2018/19 Apprenticeship data: Data processing terms

The following text was emailed to all Student record contacts on 21 August 2018. It is important you read and complete the actions listed below if you wish to submit 2018/19 Apprenticeship Standards Student Data to HESA.

******

Terms and Conditions for Submission of 2018/19 Apprenticeship Standards Student Data to HESA – Please note the Terms and Conditions that will apply for the submission of the Apprenticeship Standards Student Data and follow the instructions detailed below if you wish to use this service

As for the 2017/18 academic year the Higher Education Statistics Agency Limited (“HESA”) is offering a data processing service to Providers who wish to use the HESA Collection System to produce data files for their Apprenticeship Standards students (“ILR Files”) for submission to the Education & Skills Funding Agency (“ESFA”). This email is to make clear for data protection purposes the basis and terms on which HESA has agreed to offer such a service for the academic year 2018/19. These are similar to the terms which applied for 2017/18 academic year but have been updated to reflect the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 coming into force. They have also been updated to reflect the Office for Students’ (OfS) requirement to receive some of the Additional Information (see below for more detail) that your organisation will need to submit for HESA to produce the ILR files. 

Please note that this data processing service is optional and its cost is included within HESA’s Subscription Fee. Unlike the position where you submit data to HESA (for the uses outlined in the HESA Collection Notices), when providing this service HESA will be acting as a Data Processor and you (the higher education provider) will be the Data Controller. In order for your organisation to use this service an authorised signatory on behalf of your organisation will need to email HESA at the address set out below to confirm that your organisation accepts the terms on which the service is offered to be provided and wishes to use this data processing service.  For ease of reference we have also published a copy of these terms.

The GDPR and the Data Protection Act 2018 came into force in May 2018, and as the higher education provider is the Data Controller in respect of this arrangement, when asking HESA to undertake this processing it will be essential for you to ensure that your relevant processes and documentation will be compliant, including your fair processing information and analysis of the legal basis for this data processing.

In order to produce ILR Files HESA will need to:

• undertake some further processing of student personal data which is submitted in the ordinary course of making a student return to HESA (“HESA Student Data”), in addition to the usual processing of that data for the purposes set out in the HESA Collection Notice; 
• process some additional information which is specifically required by the ESFA and which is not already contained within HESA Student Data. This is described in more detail at Annex A below (“Additional Information”).

As stated above OfS have informed HESA that it is necessary for their statutory functions for them to receive information about the overall aim of the student’s qualification which forms part of the Additional Information (“the Apprenticeship Wrapper Aim Data”). In order for us to be able to process the Additional Information we have therefore made the provision of the Apprenticeship Wrapper Aim Data by HESA to OfS a condition of the terms of processing.  If you do not wish to instruct HESA to share the Apprenticeship Wrapper Aim Data with OfS do not submit Additional Information to HESA and use this service.

As set out above should a higher education provider wish HESA to produce ILR Files HESA will be acting as its Data Processor, not Data Controller.  It is therefore the higher education provider’s responsibility to ensure that it has complied with its fair processing obligations. As HESA is only acting as Data Processor, HESA has not made reference to the processing of data for Apprenticeship Standards in the HESA Student Collection Notice and that Notice will not therefore be effective in discharging the provider's statutory fair processing obligations in relation to the processing of data to produce ILR files.

HESA confirms that appropriate technical and organisational information security and processing procedures are maintained to ensure that the information processed to produce the ILR Files are sufficiently protected against any unlawful or unauthorised processing, as is the case in any event for HESA Student Data. As part of HESA’s data collection process HESA undertakes information security risk assessments and implements security controls managed within HESA’s ISO27001 information security management system.  HESA has disaster recovery and business continuity plans in place.  Further information about HESA's data security can be provided on request.

It is the responsibility of higher education providers who wish to use HESA to produce their ILR Files to submit accurate data.  In producing the ILR Files HESA is not applying a quality assurance process but simply processing the HESA Student Data and Additional Information to make the ILR Files meet the data structure requirements of the ESFA.

As stated above by using this service and submitting Additional Information to HESA you are instructing HESA to share the Apprenticeship Wrapper Aim Data with the OfS.  For the avoidance of doubt this will include allowing access to the Apprenticeship Wrapper Aim Data for their quality assurance process and for delivery testing purposes.

