HESA student data collection notice

Data collection at City, University of London

Every year City, University of London will send some of the information it holds about you to HESA (“your HESA information”). HESA is the official source of data about UK universities, higher education colleges, alternative HE providers, and recognised higher education courses taught at further education institutions in Wales. HESA is a registered charity and operates on a not-for-profit basis.

Submission of your information to HESA

Your HESA information is used for a variety of purposes by HESA and by third parties as described below. HESA may charge other organisations to whom it provides services and data. Uses of your HESA information may include linking parts of it to other information, as described below. Information provided to HESA is retained indefinitely for statistical research purposes. Your HESA information will not be used to make automated decisions about you. The extent to which your HESA information will be used for purposes 4-5 and 8 will vary.

HESA processes information about UK and other nationals, including EU nationals. Accordingly, all uses of HESA information must comply with the General Data Protection Regulation (“GDPR”) (including UK and EU versions) and the Data Protection Act 2018 (DPA).

Data Futures: Processing personal data

If your HESA information is processed as part of this programme it will be used by HESA and your provider to participate in a pilot of the new system and/or to check the accuracy of the new data model. Specifically, your HESA information will be used by HESA, your provider, and higher education funding and regulatory bodies participating in the Data Futures programme to:

  • evaluate the new data model; and
  • evaluate system functionality (including how the new system interacts with pilot participants’ systems and with HESA’s existing legacy systems).

If your HESA information is used as part of the Data Futures programme, then it will be deleted from that programme within 6 months of the end of the relevant testing phase.

In 2022/23 it is envisaged that the Data Futures programme will move from pilot phase to live collection via the HDP. Therefore, your data may also be processed via the HDP for live collection purposes and will be processed and retained pursuant to Purposes 1 and 2 below.

As the purpose of the Data Futures programme is to enable HESA to have a platform suitable for the public functions of the higher education sector, the lawful bases for this processing can be found in Purpose 1 (below). Processing relating to migrating data held within HESA’s permanent records to the new Data Futures data model is carried out under Purpose 8.

Sensitive information

Data submitted to HESA by City, University of London includes details about the course you are studying and any qualifications awarded to you during the academic year. It also includes personal details about you such as your name and date of birth, your prior qualifications, and where you lived before starting your course.

Information about your disability status, ethnicity, sexual orientation, gender reassignment or religion is classed as ‘Special categories of data’ under the GDPR. City, University of London provides this information to HESA and will be included in your HESA information. This information is necessary for monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act 2010. Your sensitive information will be used for research purposes and will not be used to make decisions about you.

Some other information is used to enable research into the provision of fair access to higher education, for example information as to whether you are a care leaver. As your provider is in England your HESA information may include details of any financial support you may receive from City, University of London.

A full list of data items that may be included in your HESA information for the academic year can be found on the HESA website. Please note that not all data items are collected for all students.

Purpose 1 - Public functions by HE funding and regulatory bodies

HESA shares your HESA information with the HE funding and regulatory body(s) who request HESA to collect it and require it to carry out their statutory and/or public functions. This data sharing is carried out in the public interest or in the exercise of official authority vested in HESA and the funding and regulatory bodies. HESA has been appointed as the designated data body for England under the Higher Education and Research Act 2017. The HE funding and regulatory bodies are:

Your HESA information will be shared with these organisations as part of a large dataset which contains similar information about other people who have followed higher education courses in the UK. These organisations are also Controllers of your HESA information. This means that they make their own decisions about how to use it, and this may include publishing statistics, carrying out quality assurance, and sharing the information with third parties, such as other government or public bodies or other organisations of the type listed elsewhere in this collection notice. However, all uses of your HESA information are within the purposes set out in this collection notice and covered by data sharing agreements with HESA.

These organisations may retain HESA information indefinitely for statistical and research purposes.

