Skip to main content

Graduate Outcomes Survey Results record 2018/19

Back to C19072

Guidance note on the use of raw survey data

Version 1.0 Produced 2021-09-27

INTRODUCTION

This operational guide provides information which outlines the uses of survey response data which is provided to the Graduate Outcomes Survey Results user within the provider portal. It is designed to be accessible to all types of higher education provider, including those who do not have Data Protection Officers or Data Protection teams.

RAW FEED OF SURVEY RESPONSE DATA

Once HESA has given providers access to their results data, it will be possible to download/view a raw feed for all open cohorts. The data being made available will be dynamic, updated in the provider portal on a regular basis and accessible to colleagues who hold the Survey Results user role.

This section outlines some of the key things that providers need to be aware of before downloading/viewing the survey response data. This takes into account the purpose for which the data is being collected and that prior to the final delivery, the data in the provider portal is dynamic and raw. As such, there are some limitations to the way the data can be used by providers.

Retention of raw data prior to final delivery

Providers are reminded that the raw survey response data downloaded prior to the final delivery in Spring 2022 will not be accurate as amendments will have been made to the final delivery data following the quality assurance work undertaken by HESA and its SIC and SOC coder. HESA is required under data protection legislation to remove access to data that is potentially factually incorrect and will take steps to do so immediately after the delivery of final data.

Any raw results data downloaded prior to the final delivery should be deleted by providers to ensure compliance with data protection requirements. This is because, Purpose 1 of the Graduate Outcomes Collection Notice (referred to as the ‘Privacy Information’ on the Graduate Outcomes website) makes clear that the information downloaded prior to the final delivery will only be used by providers to monitor the progress of the survey. Secondly, the raw data providers have downloaded may contain the survey results of data subjects who have since exercised their rights as data subjects to request that their survey results data be deleted.

PERSONAL DATA

Upon accessing the raw feed of survey response data, the provider will become an independent controller and must comply with all applicable data protection legislation and will be responsible for its compliant usage.

A controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Therefore, it is important that before a user downloads this data, their provider must put in place appropriate processes to ensure that the survey response data is processed securely, in accordance with data protection legislation, the relevant Collection Notice, the provider's agreement(s) with HESA and taking into account the guidance in this note.

Given the above, there are restrictions on how the raw survey response data can be used. The provider's processes must ensure that any internal recipients understand the purposes for which they can process the data.

When considering whether and how to download the data, many providers will undertake a Data Protection Impact Assessment (DPIA) to ensure that they have taken all relevant issues into account. Further guidance on DPIAs can be found on the Information Commissioner Officer's website.

As an independent controller, the provider should determine how they will comply with these requirements. If you are unsure, we recommend that you speak to your Data Protection Officer or, if you do not have one, take specialist advice.

Please note that the final data delivery should not contain 'special category personal data'.

Frequency of download

The delivery mechanism allows survey response data to be downloaded prior to the end of a cohort. As an independent controller, this means providers need to consider how often it is necessary to download/view that survey response data. Providers also need to take into account that survey response data available for download/review during the collection may change prior to the end of the Graduate Outcomes collection. Amends will be made for the final delivery data following the quality assurance work that will be undertaken by HESA and its SIC and SOC coder.

Additionally, the raw data downloaded may contain the survey results of data subjects who have since exercised their rights as data subjects to request that their survey results data be deleted.

It is, therefore, advised that earlier downloads of raw results are securely disposed once a new download has been made in order to ensure compliance with data protection requirements.

SIC / SOC data

The feed of SIC and SOC coding will be dynamic and coding is likely to change for graduates throughout the applicable survey year. Reasons for this include:

  • The flexibility of the survey process i.e. those graduates who partially complete their survey can re-enter the survey at any time during their contact period.
  • Graduates can request changes to their survey response data e.g. when a third party has responded on their behalf or when they wish to correct information, they have submitted themselves.
  • HESA's coding supplier is running a constant quality assurance process.

Until the final delivery of survey data in Spring 2022, the SIC and SOC data may be subject to change. Please also be mindful that SIC and SOC coding can constitute Personal Data.

Free text boxes

Providers will recall that graduates have the opportunity to complete free text boxes in the survey. These free text boxes have not been reviewed or amended by HESA and will be delivered exactly as written by the graduate. We strongly recommend that this is taken into account in the processes established by the provider for using this data as the free text could contain sensitive information, opinions or references.

Access control to the Graduate Outcomes data

As the survey response data (including information derived from it) should not be made public prior to the publication of the relevant Official Statistics, providers are reminded that they should put in place restricted access control for their internal use of the data i.e. only to those staff who have an operational requirement to access the information.

External publication

It is essential that the survey response data viewed or downloaded from the provider portal is not shared outside of the provider. It is embargoed until HESA’s first release of Graduate Outcomes data which is expected in Spring 2022 in the form of a Statistical Bulletin. For example, providers should not share SIC and SOC coding or any other type of survey response data via JISCMail or shared spreadsheets for comparison purposes.

Data subjects' rights

Providers are reminded that data subjects’ rights will apply to raw survey response data.

Under Data Protection legislation, graduates have the right of access to their personal information. They also have: rights to rectify inaccurate information; restrict processing or object to processing; and the right to be forgotten (i.e. to seek erasure of their personal data).

These rights are limited in certain circumstances by the GDPR and the Data Protection Act 2018 in circumstances where data is only processed for research or statistical purposes. As an independent controller, it will be the provider’s responsibility to determine if the limitations apply.

The Graduate Outcomes Collection Notice informs data subjects that HESA will be able to implement erasure requests if they are made before 1 January 2022. From that date onwards, it will not be possible for HESA to implement erasure requests: HESA will rely on the exemption regarding research and statistical purposes, as a basis for continuing to process survey answers.

Where a data subject makes an erasure request prior to the deadline above, HESA will notify the Graduate Outcomes Record Contact at the provider. It is more than likely that raw data downloaded will contain the survey results of data subjects who will exercise their right to request that their survey results data be deleted, so this will need to be considered by a provider, as an independent controller.

PERSONAL DATA BREACHES

The contact details for HESA's Data Protection Officer should you need to notify HESA of a personal data breach are as follows: email: [email protected], tel: 01242 211135.


Need help?

Contact Liaison by email or on +44 (0)1242 388 531.