All other Additional Information will only be processed by HESA so that the ILR Files can be returned to you.  HESA will not share the other Additional Information or ILR Files with third parties and steps have been taken to exclude the other Additional Information from being accessed by Statutory Customers who undertake concurrent data quality assurance on data submissions to HESA.

HESA has also taken steps to limit access to the Additional Information to only those HESA Staff who have received Data Protection Training and require access for their roles. This includes HESA liaison staff, who will be able to access the Additional Information to enable them to assist higher education providers who require help with their Apprenticeship Standards Student data. Access to HESA Student Data is limited in accordance with HESA's processes which apply to the processing of HESA Student Data for the purposes set out in HESA's Student Collection Notice.

The HESA Student Data submitted to HESA for use in accordance with HESA’s Student Collection Notice will continue to be processed and shared by HESA in accordance with the Student Collection Notice.

The data processed to produce ILR files which is also HESA Student Data is likely, subject to annual review, to be processed and retained indefinitely for the research and statistical purposes as set out in the HESA Collection Notice.

The Apprenticeship Wrapper Aim Data shared with the OfS will be used by OfS for its statutory functions.  Copies of the data delivered to OfS (including the Apprenticeship Wrapper Aim Data) is likely, subject to annual review by HESA, to be required to be retained indefinitely to enable HESA to respond to any future queries raised by OfS. The Apprenticeship Wrapper Aim Data will not be processed by HESA for any other purpose.

With the exception of the Apprenticeship Wrapper Aim Data (the retention of which is described in the above paragraph) the Additional Information and the ILR Files will be retained in HESA’s live systems for up to 6 months after the final closure of the Student Collection (i.e. following the closure of the relevant years' Student Collection Fixed Database).  Thereafter the Additional Information and ILR Files will be deleted and only be stored on HESA’s backups in accordance with HESA’s retention policy as updated from time to time. HESA will not be able to process the Additional Information and ILR Files for business as usual purposes or share it for any other reason, once they have been removed from the live system. 

It is the responsibility of higher education providers as Data Controllers to retain all copies of the HESA Student Data, Additional Information, and ILR Files that they may be required to keep for their records.

HESA in performing the above services is authorised to use all sub-contractors used by HESA to process the HESA Student Record.

If your organisation wishes to elect to use HESA to produce your ILR Files on the above terms please can you arrange for an email to be sent to [email protected] by an authorised signatory to confirm this.

If you do not agree to these terms and do not wish the Apprenticeship Wrapper Aim Data to be shared by HESA with the OfS, do not submit the Additional Information to HESA.

If at any point you wish HESA to stop processing the Additional Information and the ILR Files please also inform [email protected].

Please note that the following terms are being included in the Data Collection Student Contact IDS System. 

New Clause 3 Record Contact Responsibilities

3 HESA has agreed to offer an option for higher education providers to elect to use HESA’s data collection system to produce data files to submit to the Education & Skills Funding Agency (“ESFA”) for their Apprenticeship Standards students (“ILR Files”). If your organisation has opted to use HESA to produce its ILR Files HESA will need to carry out additional processing of some student personal data which is submitted in the ordinary course of making a student return to HESA (“for the purposes of this clause 3 described as HESA Student Data”) for the purposes set out in the HESA Student Collection Notice, and to collect and process some additional information which is specifically required by the ESFA (“Additional Information”). Do not submit the Additional Information unless an authorised signatory on behalf of your organisation has emailed [email protected]  to accept HESA’s terms. This is essential to confirm the instruction to HESA to carry out this processing on behalf of your organisation as Data Controller.  By sending such an email, your organisation will be confirming its instructions to carry out the processing described in this clause on the conditions set out below including authorising HESA to share the Apprenticeship Wrapper Aim Data, as defined below, with the Office for Students (“OfS”).  The following conditions will apply to this data processing service:

