Student Accommodation: Key principles of data protection and privacy for universities

For student accommodation providers, the start of the academic year will require the processing of personal data of new residents. It is really important to ensure that data about students is being looked after carefully. Compliance with data protection laws in this area requires planning and careful thought.

Universities and other large educational institutions will almost certainly already have a data protection officer and various policies relating to the proper processing of students’ personal data. However, sometimes there may not be proper procedures in place which deal with the specific data protection, privacy and confidentiality issues which can arise in the context of student accommodation.

The Information Commissioner and the National Residential Landlords Association have both advised that landlords should register with the ICO, as landlords will inevitably process the personal data of their tenants. Compared to other landlords, student accommodation providers often take on a more involved ‘pastoral’ role with their residents, and this means collecting more personal data, and often quite sensitive personal data. This brings additional legal obligations.

To achieve compliance with the law and good practice, educational bodies who are also accommodation providers need to make sure that they have considered how to apply data protection principles to the way they deal with residents.

Tips for achieving compliance

Know who your data protection officer is.

Frontline staff will not be able to answer every question about dealing with personal data, but support is available as long as people know where to go for help. Your data protection officer can provide you with assistance and they are ultimately responsible for ensuring that your organisation is compliant.

Consider whether a custom privacy notice is needed

‘Data subjects’ have a right to be informed about the personal data which is being collected, and how it will be used. The usual way to comply with this is to provide a privacy notice or data processing statement at the time when the data is being collected.

Accommodation teams might be collecting and using data in way which are not contemplated by a generic university privacy notice. You may also be collecting data about other people, such as a guarantor.

Have a plan for how you will share data in emergencies

Hall managers are more likely to need to deal with emergencies than other university staff. Medical emergencies can require quick decisions about what data can be shared. Dealing with student welfare issues can result in difficult questions about how much information should be shared with parents. It is important to plan ahead so that staff know how to respond quickly, and who should make decisions of this nature.

Anticipate Subject Access Requests

Students (and others) can make requests for you to provide them with a copy of the personal data about them which you hold.  Requests normally need to be responded to within a month., so it is important to act quickly. These subject access requests can be made to any member of staff and do not even need to be in writing, so it is important that all staff are trained on data protection essentials, not just those working in any central data protection team.

How we can help

At Anthony Gold, we can support universities and other student accommodation providers with all aspects of managing halls of residence, including compliance with data protection law. As well as advising on any disputes, we can help you prevent data protection problems before they happen by reviewing policies and data processing statements and providing training.