Dissemination - Legal and Compliance considerations
On this page: Data Protection Act 2018/GDPR | Official Statistics | Freedom of Information | Competition Law
The HESA dissemination policy and practices for Graduate Outcomes data operate within the following compliance environment. We explain these compliance obligations because they set the terms within which our policies on publishing and otherwise disseminating data must operate. They therefore have a profound influence on the approaches we take.
Data Protection Act 2018/GDPR
HESA collects identifiable personal data about students and graduates in and from UK HE. The majority of the data and information HESA expects to disseminate around Graduate Outcomes is drawn from both of these personal data collections.
HESA takes its responsibilities under data protection extremely seriously and recognises that, beyond basic compliance with the law, HESA data collection operations depend upon maintaining the trust and confidence of data subjects. Within our data dissemination activities, we focus a great deal of effort on reducing any risks to the confidentiality of individuals to the absolute minimum. We deploy tried and trusted approaches in achieving this, such as data minimisation, pseudonymisation, anonymisation (deploying statistical disclosure control) and contractual controls. Find out more about approaches used by HESA.
Where more detailed data, such as microdata (i.e. data at a very detailed level that could pose risks to confidentiality of individuals), is required to support particular uses (such as academic and other research), data extracts will only be supplied by HESA (or our delivery partner Jisc) under a strict data sharing agreement which specifies how the data may be used, including the precise purpose, the permitted user(s), protections for data subjects, and the timeframe over which it is allowed to be retained. Data supplied under such terms must be destroyed once the permitted use has been completed. The agreement under which such data is supplied includes stringent requirements on data recipients to maintain information security and protect confidentiality of individuals. All uses must be compliant with the terms of the Data Collection Notices issued to data subjects.
Official Statistics
HESA is a designated producer of Official Statistics under the Statistics and Registration Service Act 2007 and associated Official Statistics Order.
HESA publishes a wide range of Official Statistics, such as Statistical Bulletins. In respect of our National Statistics outputs specifically (and by implication our wider Official Statistics outputs), we are under statutory obligation to comply with the Code of Practice for Statistics, which sets out a range of expectations on how producers should plan, design, construct and disseminate statistics based around core themes of trustworthiness, quality and value.
- Trustworthiness - Confidence in the people and organisations that produce statistics and data.
- Quality - Data and methods that produce assured statistics.
- Value - Statistics that support society’s needs for information.
One of the key requirements of the Code is that organisations should commit to releasing their statistics in an open and transparent manner that promotes public confidence. Access to statistics prior to general publication is strictly controlled under the terms of secondary legislation – the Pre-release Access to Official Statistics Order.
Under the Code, together with this Orders, producers of Official and National Statistics must restrict access to unpublished statistics to those directly involved in the production and quality assurance process. The Order permits Official Statistics to be shared with a minimal number of ‘eligible persons’ (primarily Government Ministers and Senior Officials together with their advisors) no more than 24 hours prior to general publication. HESA will normally accept requests to provide pre-release access to eligible persons where such requests are fully compliant with the Pre-release Access Order, subject to the requirement to keep the number of such persons to an absolute minimum. Access prior to publication is not made available to any other parties under any circumstances, and this includes members of the UK press and media.
Information on HESA’s compliance with the Official Statistics framework is available via our website.
The Office for Statistics Regulation (OSR) conducted a review of HESA’s Graduate Outcomes publication during February and March 2021, culminating in release of their findings on 18 March 2021. The OSR found a range of features which demonstrated the trustworthiness, quality and value of the statistics, and supported a range of further improvement work that HESA was already addressing at the time of the review.
Freedom of Information (FOI)
HESA is not covered by this legislation as we are not a Public Authority under the Freedom of Information Act 2000. However, HESA aims to support openness and transparency in its operations and we publish extensive information via our website as well as responding promptly to all reasonable requests for information.
Competition Law
HESA evaluates all dissemination practices to ensure compliance with UK Competition Law. As part of HESA’s compliance, where information is approved for sharing, we seek to make it equally accessible to all potential competitors.
Previous: Key users and uses Next: Ethical considerations