Student Conduct Office Head is requiring Student to email his Office for everything. Isn&#39;t he breaching confidentiality? Presuppose a student at a university in England. I do not confirm or deny whether it is Durham. I use Durham just as an example. Student has mental illness. The Head of the Student Conduct Office (&quot;SCO&quot;) emailed like this to Student The university sympathizes with your severe mental illnesses. We have discussed your case with your department. We are writing to require you to use a single point of contact — the Student Conduct Office — rather than emailing your department directly. For any matter involving your department, email correspondence must be sent to student.cases@durham.ac.uk. You shall not email anyone in your department directly. We shall request replies from our colleagues as appropriate. We shall revert to you within five working days. This restriction on email unnerves Student. Has Head broken any university regulation, or law? Doesn't this breach Student's privacy, and taint Student to instructors? When the SCO emails instructors on Student's behalf, then instructors will know that something has gone awry, because students normally email their instructors directly. Instructors shall draw adverse inferences and prejudice against Student! Waiting five working days is unproductive and unrealistic. By butting in as the middle man, the SCO is slowing everything down, and beefing up more work for everyone! Greendrake's last paragraph of his answer appears wrong. This isn't a breach of confidentiality between the department and the student because the department and the SCO are parts of a single entity — the university. For any uni-related issues, confidentiality can only exist between the student and the uni as a whole, not with individual departments. Why is Greendrake wrong? See below. If anyone outside the Counselling, Mental Health and Wellbeing Service enquires about a student, we explain to them that it is a confidential service and that we cannot comment on whom we may or may not be seeing, or have seen. Information shared with us by the Counselling Service under the Student Services Confidentiality and Information Sharing Policy will not be disclosed either within or external to the University. Any information you disclose is confidential to the Student Wellbeing Services team. As a rule, we do not pass on personal information about you, including your attendance, to anyone outside the service (such as parents, tutors and placement staff). Information, both verbal and written, should be shared on a ‘need to know’ basis. If information needs to be communicated with others in the university, that information must contain only the minimal details required.
When the SCO emails instructors on Student's behalf, then instructors will know that something has gone awry, because students normally email their instructors directly. Well, it looks like something has gone awry between the department and the student already, which is why there is now a case which the SCO is dealing with: We have discussed your case with your department. So, apparently, the SCO thinks that the issue between the student and the department is of such magnitude that any further direct interaction between them would only complicate the case. Simply put, you don't go dancing with someone in the evening if in the morning you testified against them on a witness stand. That said, the SCO is just trying to resolve the issue, and is just asking the student not to make it harder for them. This isn't a breach of confidentiality between the department and the student because the department and the SCO are parts of a single entity — the university. For any uni-related issues, confidentiality can only exist between the student and the uni as a whole, not with individual departments.
Maybe not. The ICO says that The right of access enables individuals to obtain their personal data rather than giving them a right to see copies of documents containing their personal data. It might be valid to interpret the DPA / UKGDPR in a way that the relevant personal data undergoing processing in their system is the existence of the letters, but that you are not entitled to a copy of the letters. This is in line with the purpose of the right to access, that you can check what data they are processing about you and whether it is correct. If that argument holds and the data subject insists on receiving a copy of the letters, it might be legitimate to charge them a fee for these copies. But in practice: The data controller might not make this argument and just hand over the copies. It is worth a try. A right to access founded in data protection might not be the only way to receive a copy of these materials. If the letters are relevant for legal proceedings, they could perhaps be requested during the disclosure process.
GDPR forces companies and employees to keep personal data confidential and to use it only for its allowed uses. That obligation continues after the work contract ends. If the employee breaches confidentiality, it does not matter if he provides the data as a file in an USB-drive or if he provides it from memory; it is a breach of confidentiality. Access logs will help to determine which employees have had access to your data, in case a leak is suspected. The part of the question about human memory seems to come from a deep misunderstanding of how human memory works1. I can remember tomorrow something that I have totally forgotten now. Even worse, there is no telling of what can make me remember you; your name might not ring a bell but I may remember you by seeing someone walking a dog. And nobody will ever be able to tell if I have complied with any of your requests or if I am just lying. And of course, there is only one proven way to erase memories, and I am pretty sure the GDPR does not allow for the execution of employees (Disclaimer: IANAL and IANYL, check with a lawyer before murdering anyone if you have doubts). 1 The classical example: You can certainly delete a file from a disk. But just try to stop thinking about white bears
The Fifth and Sixth Amendments are about civil and criminal court proceedings. They do not apply to a university's internal disciplinary procedures, which are the subject of the Dear Colleague letter. Note for example the text of the Fifth Amendment: ... or be deprived of life, liberty, or property, without due process of law. A university's disciplinary procedures do not deprive anyone of their life, liberty, or property. Typically, they only decide whether to suspend or expel the person as a student at the university, or apply other academic punishments (failing grades, marks on transcript, etc). I don't think there needs to be any law "affirming" this. Rather, there is simply no law that requires universities to use Fifth / Sixth amendment standards in their internal disciplinary procedures.
