Access to student data profiling

Short answer

Yes, in most cases you have a legal right to find out that your university is creating risk scores, labels or profiles from your data, to see the personal data behind them, and to challenge them. The strength of your rights depends mainly on whether any decision affecting you is made in a fully automated way or whether a human is meaningfully involved. The main framework is the UK GDPR and the Data Protection Act 2018, enforced by the Information Commissioner’s Office (ICO).

What counts as a profile or risk score

Universities increasingly use “learning analytics” and other systems that combine data such as attendance, library and virtual learning environment (VLE) log-ins, submission patterns, grades, engagement metrics and sometimes wellbeing or financial data. When that data is used to evaluate or predict something about you, for example a “risk of failing”, “risk of non-continuation”, “wellbeing concern”, “academic misconduct risk” or an engagement flag, that is profiling under Article 4(4) UK GDPR. The score, label or category produced is itself your personal data.

Your right to be told this is happening

The university must be transparent about profiling under the transparency and privacy information duties in Articles 13 and 14. Its privacy notice (often called a student privacy notice or data protection notice) should tell you what data it uses, the purposes, the lawful basis, retention periods and whether it carries out profiling or automated decision-making. If profiling is going on and this is not explained, that is itself a compliance failure you can raise.

Your right to see the data and the profile (subject access)

Under Article 15 you can make a subject access request (SAR) for a copy of your personal data. This includes the input data used in the profile and, importantly, the output such as the score, label, category or risk rating that the system has generated about you. You are also entitled to supplementary information, including:

The purposes of the processing and the categories of data involved. Who your data has been or will be shared with. How long it will be kept. The existence of any automated decision-making, including profiling, together with meaningful information about the logic involved and the significance and envisaged consequences for you.

A SAR is normally free, and the university must respond within one month (extendable by up to two further months where the request is complex). You do not have to use any particular form, but it helps to write to the data protection officer, say clearly that you are making a subject access request under Article 15, and ask specifically for any risk scores, flags, labels, categories or profiles held about you, the underlying data, and the logic and consequences of that profiling.

A key limit: the “meaningful information about the logic” duty means the university must explain in understandable terms how the system reaches its results. It does not usually have to hand over the full source code or a trade-secret algorithm, and it can redact other people’s personal data or genuinely confidential material. But it cannot refuse to tell you the score exists or broadly how it was produced.

Your right to challenge and correct

You have several overlapping rights to challenge a profile:

Rectification (Article 16). If the underlying data is inaccurate, or an inference or label is based on inaccurate data, you can ask for it to be corrected. Note that opinions and predictions are harder to challenge as “inaccurate” than factual errors, but if the facts feeding the profile are wrong you can require correction.

Objection (Article 21). Where the university relies on “public task” or “legitimate interests” as its lawful basis (universities usually rely on public task or legitimate interests rather than consent for analytics), you can object to processing, including profiling, on grounds relating to your particular situation. The university must then stop unless it shows compelling legitimate grounds that override your interests, or that the processing is needed for legal claims.

Erasure and restriction (Articles 17 and 18). In some circumstances you can ask for data to be erased or for processing to be paused while a dispute about accuracy or your objection is resolved.

Fully automated decisions get stronger protection

Article 22 gives you extra rights where a decision is based solely on automated processing (no meaningful human involvement) and it produces a legal effect or a similarly significant effect on you. A decision to exclude you, fail you, refuse support, or trigger a disciplinary or fitness-to-study process could be “similarly significant”.

If a decision is genuinely solely automated and significant, it is prohibited unless one of the narrow exceptions applies (your explicit consent, necessity for a contract, or authorisation by law). Even where an exception applies, you have the right to obtain human intervention, to express your point of view, and to contest the decision.

In practice, most university risk-flag systems are designed so that a tutor, adviser or panel reviews the flag and decides what to do. That human involvement takes it outside Article 22, but only if the human review is genuine and not a rubber stamp. If staff simply act on the score without independent consideration, you can argue the decision is effectively solely automated and that the full Article 22 safeguards apply.

Special category and sensitive data

If the profiling uses or infers special category data, for example health or mental-health information for a wellbeing risk flag, the university needs an additional Article 9 condition (such as explicit consent or a substantial public interest condition under the Data Protection Act 2018). Profiling that infers sensitive matters from ordinary data attracts closer scrutiny, and this is a strong ground for objection if you are uncomfortable with it.

Data protection impact assessment

Large-scale profiling and scoring of students is high-risk processing, so the university should have completed a Data Protection Impact Assessment (DPIA). You can ask whether one exists and request a summary. A refusal to engage, or the absence of a DPIA for significant profiling, is a useful point if you complain to the ICO.

Practical next steps

1. Read the student privacy notice and any learning analytics policy on the university website to see what it already admits to doing.

2. Send a written subject access request to the data protection officer. Ask specifically for: all risk scores, flags, ratings, labels, categories or profiles held about you; the data used to generate them; meaningful information about the logic, significance and consequences; whether any decisions about you are automated; and a copy or summary of any relevant DPIA.

3. When you receive the response, check the underlying data for accuracy and check whether any label has affected decisions about you.

4. If something is wrong or unfair, write separately asking for rectification, objecting to the profiling under Article 21, and requesting human review of any decision, giving your reasons and any context the score missed.

5. If the university does not respond properly, use its internal data protection complaint route, then escalate to the ICO, which can investigate and order compliance. You also have a right to complain to the university’s own complaints process and, ultimately as a student, to the Office of the Independent Adjudicator for unresolved student complaints about how a decision affected you.

What would change the analysis

The precise position depends on several facts it would help to pin down: whether the profile actually drives a decision affecting you or is only used to offer optional support; whether any decision is genuinely human-reviewed; the lawful basis and any Article 9 condition the university relies on; and whether special category data is involved. If you can tell me what kind of score or label it is, what data feeds it, and what the university does as a result, I can give you a more targeted view and help you frame the request or challenge.