Skip Navigation
Main Content

9.3 Data protection and privacy 

As with copyright and IPR, HEIs are generally also very well aware of their responsibilities under the Data Protection Act (1998), therefore this section merely serves to highlight a few tips to avoid issues that can arise due to the ease of capturing and sharing information on social media. Particular care needs to be taken with regard to the sharing of images and video clips where individuals are recognisable, as this may infringe on an individual's right to privacy (as defined by Article 8 of the European Convention on Human Rights) as well as data protection legislation. Personal data must be fairly and lawfully processed and learners should be informed about all uses of their personal data and consent to that use. Institutions should also be aware that individuals captured on audio or video undertaking activities such as singing, dancing, acting, miming, reading aloud or even simply giving a lecture may be covered by performers' rights and their explicit consent will be required to publish the video clip or podcast. The Web2Rights Project established that even avatars recorded in virtual worlds can acquire performers' rights.

The Data Protection Act makes special provision in relation to sensitive personal data: this comprises data about a person's religious beliefs as well as personal data relating to racial or ethnic origin, political opinions, membership of trade union organisations, physical or mental health, sexual life and offences or alleged offences. Whenever processing sensitive personal data, explicit consent is required and additional safeguards should be in place. Social networks that support student societies may therefore process sensitive personal data. The ease of combining data from different sources may also mean that personal data or sensitive personal data, whilst anonymous in its original source, can be aggregated with other data such that individuals are identifiable.

In Section 3, Delivering benefits, we look at the potential uses of social media in supporting research and sources of guidance (see Minocha and Petre 2012) to ensure that research projects conducted using social media comply with university ethics policies and data protection legislation.
Care also needs to be taken in using social media channels to target advertising. Collecting the personal data of individuals via social media channels for purposes of advertising or marketing will not of itself breach the Data Protection Act, but users have the right to object to this. People should therefore be given the opportunity to opt in before being exposed to marketing or advertising material from the institution.

Individual users should consider that data posted to or uploaded to social media sites that are outside of the European Economic Area may not be covered by appropriate data protection and they may find themselves in breach of UK data protection legislation.

Good practice tips:

●     Protect individual privacy – ensure that consent is obtained before using images of individuals. A model consent form has been provided by Web2Rights.

●     Help your users stay safe – provide guidance to staff and students on the risks inherent in sharing personal data via social media.

●     Stay legal – ensure that the institution's social media-related data-processing complies with relevant legislation.

●     Consider research ethics – provide guidance on the use of social media in research and ensure that ethics policies are updated to cover research conducted using social media.

●     Do not spam others – invite people to opt in to receiving marketing material.

●      Offer clarity about your policy – for institutionally-hosted sites consider developing a privacy policy – you can use the template provided by Web2Rights as a basis for this.


Additional resources

The Information Commissioner's Office has published guidance on the application of the Data Protection Act to social networks.
Blank Image