information is collected as you undertake your role in terms of your reports and comments on academic matters.

3. Types and categories of data

3.1 Your data will relate to your personal details, your contract record and any payment records, if you pay your fees to the University.

3.2 Your personal data may include ‘special categories of data’ as described under the GDPR. Such special categories will include racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

4. Purpose of collection and processing of student data

4.1 The University needs to process your personal data to manage and monitor your contract, and provide you with applicable services.

4.2 The University processes your personal data for the following purposes:

  • Administration of your appointment, including your reporting;
  • Provision of appropriate services such as payment;
  • Access to, and security of, University facilities, if applicable;
  • Carrying out statutory duties to provide information to external agencies (see 'Disclosures' for further details); 

4.3 The University also collects special categories of data such as ethnicity, religion or belief; sexuality. This information is used for monitoring, statistical and research purposes in order to meet public needs regarding equality of opportunity.

5. Additional notices and guidance/policies

5.1 We also have some additional notices, guidelines and policies with further useful information about the way in which we process your personal data:

The University’s Data Protection Code of Practice –This contains a lot of useful general information on data protection and University practices see our website.

Our website – we use Cookies (that will collect your personal data) on our web pages. Please see our policy on the use of Cookies.

HESA returns – where applicable, we are required to return important information (that will include your personal data) to HESA. Please see HESA’s collection notice together with other supporting information.

6. Legal basis for processing

6.1 Most of the data we collect from you is required to enable us to administer and monitor the delivery of your appointment. The provision of this data is part of the contract you form with the University when you accept an offer and are appointed.

6.2 An explanation of the basis for processing is attached at Appendix 1. The basis for the collection and processing of your data is outlined in drop downs below.

Data:

7. Disclosures to third parties

7.1 The University will disclose your data for third parties where this supports the educational process or where we are legally obliged to do so and details are contained in the drop downs below:

Disclosure to:

7.2 The University may from time to time make other disclosures without your consent. However, these will always be in accordance with the provisions of the General Data Protection Regulations.

8. Transfers to third party countries

8.1 Sometimes to achieve the purposes for which we are processing your personal data we may need to share your personal data with other organisations based within the European Union or if outside the European Union based in countries that have comparable levels of protection.

8.2 When it is necessary to share your data with organisations outside of the European Union such as Academic Partners, we will ensure that there are appropriate safeguards in place.

9. Retention periods

9.1 Your data will be retained as set out in the University’s Records Retention Schedule.

10. Your rights

10.1 Under the GDPR you have a right to request a copy of your personal data held by the University. The University is required to fulfil this request within 20 working days.

10.2 You also have the right to:

  • withdraw consent where that is the legal basis of our processing;
  • rectify inaccuracies in personal data that we hold about you;
  • request to remove some personal data we hold about you (this will not apply to your basic student record or data held as part of the University’s legal obligations)
  • restrict the processing in certain ways;
  • object to certain processing of your personal data by us.

10.3 Please see ICO website for further information on the above rights. You may also contact the Data Protection Officer for further information (university.secretary@uwl.ac.uk).

10.4 You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. 

11. Unwanted communication

11.1 We will from time to time communicate with you by email, post and telephone. If, at any stage, you are concerned about the content of these communications, e.g. unwanted marketing information, or wish to change the method of communication that we use please unsubscribe to general email communications.

11.2 If you are unsuccessful in unsubscribing from our communications and/or remain concerned, please contact our Data Protection Officer.

12. Your responsibilities

12.1 You have a responsibility to keep your personal details accurate and up to date and should notify the University of any changes.

12.2 External Examiners may, during the course of their contract, have access to personal information about other individuals. External Examiners are expected to treat this in a responsible and professional manner. You have responsibilities under the GDPR for any personal data relating to other people which you may access during your studies. This responsibility is in addition to any obligations arising from professional ethics or codes of conduct. Information obtained in the expectation of a duty of confidence should be treated as confidential and generally not disclosed without the subject's consent. The University will take a serious view of any breach of the GDPR by any of its members, including the consideration of disciplinary action.

12.3 If as part of your duties you breach data protection or discover a breach of data protection you must report this immediately to the University Secretary and the Information Security Manger in accordance with the University’s Breach Procedure.

Appendix 1

Legal basis for processing your data under GDPR

GDPR is new law and it has not yet been applied to circumstances similar in context to our relationship with students. The extent of lawful grounds for processing data has yet to be fully understood. Table 1 gives the University’s present view on the grounds for processing against each specified purpose. As legal views mature the University may change its views on its legal basis for processing.

(Article 6(1)(a)), Consent – on specific occasions the University will only process certain data if you consent e.g. on registration you only need to provide certain “special categories” of data if you agree that that.

(Article 6 (1)(b)), necessary for the performance of your student contract – on many occasions the University will process your data to enable it to meet its commitments to you e.g. those relating to teaching and assessment.

(Article 6 (1)(c)), necessary to comply with a legal obligation – the University does have legal obligations to provide your personal data to others e.g. HESA.

(Article 6 (1)(d)), for the purpose of protecting the vital interest of yourself or another – sometimes in extreme circumstances the University will have to release information to protect your interests or the interests of others e.g. in medical emergencies.

(Article 6 (1)(e)), processing necessary for the performance of a task carried in the public interest – the University is an educational establishment and in particular its educational activity is conducted in a public interest (including your interest and the interest of others).

(Article 6 (1)(f)), processing is necessary for the purposes of the legitimate interest of the University or a third party subject to overridden interests of the data subject – the University (and sometimes third parties) has a broad legitimate interest in activities that connect to the activities and education of students. Subject to those interests not being overridden by the interests of fundamental rights and freedoms of students, it will pursue those interests. A good example of this legitimate interest would be its Alumni activities. Where Article 6(1)(f) is used the “legitimate interest” is generally the interest of the University (or third party) in providing or supporting the provision of higher education to its students.

(Article 22(2)(a)), automated decision making necessary for performance of a contract – the University will sometimes automate decisions relating to its services it is providing to you.

(Article 9(1)(a)), processing “special categories” of data where you have given consent – the University will process certain sensitive information about you with your consent.

(Article 9(1)(g)), processing “special categories” of data where necessary for reasons of substantial public interest.

(Article 9(1)(f)), processing “special categories” of data in connection with legal claims. It is recognised that some of the above grounds will overlap and that the University could rely on multiple grounds justifying its lawful processing.

The University also reserves the right to rely upon other grounds that are not referred to under table 1.