University sharing student records for research

Short answer

In many circumstances a university in England and Wales can lawfully use your student records for research, and can share them with researchers, without asking for your separate consent. This surprises many people, but under UK data protection law “consent” is only one of several possible lawful bases for processing personal data, and for a public authority like a university it is usually not the one relied on for research. However, this is not an unlimited power. It only applies where specific conditions and safeguards are met, and you retain a number of rights. Whether a particular use is lawful depends on the facts.

The legal framework

The relevant law is the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Your student records are personal data, and some of the information they contain may be special category data (for example data revealing health, disability, ethnicity, or religious belief) which attracts extra protection.

Every use of personal data needs a lawful basis under Article 6 UK GDPR. Consent is only one of six bases. The Information Commissioner’s Office (ICO) states that for a public authority such as a university, the most likely lawful basis for research is not consent but public task, meaning processing that is necessary to perform a task in the public interest or an official function that has a clear basis in law. Research and the advancement of knowledge fall within the recognised public functions of universities. Legitimate interests is the basis more commonly relied on by private or commercial bodies.

This is why a university can often process your records for research without asking you to opt in. Consent as a formal lawful basis under data protection law must be freely given, specific and capable of being withdrawn, and the ICO and the Health Research Authority both note that in the university context it is frequently unsuitable as the data protection basis, even though ethical consent to take part in a study is a separate matter.

The research provisions and their conditions

The UK GDPR and Data Protection Act 2018 contain specific “research provisions” that give organisations some flexibility when processing personal data for research, statistical or archiving purposes in the public interest. These provisions can, for example, relax the usual rules on using data for a new purpose and on how long data may be kept.

That flexibility is conditional. To rely on the research provisions the processing must meet safeguards set out in section 19 of the Data Protection Act 2018. In particular the processing must not be likely to cause substantial damage or substantial distress to an individual, and it must not be used to take measures or decisions about a particular individual. In practice this means genuine research uses aggregated or de-identified data and does not make decisions about you personally. If special category data is involved there is an additional requirement for the processing to be in the substantial public interest or otherwise to meet a specific condition in the Act, backed by an appropriate policy document.

So the position is not that a university can do anything it likes with your records under the banner of research. It can use them where the use genuinely qualifies as research in the public interest and the statutory safeguards are satisfied.

Sharing with external researchers

Sharing records with researchers, including researchers at other institutions, is possible but adds further requirements. The university must still have a lawful basis, and it must comply with the data protection principles of fairness, transparency, purpose limitation and data minimisation. In practice a well run university will:

1. Share data in de-identified or pseudonymised form wherever possible, so individuals are not readily identifiable.

2. Put a data sharing agreement or contract in place setting out how the data may be used, secured and eventually destroyed.

3. Require ethical approval through a research ethics committee before the research proceeds.

If genuinely anonymised data is shared, so that no living individual can be identified from it or from it combined with other available information, then it is no longer personal data at all and data protection law does not apply to that transfer. Much research sharing is done on this basis.

Transparency and your right to be informed

Even where consent is not required, the university must tell you how it uses your data. This is normally done through a privacy notice or student data protection statement, which should explain that records may be used for research and statistical purposes and on what lawful basis. If you have never seen such information, you are entitled to ask for it. The research provisions do contain a limited exemption from the duty to inform individuals where data is obtained from another source and providing the information would involve disproportionate effort, but that exemption is narrow and does not remove the general expectation of transparency.

Your rights and how to object

You retain data protection rights even when the university relies on public task rather than consent.

If the lawful basis is public task or legitimate interests, you have the right to object to processing under Article 21 UK GDPR. Where you object to processing for research purposes, the university must stop unless the research is necessary for a task carried out in the public interest, in which case there is a balancing exercise. Section 19 of the Data Protection Act 2018 can limit the right to object where the research results would be impaired and appropriate safeguards are in place, but a genuine objection should still be considered.

You also have the right to make a subject access request to see what personal data the university holds and to be told how it is being used. This is often the most useful first step because it forces the university to set out the basis and purpose of any research use.

If you consider the university has misused your data, you can complain to the university’s data protection officer, and if unsatisfied you can complain to the ICO, which is the regulator for data protection in the UK.

Practical next steps

1. Read the university’s student privacy notice or data protection policy, which should set out research uses and the lawful basis.

2. Ask the data protection officer directly whether your records are being used for research, what lawful basis is relied on, whether the data is identifiable or anonymised, and whether it is shared externally.

3. If you object to a particular use, put your objection in writing under Article 21 and ask the university to explain its response.

4. Consider a subject access request if you want to see exactly what is held and how it is processed.

5. If you remain dissatisfied and believe the law has been breached, complain to the ICO.

Points that could change the answer

The outcome depends on several facts that you have not given. It matters whether the data is genuinely anonymised or still identifiable, because anonymised data falls outside these rules entirely. It matters whether special category data such as health or ethnicity is involved, because that requires an additional condition. It matters whether the “research” is genuine research in the public interest or is in truth a decision affecting you individually or a commercial or marketing exercise dressed up as research, because the research safeguards do not cover use to make decisions about identified individuals. It also matters what your specific university’s privacy notice actually says, since that documents the basis it relies on. If you can tell me the type of research, whether external bodies are involved, and what your privacy notice states, I can give a more precise assessment.