University sharing data with students union

Short answer

Yes, in many situations your university can lawfully share limited personal data with the students’ union without asking for your consent, provided it has another valid lawful basis under the UK GDPR and the sharing is fair, necessary and covered by a proper privacy notice. Consent is only one of six lawful bases, and for a university it is often not the one that applies. However, this is not unlimited. The type of data, the purpose of the sharing, and whether you have the right to opt out all matter.

Why consent is usually not the key issue

Under the UK GDPR (Article 6), an organisation must have at least one lawful basis to process personal data. Consent is only one of them. The Information Commissioner’s Office (ICO) is clear that you do not always need consent, and that consent is often not the most appropriate basis where the organisation has legal powers or public functions.

For universities and students’ unions, the bases most likely to apply to routine sharing are:

Public task (Article 6(1)(e)) – where the university or union is carrying out a function in the public interest or exercising official authority, for example administering union membership.

Legal obligation (Article 6(1)(c)) – where sharing is required to comply with a statutory duty.

Legitimate interests (Article 6(1)(f)) – for non-public bodies such as many students’ unions, where there is a genuine need that is not overridden by your rights.

Because one of these usually applies, the university does not generally need your consent to share basic membership data. That said, the university cannot simply invoke a lawful basis; it must have identified one properly, recorded it, and told you about it in a privacy notice.

The special position of students’ union membership

There is an important statutory background here. Under the Education Act 1994, students at a higher or further education institution are ordinarily automatically members of the students’ union, and the institution has statutory duties in relation to the union’s operation. Critically, the Act also gives every student the right to opt out of union membership without disadvantage.

This matters for data sharing in two ways. First, it means that administering union membership and elections is a recognised, lawful function, which supports the university sharing the basic personal data needed to run the union (such as name, student number and course) without individual consent. Second, if you have exercised your right to opt out of union membership, the justification for sharing your data with the union largely falls away, and continued sharing may not be lawful.

What kind of data, and for what purpose, makes a difference

The lawfulness of any particular disclosure depends heavily on what is being shared and why. Common lawful categories include:

Membership administration and elections – sharing basic identifying details so the union can maintain an accurate membership register and run democratic processes. This is typically justified without consent.

Statistical monitoring and reporting – sharing anonymised or aggregated data usually raises fewer issues; sharing identifiable data for monitoring needs a clear basis and a privacy notice.

Student conduct and welfare – where the university and union share information about disciplinary or safeguarding matters, this can be lawful but is more sensitive and must be necessary and proportionate.

Marketing and promotional material – this is treated differently. Direct marketing to you, particularly by electronic means, engages the Privacy and Electronic Communications Regulations (PECR) as well as the UK GDPR, and here consent or a clear opt-out is much more likely to be required. Genuine union democratic notices, health and safety and emergency communications are usually not treated as marketing.

Special category data – information such as health, disability, ethnicity or sexual orientation attracts extra protection under Article 9 UK GDPR and needs an additional condition beyond an ordinary lawful basis. Sharing this kind of data without consent is far harder to justify.

What the university must do to make sharing lawful

Even where consent is not needed, the sharing has to satisfy the wider data protection principles. In practice the university and union should have:

1. A clear lawful basis identified and documented for each type of sharing.

2. A data sharing agreement between the two organisations (many universities publish these), setting out what is shared and why.

3. A privacy notice that tells you, before or at the point the data is collected, that your data may be shared with the union, the purposes, the lawful basis and your rights. Fair processing under the transparency principle generally requires that you are informed of this sharing, even if you are not asked to consent.

4. Data minimisation, so only the data actually needed is shared, and it is kept accurate and secure.

If the university has never told you that this sharing happens, that is itself a potential compliance failing, even if a lawful basis could in principle exist.

Your rights

You have several rights you can use here:

Right to be informed – you can ask the university and the union for their privacy notices and the data sharing agreement, and ask which lawful basis they rely on.

Right of access – you can make a subject access request to see what personal data each holds about you and what has been shared.

Right to object – if the sharing relies on public task or legitimate interests, you can object under Article 21 UK GDPR, and the organisation must stop unless it shows compelling legitimate grounds. Where the processing is for direct marketing, your right to object is absolute.

Right to withdraw consent – if, and only if, the sharing genuinely relies on consent, you can withdraw it at any time and it should then stop.

Opt out of union membership – exercising your statutory right to opt out under the Education Act 1994 removes much of the justification for membership-related data sharing.

Practical next steps

1. Ask the university and the students’ union for their privacy notices and any data sharing agreement, and ask specifically what data they share, for what purposes, and on what lawful basis. Several universities publish these online.

2. Check whether the sharing you are concerned about is core membership administration (hard to challenge) or something more sensitive such as marketing or special category data (much easier to challenge).

3. If you object to the sharing, put your objection in writing under Article 21, or withdraw membership if that reflects your wishes, and ask them to confirm what they will stop doing.

4. If you are unhappy with the response, use the organisation’s internal data protection complaint route and contact its Data Protection Officer.

5. If it remains unresolved, you can complain to the ICO, which regulates data protection in England and Wales, and you may in principle bring a claim for any damage caused by unlawful processing.

What would change the answer

The outcome turns on facts you have not yet given. It would be different if the data involved is special category data, if the sharing is for marketing rather than administration, if you have opted out of union membership, or if the university never provided a privacy notice mentioning the sharing. If you can say what specific data is being shared and for what purpose, and whether you are still a union member, it is possible to give a much more precise assessment of whether the particular sharing you are worried about is lawful.