Purpose 2 - Public functions by public authorities

Education statistics and data

HESA also acts as an information hub to provide information on higher education. In England, this is undertaken outside of HESA’s designated data body activities. HESA shares your HESA information with public authorities who require it to carry out their statutory and/or public functions. This data sharing is carried out in the public interest or in the exercise of official authority vested in HESA and the public authorities. Your HESA information will be shared with these organisations as part of a large dataset which contains similar information about other people who have followed higher education courses in the UK.

These organisations are data controllers in common of your HESA information. This means that they make their own decisions about how to use it, and this may include publishing statistics and sharing the information with third parties, such as other government or public bodies or other organisations of the type listed elsewhere in this collection notice. However, all uses that they make of your HESA information will be within the purposes set out in this collection notice and covered by data sharing agreements with HESA. These organisations will not use the data for the purposes of identifying you as an individual or to take decisions about you, except as described in Purpose 3 below. These organisations may retain HESA information indefinitely for statistical and research purposes, or for fixed terms depending on the terms of their data sharing agreements with HESA.

Such organisations may include:

  • Department for Education
  • Department for Business, Energy and Industrial Strategy
  • Welsh Government
  • Scottish Government
  • Department for the Economy, Northern Ireland
  • Office for Students (formerly HEFCE)
  • Higher Education Funding Council for Wales
  • Scottish Funding Council
  • UK Research and Innovation (UKRI) and Research England
  • Teaching Regulation Agency
  • National Health Service bodies and organisations working with them e.g. Health Education England
  • General Medical Council
  • UCAS
  • Office of National Statistics

and any successor bodies. Further data controllers may be added to the list from time to time – please see the online version of this notice.

Purpose 3 - Administrative uses

HUSID look-up service – If you have been included in the Student record in previous years, your current higher education provider may use HESA’s look-up service to validate your student identifier (referred to as your HUSID). More information can be found on HESA’s look-up service.

Changing provider during your higher education studies – If during your study with a higher education provider, you transfer to another higher education provider or your course is delivered in collaboration with another higher education provider, it may be necessary for HESA to share information about you with your new provider to ensure you are correctly included in their relevant data submission to HESA. HESA may also be required to inform your previous provider that you are now studying elsewhere.

External Administrative Uses

In the exercise of their official authority, it may be necessary for the UK higher education funding and regulatory bodies listed in Purposes 1 and 2 to use your HESA information which is passed to them for Purposes 1 and 2 to identify you and take decisions about you as an individual for the following purposes only:

Fraud detection and prevention - Your HESA information may be used to audit claims to public funding and student finance, and to detect and prevent fraud.

Previous study - As your higher education provider is in England: The Office for Students (formerly HEFCE) may share your previous education records with this provider, including HESA information submitted by other higher education providers, to determine the nature of any prior higher education study, including your current qualifications. This may be used to make decisions about the fees you are required to pay the support available to you or the availability of a place for you to study with City, University of London.

For these purposes your HESA information may be held separately (in addition to being held within datasets for Purpose 1) and retained for as long as necessary for the purposes of detection or prosecution of fraud and any associated legal or audit purposes.

Purpose 4 - HESA publications

Part of HESA’s role is to produce and publish information about higher education in the public interest. This includes Official and National Statistics publications and online business intelligence and research services.

When producing this material for publication, HESA applies its disclosure control, the HESA Standard Rounding Methodology, to ensure that no Personal Data is included and that individuals cannot be identified from published material.

Purpose 5 -  Equal opportunity, research, journalism and other processing in which there is a legitimate interest

HESA and the other data controllers in common (see Purpose 1 & 2) may also supply information to third parties where there is a legitimate interest in doing so for statistical and research purposes. Examples of use for this purpose include:

  • Provision of information to students and prospective students
  • Equal opportunities monitoring
  • Research - This may be academic research, commercial research or other statistical research where this is in the public interest
  • Journalism - Where the relevant publication would be in the public interest e.g. league tables
  • Creation and operation of analysis tools, for example, Heidi Plus.

