Data Protection Policy - Personal Data in the Public Domain
Swansea University is subject to the GDPR and the Freedom of Information Act. The GDPR requires us to take care in how we manage the information which we hold about individuals, for example by handling it in ways which respect individuals' private lives. The Freedom of Information Act has created a general right of access to information held by public bodies in the interests of openness and accountability, with an expectation that public bodies will be proactive in publishing information. Both legislations have implications for the information which the University makes available about its staff.
The Information Commissioner - the agency which regulates Freedom of Information and Data Protection - has issued guidance to help public bodies resolve potential conflicts between the legislation in the area of information about staff. Although data about the private lives of staff and sensitive personnel information would normally never be disclosed under Freedom of Information, the Commissioner's view is that public bodies should be prepared to release certain basic work-related details about their staff, and can do so without contravening the Data Protection Law. Job titles, roles and responsibilities, certain information about grades, salaries and expenses, work contact details, and decisions and actions by staff in an official or work capacity are examples of the information which can be made available in the interests of transparency. This information will normally be released if requested under the Freedom of Information Act, although there are situations where it can be legitimately withheld under an exemption in the Act: for example, if disclosing the information would place a member of staff in danger.
It is the practise of Swansea University to hold certain information about individuals in the ‘public domain’. Personal data classified as being in the 'public domain' refers to both automatically processed and manually held information, which will be publicly available world-wide and may be disclosed to third parties without recourse to the data subject. Where such personal data are held on-line, 'public domain' refers to information, which is potentially freely available from anywhere on the Internet. The University's practice is to make the following items of data freely available unless individuals have objected:
- names of members of Council, Court and Senate
- names and academic qualifications of academic and academic related staff and other support staff where appropriate
- academic staff biographies, where supplied by the data subject
- staff e-mail addresses
- staff work place telephone numbers
- Degrees awarded
- Press releases
- Any additional information relating to data subjects which they have agreed to be placed in the public domain and which may be in automated and/or manual form
Any person who wishes to have their details excluded from such published information should contact the Information Compliance Officer (FOI/DP).