Privacy Notice - Course Enrolments

Who is collecting the information?

West Lothian College is the Data Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing:  GDPR@west-lothian.ac.uk  

Why are we collecting it and what are we doing with it (Purpose)?

When you enrol onto a course run at the College it is necessary to collect your personal information to process your enrolment, provide you with learner services during your time as a student and ensure resulting and certification at the end of your time on the course. This privacy notice is specific to the student enrolment purpose. The data you provide will be used by the college to process your enrolment to a course at the college.

The information you provide is also used to produce anonymised statistical analysis of students at the college for the purpose of curriculum planning and meeting government targets and ensuring we are providing accessible ways to interact with the college.

What personal data do we collect?

The lawful basis for the processing?

The legal basis for processing under data protection law if GDPR Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject” and 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The Post 16 Education (Scotland) Act 2013 and the Further and Higher Education (Scotland) Act 2005 detail the functions that Colleges are required to carry out.

For the processing of special category data, the legal basis is Article 9(2)(g) “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.” This is to meet the requirements of the Equalities Act 2010 and under the Data Protection Act 2018 Schedule 1(2)(8) Equality of opportunity or treatment.

Who we share the information with:

The College does share student personal data to the college marketing department and the Student Association. However, this is only shared if you have consented to receive marketing information or information regarding the Student Association. Both departments will provide a specific privacy notice for how they will use your data.

We share your data with various bodies to meet statutory requirements and to support our students in gaining their qualifications. These include, are not limited to,

• Awarding Bodies – e.g. Scottish Qualifications Authority (SQA), City & Guilds (C&G), Institute of Leadership and Management (ILM)
• Support Bodies – e.g. Skills Development Scotland (SDS), Street League
• Government/Public Bodies – e.g. Scottish Government, Education Scotland, West Lothian Council
• Student Funding & Debt Collection – e.g. Student Awards Agency Scotland (SAAS), Student Loans Company (SLC), Employers (if your employer is paying for course), Scottish Funding Council. TNC Collections
• College Software Providers – e.g. Microsoft, Capita FHE, SirsiDynix, Castle Computer Services
• Other Education Bodies – e.g Edinburgh Napier University, Queen Margaret University
• Auditors – e.g. Scott Moncrieff, Mazars.

Personal and Special Category data will be shared with the Scottish Funding Council (SFC) to allow them to allocate appropriate funding to colleges in line with Scottish Government strategies and their statutory duties. For more information on how the Scottish Funding Council use your personal data please see their student privacy policy on their website at http://www.sfc.ac.uk/about-sfc/how-we-operate/access-information/privacy-notice/college-student-data.aspx

Where we do share your personal data, this will be done securely and a data sharing agreement will be in place.

How long do we hold the personal data?

If you were selected as part of the European Social Fund programme, West Lothian College are required to hold this data until 2032.   If you are not part of the ESF programme the College will hold your data for eight years, covering seven full academic years plus the current academic year. Following this retention period, your personal data will be destroyed securely following college procedures.

Historical anonymised data will be held for statistical analysis for curriculum planning etc. The data will be destroyed securely following two years retention.

Individuals’ rights in relation to this processing

Under data protection law, individuals have a number of rights. These rights are as follows:

• Right to be Informed – i.e. a privacy notice
• Right of Access – this means that you can request access or copies of your personal data
• Right to Rectification – this means you have the right to correct inaccurate or incomplete data held about you
• Right to Erasure (commonly known as the Right to be Forgotten (RTBF)) – this means you have the right to request your personal data held is deleted/destroyed.
• Right to Restrict – this means you have the right to restrict processing of your data, this links with other rights and if there is disagreement then you can request the processing is restricted until the issue is resolved.
• Right to Object – this means you can object to how your data is processed.
• Right to Data Portability – this means you can request your personal data in a machine-readable format (e.g. a .csv file). You can also request that the organisation transfers the file to another organisation
• Right to know of any automated decision making, including profiling – the college does not do this with personal data, so this right does not apply.

Please note some of these rights only apply in certain circumstances and are not absolute. To exercise any of your rights please email the data protection mailbox at GDPR@west-lothian.ac.uk The College will process your request accordingly and respond within one month of receipt of your request.

Complaints to UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance please can you contact the College Data Protection Officer (DPO) at GDPR@west-lothian.ac.uk . If you are not satisfied with the outcome then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO has guidance on their website here: https://ico.org.uk/your-data-matters/raising-concerns/

You can email them at casework@ico.org.uk or call them on 0303-123-113 or you can send a letter to them at the following address:

Customer Contact

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

SK9 5AF