Users to whom information may be supplied for Purpose 5 include:

  • Higher education sector bodies including Jisc
  • Higher education providers
  • Academic researchers and students
  • Commercial organisations (e.g. recruitment firms, housing providers, graduate employers)
  • Unions
  • Non-governmental organisations and charities
  • Local, regional and national government bodies
  • Journalists

Information supplied by HESA, via JISC to third parties within Purpose 5 is supplied under contracts which require that individuals shall not be identified from the supplied information and this means that they also cannot use it to make decisions about you.

A copy of these agreement for the supply of tailored information is available here. Each agreement specifies the duration for which data may be processed. This is usually one year but may be longer if necessary for the specific research purpose. Each request for HESA information under Purpose 4 is assessed for its compliance with data protection legislation and its compatibility with this Collection Notice. JISC ensures that only the minimum amount of HESA information necessary for the specified research purpose is supplied to users. If the supplied information is to be published HESA's Rounding Methodology or an equivalent disclosure control must be applied to ensure that individuals cannot be identified from the published material and it does not constitute Personal Data.

A copy of HESA’s current agreement for access to Heidi Plus is available here. Each agreement specifies the purpose for which the data may be processed.

DfE Data Sharing Service

If you are a student at a provider in England, HESA information may be linked to school and/or further education college information and supplied or linked to researchers' data through the Office for National Statistics Secure Research Service ('ONS SRS'). In some cases, HESA information may be shared with researchers directly following this linking activity. This onward sharing to researchers is provided by the DfE Data Sharing Service. DfE are the Controller of the data processed as part of the provision of this service. Copies of the ‘Agreement for the Supply of Linked Data’ and of the ‘Agreement for Making Linked Data available in ONS SRS’ can be requested from data.sharing@education.gov.uk.

DfE Longitudinal Education Outcomes (LEO)

Your HESA information may be linked to school, college, employment, tax and benefits data by the DfE and may be supplied to researchers by the DfE through the Office for National Statistics Secure Research Service. More information is available from https://www.gov.uk/government/publications/longitudinal-education-outcomes-study-how-we-use-and-share-data.

Other Controllers (listed under Purpose 1 above) may also process data for this purpose where this is necessary to fulfil their public functions.

Purpose 6 - On Primary Medical Qualification courses only

The GMC is a body with statutory responsibilities for the education, training, and regulation of medical practitioners in the UK. These responsibilities are set out in the Medical Act 1983.

The GMC will use data for the purposes of:

  • Promoting, maintaining and improving high standards of medical education and training in the UK.
  • Undertaking research that will allow the GMC to co-ordinate policy across all stages of medical education, including selection to medical school, undergraduate education, postgraduate education, and medical practice. This research is only possible with high quality measures of school performance. More information about how GMC use your data in research projects can be found here.
  • The GMC will not use the data collected by HESA to make decisions about individual students or doctors.

Purpose 7 - Voluntary basis

Sometimes an HE provider’s circumstances change so that it isn’t compulsory for it to submit student data to HESA. In this case, the HE provider and HESA (following consultation with relevant Statutory Customers) might agree to continue to allow the return of data by the provider for their students where this is considered to be in the public interest. Should the status of the provider change so that it becomes compulsory to submit student data to HESA, this will be collected under Purpose 1.

Purpose 8 - Used by HESA

HESA processes your HESA information as part of a larger statistical dataset for the above purposes to:

  • Create derived fields to enrich data utility and insights of HESA data
  • Contextualise the use of HESA data
  • Research and understand progression through higher education. This may include linking to survey responses provided in the future as part of the Graduate Outcomes survey and to other datasets for example college data
  • Quality assure data and to remove anomalies and improve data accuracy. This may include processing personal data in the context of providing bespoke training to higher education providers to provide analysis and improve data quality
  • Research into data quality and the sector’s reliance on time series data
  • Check it against information submitted to UCAS to improve data accuracy
  • Check it against information submitted to National Student Survey (NSS) to improve data accuracy
  • To review how changes and improvements can be made to HESA’s processing including systems and software and the implications that this would have on the data it produces.

