Contractors, Short-term, and Voluntary Staff
The University is responsible for the use made of data by anyone working on its behalf, whether as an employee or in a voluntary capacity, as a consultant or contractor undertaking work for the University. Anyone in this position, therefore, must:
a) Ensure that any personal data made available by the University, or collected in the course of work undertaken for the University, is kept securely and confidentially. This applies whether the data is an integral part of the work, or whether it is simply contained on media or in places which contractors etc. need to access; it applies whether or not the University explicitly mentions the data in the contract.
b) Ensure that all such data is returned to the University on completion of the work, including any copies which may have been made in the course of working on, for example, computer systems.
c) Give the University details of any processing of personal data which will be necessary as part of a contract, so that the University can ensure that the appropriate data protection registration is made, and ensure that neither they nor their employees nor any sub-contractors carry out any processing other than that which has been agreed.
d) Give the University details of any need there will be to disclose any personal data supplied by the University to any other organisation or any person who is not a direct employee of the contractor. The University will need to satisfy itself that such disclosures are covered by its data protection registration, and they should not be made until the written consent of the University has been received. Where such disclosures are not covered by the registration, the University will advise the contractor or other worker that they should not be made unless or until consent is received from the data subjects concerned.
e) Ensure that any personal data made available by the University, or collected in the course of the work, is neither stored nor processed outside the UK unless written consent to do so has been received from the University.
Any enquiries about the working of the Data Protection Act 1998 should be referred in the first instance to the Pro Vice-Chancellor (Student and Staff Services). The Act can also be accessed on the World Wide Web at: http://www.legislation.gov.uk/ukpga/1998/29/contents