1. HESA will be acting as a Data Processor for your organisation and your organisation is the Data Controller in respect of this processing.
2. It is your responsibility on behalf of your organisation to ensure prior to submitting the Additional Information to HESA that your organisation has complied with its fair processing obligations and identified a lawful basis for the processing.  HESA is only acting as Data Processor on your organisation's instructions, and it has not made reference to the processing of Apprenticeship Standards personal data in its own fair processing notification, the HESA Student Collection Notice.
3. It is your responsibility on behalf of your organisation to submit or arrange for the submission of accurate data for inclusion in the ILR Files.  In producing the ILR Files HESA is not applying a quality assurance process or making decisions about the data to be processed, but simply processing the HESA Student Data and Additional Information to create the ILR Files which will meet the data structure requirements of the ESFA.
4. The OfS have informed HESA that it is necessary for their statutory functions to receive information which describes the overall aim of the student’s qualification which forms part of the Additional Information (“the Apprenticeship Wrapper Aim Data”).  It is an express condition of using this service that the Apprenticeship Wrapper Aim Data shall be shared by HESA with OfS.
5. The Additional Information will otherwise only be processed by HESA so that the ILR Files can be returned to your organisation in accordance with your instructions.  With the exception of OfS, who your organisation is instructing HESA to share with, HESA will not share any Additional Information with third parties and will not carry out any other processing of the Additional Information unless this is the subject of a written instruction from your organisation which is accepted in writing by HESA.  In addition to the processing of HESA Student Data for the purposes of creating the ILR, HESA will otherwise only process the HESA Student Data in accordance with the HESA Student Collection Notice and the terms on which your organisation submits data to HESA for these purposes. 
6. HESA will maintain appropriate technical and organisational information security and processing procedures to ensure that HESA Student Data and the Additional Information are sufficiently protected against any unlawful or unauthorised processing. As part of HESA’s data collection process HESA undertakes information security risk assessments and implements security controls managed within HESA’s ISO27001 information security management system.  HESA has in place disaster recovery and business continuity measures which it considers appropriate in respect of the data processing it carries out.  HESA keeps its data security measures under review.  HESA will provide on request reasonable information about its data security measures.
7. HESA will limit access to the Additional Information to only those HESA Staff who have received data protection training and require access for their roles. This includes HESA liaison staff, who will be able to access the Additional Information to enable them to assist higher education providers who require help with their Apprenticeship Standards Student data. Access to HESA Student Data is limited in accordance with HESA's processes which apply to the processing of HESA Student Data for the purposes set out in HESA's Student Collection Notice.
8. HESA Student Data will be processed and subject to annual review is likely to be retained indefinitely for research and statistical purposes as set out in the HESA Student Collection Notice. The Apprenticeship Wrapper Aim Data included in the data delivery to the OfS will be used by OfS for its statutory functions. 
9. Copies of the data delivered to OfS (including the Apprenticeship Wrapper Aim Data) is likely, subject to annual review by HESA, to be required to be retained indefinitely to enable HESA to respond to any future queries raised by OfS. The Apprenticeship Wrapper Aim Data will not be processed by HESA for any other purpose by HESA.
10. Subject to sub clause 9 the Additional Information and the ILR Files will be retained in HESA’s live systems for up to 6 months after the final closure of the Student Collection (i.e. following the closure of the relevant year’s Student Collection fixed database).  Thereafter the Additional Information and ILR Files will be deleted and only be stored on HESA’s backups in accordance with HESA's retention policy as updated from time to time. HESA will not be able to process the Additional Information and ILR Files for business as usual purposes or share it for any other reason, once they have been removed from the live system.  It is therefore your responsibility to ensure your organisation has taken steps to retain all copies of the HESA Student Data, Additional Information, and ILR Files that it is required to keep for its records.
11. HESA will provide your organisation with any assistance reasonably required to enable the organisation to investigate reasonable concerns about the data processing under this clause and to comply with the rights of data subjects.
12. HESA agrees to notify your organisation if:
    • It is legally required to undertake any processing of the Additional Information beyond that described in this clause 3, save where such notification would be unlawful
    • It identifies a security breach which has taken place in respect of the Additional Information or the processing of data described in this clause 3. Such notification shall explain the nature of the security breach, including the categories of data field and the number of records or data subjects concerned, the steps being taken by HESA to remediate or control the breach and the name and contact details of the person at HESA who liaise with your organisation about the breach;
    • Any subject access request or other request to exercise data subject rights which is received by HESA in respect of the Additional Information or the processing described in this clause 3. HESA shall not respond directly to such communications but shall pass them to your organisation as quickly as reasonably possible.
13. HESA is authorised to use all sub-contractors used by HESA to process the HESA Student Record.
14. This data processing agreement will terminate automatically on completion of the data processing and supply

Annex A – Additional Information

Categories of Data Subjects: Students undertaking Apprenticeship Standard courses at higher education providers.

Description of Personal Data to be Processed Under this Agreement:

Please note that Additional Information also includes the Apprenticeship Wrapper Aim Data which whilst not a data field describes the overall aim of the student’s qualification.