You're at your desk, adding to your to-do list faster than you are removing things, when you get a request from a colleague: "Hey, please could you send over that list of students from last year's placements, including their contact details? Cheers!" Its from someone you know well, but something about this doesn't sit right.
What would your Steward say?
You've been at the University of Bath long enough to know that data is not just 'admin stuff,' but a responsibility. You could take your spreadsheet from last year called Student_Contacts_FINAL_v2_THISONE.xlsx and hit reply, easy peasy, but wait...
You remember your local friendly Data Steward saying you should always use the official source, not local or personal copies. That means SAMIS, iTrent and the like. This ensures you are using the most up to date information - you wouldn't want to contact a student who withdrew! You also remember that personal data like student contact details should not be shared without a lawful basis; you don't know if the students have consented to their data being used in this way, nor whether its part of their contract with the University. Hmm. You ask your Data Steward for help.
Less really is more
After a quick chat with your Steward, you know what to do. You go back to your colleague to clarify the purpose and you realise they just need broad placement stats, not individual data. By minimising the data you share with them, you have fulfilled their request without compromising anyone's privacy. You also learn that its better not to give out personal information where possible, such as a name or date of birth, if you can use anonymised data instead.
ERROR
You're working on your next request, and you notice there are some inaccuracies in the data. You could fix them yourself, but you are not sure who else uses this data, or which other processes might be affected. You decide to log a Data Quality Issue with the Data Governance team, so they can find up the right Stewards, work out why the error occurred and prevent it happening again. They can also ensure that all parties that use this data are satisfied with any improvements or fixes. Marvellous.
As part of that discussion, you realise that being aware of the University's Glossary and Acronyms really helps prevent misunderstandings and ensures there are no more arguments about what the difference is between a student's fee status and domicile...
FOI? SAR? That's not my job
A few weeks later, another request comes in. This time, someone from the local paper asked for information on University spending. Now, you love spreadsheets as much as the next person, but Freedom of Information (FOI) requests or Subject Access Requests (SARs) are not something you handle with a quick email reply. You forward it immediately to the right mailbox:
- Freedom of Information: freedom-of-information@bath.ac.uk
- Subject Access Requests: dataprotection@bath.ac.uk
You also remember that these requests can and do extend to all recorded information, including Teams chats, emails, recorded meetings and so on. Even if someone requests data via Teams chat, email, or passing in the corridor, it’s all in scope. Always forward it to the team and let the experts handle it.
Summary
- 🦸♀️ Speak to your Data Steward - they have the answers!
- 🕵️♀️ Ensure you understand the lawful basis for processing your data.
- 🤏 Minimise, anonymise, redact.
- 📑 Log Data Quality Issues and use the Glossary and Acronym lookup.
- 📧 Send all Freedom of Information or Subject Access Requests to the right team immediately.
Our next blog post will be on Sharing Data and Information.
Respond