Data Sharing Agreement
1. Overview
The following agreement governs the provision of students’ personal information by the University of Reading to Reading University Students’ Union (RUSU) and explains the purposes for which that information may be used.
2. How students’ personal information will be used by RUSU
RUSU will use the personal information for the following purposes only:
2.1 Administration of elections
2.2 Administration of RUSU clubs and societies
2.3 Generate demographic reports
2.4 Verify student’s identity
2.5 Ticket Sales / Club & Societies Memberships
2.6 To allow email communication between RUSU and its members
2.7 To allow email communication between its Clubs & Societies members where no emails are visible to the sender (Sender; President or Secretary of the Club/Societies)
3. Information to be shared
3.1 The University will provide RUSU with the following student information from RISIS: mode of attendance; student code; year; first name; surname; Date of Birth; UG or PG; course code; course name; faculty; department; enrolment status; university email address; gender; Home or Overseas status for fee payments.
3.2 No sensitive personal data will be transferred between RUSU and the University.
3.3 The University will provide data for current students only and will exclude the following students:
3.3.1 Malaysian Law
3.3.2 College of Estate Management
3.3.3 Graduate Teacher Programme
3.3.4 International Foundation Programme
3.3.5 Continuing Education
3.3.6 research students at write up stage
3.3.7 studying outside the UK
3.3.8 non-UK based distance learning
3.3.9 studying abroad for a year
3.3.10 ‘opt outs’ by virtue of 8.
4. Information provision
4.1 Student information will be provided via regular secure electronic transfer. The transfer will ensure that RUSU, and
any data processor that RUSU uses, will hold up-to-date information at that time and ensure that the details of any students
who opt out of the data sharing agreement are not processed further.
5. Data transfer
5.1 UKMSL will act on behalf of RUSU to obtain student related data in co-operation with the University of Reading. The personal data will be transmitted to UKMSL electronically using the latest security measures to ensure the eight DPA principles are met.
6. Conditions for the processing student personal information
6.1 With regard to the use of students’ personal information, RUSU shall:
6.1.1 ensure compliance with the University’s Data Protection Policy (www.reading.ac.uk/data_protection ) and Guidelines (http://www.reading.ac.uk/internal/imps/DataProtection/imps-d-p-guidelines.aspx) where appropriate;
6.1.2 ensure compliance with the eight data protection principles in the Data Protection Act 1998 generally;
6.1.3 ensure that all RUSU staff, and any staff of data processors, handling student personal information, take and pass the Data Protection online training module (http://www.icr.ac.uk/icre8/org/Courses/reading/reading_dpa/html/) before processing begins.
6.1.4 ensure that any data processor it uses has security policies and procedures that ensure compliance with Principle 7 of the Data Protection Act 1998.
7. Restrictions on the use of information
7.1. The information provided by the University to RUSU shall not be passed to any third party without the express consent of the individual(s) concerned, except under the following conditions:
7.1.1. where RUSU has obtained the written or minuted permission from Chair of Students’ Union Liaison Committee.
7.1.2. where the information is released to a data processor to host RUSU’s website, RUSU shall ensure that that data processor is contractually:
7.1.2.1. Restricted from using the data for any other purposes other than those given in 2.
7.1.2.2. Obliged to comply with the conditions in 6.
7.2. The information provided by the University to RUSU shall not, without the express consent of the individual concerned, be used for the purpose of marketing services provided by organisations or individuals other than RUSU.
7.3 Students are given an option in each mailing to opt out of future mailings.
7.4 Information sent to students relates directly to the operational activities of RUSU or to products and services provided by RUSU which are of genuine benefit to students.
7.5 The University’s IT Services is given appropriate notification of bulk emails.
8. Student opt out rights
8.1 The following opt out procedures shall be in place:
8.1.1 If a student notifies RISIS that they object to their information being shared with RUSU then their personal information will no longer be included in the transfer of information.
8.1.2 Where a student opts out RUSU, or any data processors working on behalf of RUSU, shall ensure that their personal information destroyed and no longer processed without delay.
8.1.3 RUSU shall maintain a readily accessible and easy-to-use mechanism for students to opt out of having their personal information being processed by RUSU at any time.
9. Retention of information
9.1 RUSU will ensure that it adheres to the University’s records retention policies for student personal information.
10. Review and publication
10.1 This agreement is to be reviewed annually.
10.2 This agreement will be published on the University and RUSU websites and linked from the University’s fair processing notice, which new students consent to on enrolment: http://www.reading.ac.uk/web/FILES/stdserv/Studentdiary200910.pdf#nameddest=DataProtection