Universities Scotland was first asked to respond to a media enquiry from the Times on Monday, 4 July in regard to university application processes and the means by which it is possible for universities to determine whether students have unspent criminal convictions or otherwise pose a heightened risk to others. The Times then ran this story on Tuesday, 5 July and it has since been picked up by other news outlets. The story centres around the lived experience of university student, Ellie Wilson, who waived her anonymity to highlight this issue. Our full media line can be found below.
A spokesperson from Universities Scotland said:
“We want to recognise Ellie’s bravery in waiving her anonymity to air a really important issue like this. It’s not appropriate for us to comment on the specifics of this case but every university is committed to student safety and to the prevention of gender-based violence, within their power.
“Universities have to work within the law when it comes to what information they can ask of applicants and when. Information relating to an individual’s unspent criminal convictions has enhanced legal protection and this prevents a one-size-fits-all approach across institutions. A change to data protection laws, which took effect just before the pandemic, created an opportunity to do things better. We know this has resulted in more focused and more robust, data capture by institutions using a risk-based approach, with heightened levels of checks where protection of vulnerable groups is a factor for the degree course. In some cases, institutions now ask for this information annually, at re-enrolment, rather than only once at initial application. These changes allow universities to make finer, albeit still very difficult, judgements in regarding to their safeguarding responsibilities and education as a means of rehabilitation.”
We understand how acutely painful and deeply sensitive this is for students, like Ms Wilson, involved in cases such as that reported on this week. It is a complex issue, which requires universities to to adhere to the law, to balance conflicting responsibilities to different groups of students, and to fulfill their legal and moral responsibilities to ensure student safety and create a campus environment where students feel supported and can thrive. Given this context, we feel it is important to elaborate on the media line we provided earlier this week, to provide some further context, as it is not possible to accurately reflect this situation or the action that universities have taken in a few sentences of a media line.
- We were actively engaged in this area of policy in 2018/19 when aspects of the Data Protection Act 2018 (DPA2018) took effect, requiring a change from the process that had been in place, via the admissions body UCAS, up until that point.
- Previously UCAS asked all applicants to voluntarily disclose if they had unspent criminal convictions at the initial point of application. Following the DPA2018 the Information Commissioner’s Office made it clear that there was a new, high threshold for the need to collect this sensitive personal information.
- Whilst the previous process had to change, all universities approached this from the basis of finding a new, lawful justification to collect this information.
- The DPA2018 requires all universities to approach the need to collect highly sensitive information relating to an individual’s unspent criminal convictions on an institution-specific basis, taking account of the different context each institution finds itself in and to make an assessment of the proportionality and necessity of the need for this information. There is a consistent and robust process in place, called a Privacy Impact Assessment (PIA), to assess the lawful basis on which this can be asked and collected.
- The institution-specific requirement of the PIA means there cannot be a blanket, sector-wide approach to this from the outset. That makes it unlikely that there would be consistency across institutions on the timing at which they ask applicants for this information. However, all institutions have consistently and robustly made an assessment of when it is lawful for them to ask for this information. As UCAS’s published good practice guide from 2018 states: “it is likely there is no ‘one size fits all’ approach”.
- We discussed this issue with the Scottish Government and other stakeholders working in gender-based violence policy in early 2019 and advised that universities would be required, by law, to take an institution-by-institution approach, but universities were additionally working together, across Scotland the UK, where possible to share information, consider the implications and raise understanding.
- Back in 2019, shared an update on institutions’ approaches with the Education Committee of the Scottish Parliament. You can find that letter here. We said then that institutions would work to learn from each other in response to this changed legal and policy circumstance, share good practice, and would be likely to evolve their processes given that the change was new. We remain open to discussion with stakeholders including people with lived experience, students, women’s organisations, the Scottish Government and others.