Lawyer Destroyer

Short answer There is no absolute ban on university staff using AI tools in their work, but they cannot lawfully upload material that contains your personal data to an external AI tool without a proper legal basis, and in most cases without being transparent about it. Whether a particular use is lawful depends on what … Read more

Short answer A university can introduce an attendance app, and it may lawfully process some device or location data through it, but only within the limits of UK data protection law. Any location tracking must be genuinely necessary and proportionate to the purpose of recording attendance, and cannot go further than that purpose reasonably requires. … Read more

Short answer In most cases, no. If a decision is significant enough to affect your legal position or something of comparable importance to you, and it is made purely by an AI or automated system with no genuine human involvement, data protection law gives you rights that will usually entitle you to human intervention, an … Read more

Short answer It depends on why the data is being shared and what legal basis applies. Under the UK GDPR and the Data Protection Act 2018, sharing your attendance, marks or disciplinary record with a third party is “processing” of your personal data, so your university needs a lawful basis to do it. Crucially, that … Read more

Yes, in many circumstances your university can lawfully share your personal data with the police without your consent and without a court order. The short answer is that neither your consent nor a court order is a legal prerequisite for such disclosure under data protection law. However, the university cannot do this at will. It … Read more

Short answer Yes, in principle your university can transfer your personal data outside the UK through cloud services or external providers, but only if it complies with the international transfer rules in the UK GDPR and the Data Protection Act 2018. A transfer is not unlawful simply because the data leaves the UK. What matters … Read more

Short answer In principle, yes, a university can require you to use a third-party app or platform that processes your personal data, but only within the limits set by data protection law and by its own duties as a public authority or contracting body. The requirement is not automatically unlawful just because a private company … Read more

Short answer There is no absolute right to have your coursework kept out of a plagiarism database, and there is no simple ban on long retention. But “indefinitely” is not usually lawful in the sense the word suggests. Under UK data protection law your work, insofar as it identifies you or is linked to you, … Read more

Short answer It depends on what the material is, whether it identifies you, what your university’s policies and agreements say, and whether an appropriate legal basis exists. There is no blanket rule that lets a university use your coursework, recordings or messages to train or test an artificial intelligence system without regard to your rights. … Read more

Overview In England and Wales there is no single “image rights” or “personality rights” law that automatically stops anyone using your name or image. Instead, whether your university can use your name, photograph, video, voice or testimonial in marketing depends mainly on data protection law, and to a lesser extent on the law of confidence, … Read more

Who is legally responsible Under the UK GDPR and the Data Protection Act 2018, responsibility depends on who determines the “purposes and means” of processing your personal data, not on whose logo is on your certificate or who teaches the classes. The organisation (or organisations) that decides why and how your data is processed is … Read more

Short answer Yes, in many situations your university can lawfully share limited personal data with the students’ union without asking for your consent, provided it has another valid lawful basis under the UK GDPR and the sharing is fair, necessary and covered by a proper privacy notice. Consent is only one of six lawful bases, … Read more

Short answer In many circumstances a university in England and Wales can lawfully use your student records for research, and can share them with researchers, without asking for your separate consent. This surprises many people, but under UK data protection law “consent” is only one of several possible lawful bases for processing personal data, and … Read more

Short answer For the core statutory reporting, no, you generally cannot opt out. Your university is legally required to report certain data about you to bodies such as the Higher Education Statistics Agency (HESA, now part of Jisc) and the Office for Students (OfS), and in some cases the Education and Skills Funding Agency (ESFA), … Read more

Short answer In almost all cases you can decline to give equality-monitoring information, and universities are expected to design their forms so that answering is optional. Whether you have a formal legal right to object under data protection law depends on the lawful basis the university is relying on. Where the collection is genuinely voluntary … Read more

Yes. You have a right under data protection law to obtain footage that shows you, whether it is fixed CCTV or body-worn camera footage held by the university. The mechanism is a subject access request (SAR) under Article 15 of the UK GDPR and the Data Protection Act 2018. The key practical problem you have … Read more

Short answer Yes, a university in England and Wales can lawfully use CCTV, ANPR and body-worn cameras to monitor parts of its campus, but only within limits set by data protection law. These cameras capture personal data, so the university (as data controller) must comply with the UK GDPR and the Data Protection Act 2018. … Read more

Short answer You do not have to put up with unwanted alumni fundraising or marketing. Once you graduate, your university has no automatic right to keep contacting you for these purposes. You can require it to stop, and depending on how it contacts you, it may need your active consent before contacting you at all. … Read more

Short answer Your marks and results, when linked to your name or student number, are your personal data. Under the UK GDPR and the Data Protection Act 2018 a university can only publish or display them if it has a lawful basis and complies with the data protection principles, in particular transparency and fairness. In … Read more

Short answer Yes, in principle a university can include your student email address and certain contact details in an internal directory, but only if it does so in a way that complies with UK data protection law. Your email address and other contact details are personal data under the UK GDPR and the Data Protection … Read more