Linking information in the HESA record

As indicated above, where HESA and organisations covered by Purpose 1 & 2 use HESA information this may include linking named or pseudonymised HESA information to other information for research purposes. Examples include linking to:

  • National Student Survey data – to place the results of this survey in context
  • School and Further Education data – to research progression to higher education
  • Student Loans Company data – to research the use of student finance
  • Qualification Awarding Bodies data – to research the value and outcomes of qualifications
  • Tax, Benefits, and Employment data – to research the salaries of graduates and to better understand the outcomes of education (Guidance on the use of HESA records matched to Tax, Benefits and Employment data is available on the Government website)
  • UCAS data – to understand entry rates to higher education
  • UCAS and Higher Education Career Services Unit (HECSU) data – to deliver an information service to support students and prospective students make informed and effective study and career choices
  • If you are a medical student your HESA information may be included in the UKMED research database. The General Medical Council is the Controller for this database used for researching  doctors’ progression through their education and training.

Where HESA provides information from your HESA information to third parties under Purpose 5, the permitted processing of the information by a third party may include linking HESA information to other information held by the third party. Permission is considered on a case-by-case basis. It is only given where the linking is for the purposes outlined in Purpose 5 and subject to the requirement not to carry out linking to identify individuals.

Widening Participation Programmes - If you have participated in programmes designed to widen participation in higher education, your HESA information may be linked to data held by these programmes for research purposes. This may include Higher Education Access Tracker (HEAT), East Midlands Widening Participation Research and Evaluation Partnership (EMWPREP) and Aimhigher West Midlands (AHWM).

Destinations information for schools and colleges – If you attended a school or college in England or Wales linked data may be disclosed to the last school or college you attended (or its successor body) and to Ofsted or Estyn in the exercise of their official authority to enable them to assess the outcomes of secondary educati. About 15 months after you graduate, we may contact you to ask you to fill in the Higher Education Statistics Agency (HESA) ‘Graduate Outcomes’ questionnaire. You may also be contacted as part of an audit to check that we have undertaken this survey properly. We will not give your contact details to HESA.

Student and leaver surveys

Your contact details may be passed to survey contractors to carry out the National Student Survey (NSS), other surveys of students’ views about their study, and surveys of student finances, on behalf of some of the organisations listed under Purpose 1 & 2 above.

Your provider will hold your contact details after you graduate in order for you to be contacted to complete the Graduate Outcomes survey. Your contact details will be passed to HESA and the organisation(s) contracted by HESA to assist it to undertake the Graduate Outcomes survey.

HESA’s contractors will only use your contact details for the survey and will delete them when the survey is closed. HESA may hold your contact details for further Graduate Outcomes surveys or administration of the survey data where these are in the public interest. Your responses to the Graduate Outcomes survey will be made available to your provider, and your provider may choose to add additional questions to the survey for their own use.

Further privacy and data protection information will be provided if you are contacted for any of these surveys. The privacy information for Graduate Outcomes is available on the Graduate Outcomes website. You might also be contacted as part of an audit to check that a survey has been undertaken properly.

Your rights

You have the right to be informed about how your personal data is used. This Student collection notice is regularly reviewed to ensure that it accurately describes how your HESA information is used. This notice may be updated from time to time, for example when new legislation is enacted, or when new policies are implemented by the public authorities listed under Purposes 1 & 2. The most up to date version can always be found HESA website.

For further information about data protection, including contact details for HESA’s Data Protection Officer please see the HESA website. If you have questions about how your HESA information is used, please contact data.protection@hesa.ac.uk.

Under the General Data Protection Regulation you have the right of access to your personal information and the right to rectify inaccurate information; the right to erasure; restrict processing; and object to processing. These rights are limited in certain circumstances. If you think there is a problem with the way HESA is handling your data, you have the right to complain to the Information Commissioner's Office.

Data transfers to other countries

Your HESA information will only be transferred to countries whose data protection laws have been assessed as adequate, or where adequate safeguards (in almost all cases, standard data protection clauses), are in place to protect your HESA information. To obtain a copy of these safeguards or if you have any questions about how your HESA information is used, please contact data.protection@hesa.ac.uk.