Full privacy notice
This notice sets out information about who processes your information, what they use it for, the legal bases for this processing, and your rights under data protection legislation.
1. Introduction
The Office for Students (OfS) has commissioned Jisc Services Ltd to carry out work on awareness raising into degree fraud and bogus providers. This includes:
- Looking into suspected bogus degree providers and degree fraud and liaising with appropriate enforcement bodies;
- Raising awareness of bogus degree providers and degree fraud with students, registered HE providers and the wider public;
- Liaising with stakeholders to raise international awareness and develop strategy in relation to tackling bogus degree providers and degree fraud legitimate degree providers operating in England.
This notice sets out privacy information in relation to:
- Individuals who make enquiries or raise a concern directly in relation to suspected bogus providers;
- Representatives of providers, other HE organisations and stakeholders in connection with awareness raising.
2. Who we are
Hedd offers services within the UK Higher Education sector for candidate verification and university authentication. It undertakes work to protect UK universities, employers and graduates from degree fraud.
Hedd is a Jisc enterprise. Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB.
You can find more information about Jisc and Hedd at https://www.jisc.ac.uk/about and https://hedd.ac.uk/about.
The OfS is the regulator of the higher education sector in England and has certain statutory functions set out in the Higher Education and Research Act 2017. You can find more information about the OfS at https://www.officeforstudents.org.uk/.
Both the OfS and Jisc are registered with the Information Commissioner's Office (ICO). You can check our entry details on the ICO's website: https://ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/.
3. Data controller and Data Protection Officer
The OfS and Jisc (acting through Hedd) are joint "data controllers".
- The OfS requires Jisc to process personal data for the purposes of the activities that the OfS has commissioned them to undertake (and not for any other purposes).
- Jisc has a role in determining the information that is collected for the purposes of those activities and the manner in which the processing will be carried out.
The OfS and Jisc process personal data according to our joint controller agreement, which acknowledges that each controller is responsible for compliance with data protection legislation in regard to the data we individually process, and your personal data is not shared between the two organisations.
If you have any questions about how we use your personal information, please email or write to the relevant organisation:
Data Protection Officer
Office for Students
Nicholson House
Lime Kiln Close
Bristol
BS34 8SR
Email: dp@officeforstudents.org.uk
Data Protection Officer
Jisc
4 Portwall Lane
Bristol
BS1 6NB
Email: privacy@hedd.ac.uk
4. What personal information we will collect
The personal information we will collect and use as part of this activity is set out below.
Individuals who make enquiries or raise a concern directly in relation to suspected bogus providers
Jisc and the OfS will retain enquiries and any further correspondence, which could typically include the following personal data relating to those who raise concerns:
- Name
- Status and position, for example:
- current student and provider
- prospective student and provider
- position at provider
- position at other HE related organisation - Information about experiences with suspected bogus provider
- Any other volunteered information
Representatives of providers, other HE organisations and stakeholders in connection with awareness raising
Jisc and the OfS will use the following categories of personal data in order to liaise with you and establish networks in connection with bogus providers and degree fraud:
- Name
- Contact details
- Position at provider or other HE related organisation
- Correspondence
We may also collect and use information about individuals who are connected to organisations which are being monitored or which are suspected of being bogus or involved in degree fraud (for example, name, position, contact details).
5. How we will use your information
We can only use your personal information where we have a specific purpose or purposes for doing so.
Your personal information will be used to look into and raise awareness on the issue of bogus degree provision and degree fraud. To achieve this, the specific uses that will be made of your personal information are listed below:
Individuals who make enquiries or raise a concern directly in relation to suspected bogus providers
Where the OfS receives an enquiry or concern about a suspected bogus provider, it shall pass on that enquiry or concern to Jisc to look into. The OfS may share the name of the person raising the concern or enquiry (or any other personal data relating to that person) with Jisc.
Where Jisc receives an enquiry or concern about a suspected bogus provider, it shall look into the enquiry / concern, liaise with the OfS and, where appropriate, inform enforcement authorities. Jisc may share the name of the person raising the concern or enquiry (or any other personal data relating to that person) with the OfS.
The body who has received the enquiry (OfS or Jisc, or both) will keep a record of any communication you make with us for a period of up to six years. After that point, your personal information will be confidentially and securely disposed of.
Representatives of providers, other HE organisations and stakeholders in connection with awareness raising
Jisc and the OfS will use your name, position, contact details and any communication you make with us in order to liaise with you and establish networks in connection with bogus providers and degree fraud.
Jisc will retain this information for this purpose for the duration of the contract, due to end 30 November 2020. The OfS will retain this information in order to administer our public task or until it is superseded, whichever is earlier. After that point, your personal information will be confidentially and securely disposed of.
If we want to use your personal information for a reason other than those purposes set out above, we will tell you before we start that use and provide further information about the new purpose(s).
6. Legal basis for using your personal information
Under data protection legislation, we require a legal basis to be able to process your personal information for the purposes set out above.
In this case, our legal basis for processing your information is that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the OfS.
7. Who we give your personal information to
We will not routinely pass your information to any other organisation except where required to do so as part of our functions or by law. In some circumstances your personal data may be shared with enforcement agencies.
8. Where your personal information will be stored
Your personal information will be stored securely within the United Kingdom and will not be transferred outside that territory unless required by a court order.
9. How do we protect your personal information?
OfS has a number of security measures in place to protect your personal information, listed below:
- Accredited to the Cyber Essentials PLUS standard for cyber security
- All staff are required to undertake training in data protection and information security on joining OfS and then on an annual basis;
- Formal information security policies that must be read and understood by all staff;
- Personal information is only available to those members of staff who require access as part of their role.
Jisc also employ a number of security measures to ensure the protection of your personal information, including:
- Multi-tiered firewalls, real-time antivirus and malware detection;
- Segregated processing functions;
- Physical and environmental security and monitoring systems;
- All staff required to undertake data protection training on appointment and periodically thereafter;
- Formal data protection policies that must be read and understood by all staff;
- Alignment with and regular auditing to the ISO 27001:2013 Information Security Management System standard.
10. Your rights over your personal information
Once your personal information has been collected, you have certain rights in relation to that personal information that may be exercised. You have the right to request:
- A copy of your personal information;
- Inaccurate personal information held about you is corrected;
- Your personal information to be deleted;
- Processing of your personal information is restricted;
- A copy of your information in a format that allows easy transfer ("data portability");
- That you are not subject to automated decision making or profiling (if these take place).
All these rights have certain limitations depending on the request and the purpose for which we are holding your personal information. Further information can be found about these rights and our processes for handling such requests at:
https://www.officeforstudents.org.uk/privacy/individual-rights-under-the-general-data-protection-regulation/
If you have any concerns about the use of data for these purposes or would like to exercise one of your rights above, please contact OfS or Jisc (whichever organisation you have had contact with). The organisation you have had contact with (OfS or Jisc) shall be primarily responsible for providing you with information and / or ensuring your request to exercise your rights is properly addressed. Where your information has been shared between the OfS and Jisc (or you have had direct contact with both of these organisations), we shall liaise with each other in order to be able to properly respond to your request.
11. Complaints about the use of your personal information
If you are unhappy with the way in which your personal information has been handled by OfS or Jisc, please contact the relevant organisation via our Data Protection Officer (details in section 2) and we will try to resolve your issue informally.
If we are not able to resolve the issue to your satisfaction, you can also make a complaint to the data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) and they can be contacted at:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Email: casework@ico.org.uk
12. Changes to this notice
We keep our privacy notices under regular review and we will inform you of any changes to this notice by placing an update on our website.
This privacy notice was last updated on 01/05/2020