The Right to Access is pretty absolute. However, there are some limitations: Is the service even the Data Controller for the data in question? Here, you're talking about notes of one user about another. Is the platform the controller for the notes, or would the note-taker be the controller? Or both, jointly? If the platform weren't a controller but merely a data processor for these notes, it would be illegal for them to disclose the information. Trish also correctly points out that the GDPR does not apply to processing for purely personal or household purposes, e.g. personal social media use. So GDPR would not provide a basis to compel a user to disclose their notes to the data subject, assuming that the note-taker is covered by this exception. Of course, this exception wouldn't apply if the notes are taken for other purposes, e.g. professional networking. Also, this exception doesn't affect the platform. There is an explicit limitation to the right of access in Art 15(4): The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Disclosing user A's notes about user B to user B would likely violate the privacy rights of A. The notes are both A's and B's personal data. However, the correct balance depends on context. E.g. an employer probably can't refuse to provide access to a performance assessment merely because it was written by an identifiable manager. The UK ICO has provided detailed guidance on this aspect to the right of access. They propose a three-step test: Step one – Does the request require disclosing information that identifies another individual? For example, it might be possible to redact other people's information (but not in your Mastodon notes example). Step two – Has the other individual provided consent? Step three – Is it reasonable to disclose without consent? What is reasonable is highly context-dependent, but UK data protection law gives some concrete criteria to consider. The EU EDPB has draft guidance on the Right to Access. They note that the Art 15(4) can cover a wide range of rights, not just other people's privacy rights. But as in all things, the data controller is required to strike an appropriate balance between user A and B's conflicting rights. In the Mastodon user notes scenario, I think that the note author's rights to privacy should be considered more important than the data subject's right to access those notes, thus making it possible to reject that part of a DSAR under Art 15(4) GDPR. If we assume that the note-taker A is a (joint) controller for these notes, then it would also be necessary to consult them before making a decision about the access request.
Prove my work is not a trade secret violation Please don't. It's not your job to prove your innocence. The burden is on them to be specific, explain fully, and prove specific claims about your actions. In other words, don't justify, don't explain, and don't defend yourself to them. It's actually best you do not say anything to them, and just forward the letter to your legal counsel (Since you're selling software to be used in the medical field, I assume you already have some kind of legal counsel). For instance, even saying something as innocuous as "Managing patients, Exams, Bills etc are all public knowledge." could be used against you. Because it establishes the fact that you've been working on those features with them and that you've been working on those features with your new company (which doesn't necessarily follow, for all they know, you could have purchased a library module from someone else with those exact features). In other words, even if you were to reply with such an innocuous-sounding statement, you could be saving them months of cross-border discovery and litigation about some of their claims (even if you believed you were being entirely reasonable by defending yourself). But at the same time, don't take what I'm saying to mean that you should lie to them about which features you recently worked on. When I say that you shouldn't be talking to them. I mean that you should not be talking to them. You shouldn't be engaging with them and you shouldn't be giving them any shred of information whatsoever (implied or otherwise). It's not your job to make their job any easier. Do not reply to them. Don't even acknowledge the receipt of the letter (unless you already did by signing for it, which can't be helped). Use a legal intermediary. Give the letter to your own legal counsel (whether you signed for the letter, or not) and leave any reply to him or her (assuming he/she thinks this warning letter even warrants a response). And if this former employer gives you a phone call, kindly refer them to your legal counsel without saying another word.
No, it's not legal. The General Data Protection Regulations (GDPR) apply given that you are in the UK (regardless of where the Data Processor is based). The UK GDPR is slightly modified due to Brexit, but the same principles apply. The only plausible legal basis for this actions would be that you consent to it, and you're entitled to withdraw that consent at any time. Some may claim that Article 6.1(b) applies, i.e. that it's necessary to send marketing email in order to fulfil the contract, but GDPR is clear that bundling such consent into a contract for service simply to permit the data processor additional actions isn't allowed, as I'll demonstrate. UK GDPR requires that consent to use your personal information (in this case, your email address) for the stated purpose be freely given. Consent to use your information for direct marketing is not freely given if it's inseparable from the consent to use it for some other service, as per para 43: Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. And Article 7.4 backs this up with When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. The intent of Article 6.1(b) is that only the processing required for the service you have bought is allowed (e.g. if you supply your address for delivery of stuff you've bought, the data processor can use that address to send you the stuff, but is not allowed to add a contract term that allows them to send you unwanted stuff). Examples of emails that Article 6.1(b) would allow (in my assessment) include things such as notification of upcoming downtime, or a reminder that subscriptions are due, but not unsolicited advertisements for other products. There's a grey area that's open to interpretation, where adverts are piggybacked onto actual service messages.
In the UK, if you're in a regulated sector e.g. financial services or health services, there are obligations relating to complaints handling. E.g. the Financial Conduct Authority sets out complaints handling rules in DISP 1.3. The FCA says a complaint is: any oral or written expression of dissatisfaction, whether justified or not, from, or on behalf of, a person about the provision of, or failure to provide, a financial service, claims management service or a redress determination, which: (a) alleges that the complainant has suffered (or may suffer) financial loss, material distress or material inconvenience; and (b) relates to an activity of that respondent, or of any other respondent with whom that respondent has some connection in marketing or providing financial services or products or claims management services, which comes under the jurisdiction of the Financial Ombudsman Service. So if there is "feedback" expressing "dissatisfaction" etc it is a complaint. Some entities have acted such that they seem to believe a complaint must be submitted through 'proper channels' to be a complaint. E.g. a complaints form online, a complaints@companydomain email address or a letter addressed to the Complaints Department. Is that the distinction you are making? But that is not the case in regulated organisations, where a complaint is "any oral or written expression of dissatisfaction..." Now, in such an organisation you're not obliged to have a particular type of form or email address etc. But you are obliged to make the complaints procedure relatively easy and reasonably priced if not free (i.e. premium rate phone number for the complaints line = bad, local rate or freephone number = OK).