Version 6

The Implications of Data Protection and Freedom of Information for Creating Records

For whom is this guidance intended?

This guidance is intended for all University staff who produce records as part of their everyday work. It highlights the issues you should consider when creating any University record, and it provides specific guidance on common document types that raise particular issues.

It is particularly relevant for those who write about identifiable, living individuals,or who write references or Board of Examiner minutes. .For those needing guidance on the implications of Data protection and Freedom of information for committee servicing please refer to the following guidance document:

What is the purpose of this guidance?

The aim of this guidance is to ensure that you and your colleagues have the information you need to carry out your job, that the University has the official records it needs, and that we can respond quickly and easily to requests made under the Data Protection Act 1998 and the Freedom of Information (Scotland) Act 2002.

Why is this an issue?

The Data Protection Act 1998 and the Freedom of Information (Scotland) Act 2002 both give people rights of access to information held by the University.

The Data Protection Act permits people to see most of the information that the University holds about them (including information in e-mails, on personal drives of computers, or on home computers if you work from home) if they make a subject access request.

The Freedom of Information (Scotland) Act gives people the right to access any other recorded information that the University holds (again, including e-mails, information on personal or home computer drives or meeting minutes). The rights of access under the Freedom of Information (Scotland) Act came into force on the 1 January 2005, but these rights are retrospective and apply to documents created before this date but in the University’s possession.

Although both pieces of legislation include exemptions that will apply in certain circumstances, it is advisable to work on the assumption that all information you create will be accessible to somebody.

The Freedom of Information (Scotland) Act has also required the University to develop a publication scheme. This is a list of the types of information that the University will make available to the public as a matter of routine without waiting to receive an individual request. The University’s publication scheme can be viewed at Inclusion of an item in a publication scheme is a legally binding commitment to publish that information in its entirety to the timetable set out in the scheme. However, if your information is included in a publication scheme you do not have to respond to individual requests for information, so if you expect that an area of your work will attract a large number of individual requests, it will save you time if you include that work in the University’s publication scheme.

Whose responsibility is this?

Individuals employed by the University are responsible for ensuring that their written communications are professional in tone and follow the general principles set out in this document.

What is a record?

For the purposes of this guidance, a record is ‘recorded information in any format’. It includes official University documents, references, e-mails, video recordings, photographs and even Post-It notes.

How does this guidance affect academic freedom?

It is not intended that this guidance should limit academic freedom; the ability to debate and examine contentious, uncomfortable or other difficult issues is an essential part of the University's mission. However, debate should be conducted in a professional manner which meets the requirements of the Data Protection Act, other relevant legislation and the University’s own Code of Professional Practice.

What do I need to think about when creating a record?

Before creating the record, consider the purpose of the record. Ensure that you include all the information necessary to achieve that purpose, but do not include extraneous information.

What should I do when writing about an identifiable, living individual?

As well as giving people the right to see the information we hold about them, the Data Protection Act also requires us to ensure that the information we hold about identifiable, living individuals is relevant, accurate but not excessive.

The following points will help you to achieve this in documents you create (all the examples are based on real situations):

  • Do not include irrelevant information. For example, when giving an academic reference it is unlikely to be necessary to comment on a person’s health, financial position or personal circumstances unless they have a direct bearing on the person’s academic achievement.
  • Clearly differentiate between matters of fact and opinion. For example, say, ‘In my opinion, this person has difficulty mixing with others’, rather than, ‘This person cannot mix with others’.
  • Do not express opinions that you are not prepared to defend, or which you cannot substantiate. For example, do not say, ‘This person has no personality whatsoever’; this clearly cannot be substantiated.
  • Do not express opinions in areas where you are not qualified. For example, do not say, ‘This person has a personality disorder’, unless it is relevant and you are qualified medical practitioner in a position to make such a diagnosis, or you know that a qualified medical practitioner has diagnosed the condition. It might be acceptable in some circumstances to say, ‘I am concerned about the mental health of this person’ but only if it is relevant to the matter under discussion.
  • Always be sure of the facts. Do not say, ‘This person has no archival research experience’ if you do not know the full details of their career. Instead say, ‘While this person was studying with me they did no archival research’, or, ‘To my knowledge, this person has no archival research experience’.
  • Do not write in anger or in haste. This is a particular danger with e-mails because of the immediacy of e-mail as a means of communication. Do not say, ‘This clod should be horse-whipped’. Wait and write once you have calmed down.
  • Always speak respectfully of the person, even when expressing negative information. For example, do not say, ‘This student is the weakest link. Goodbye’. Say, ‘This student’s performance falls significantly below the standards required for this course and we cannot allow them to continue their studies’.

What do I need to think about when providing a reference?

The University will develop a policy on references at a later date. In the meantime, please take the following into account whenever you are asked to give a reference.

The Data Protection Act states that if you are somebody’s referee then you are not required to provide a copy of the reference to its subject, even if they make a subject access request. However, the organisation to which you provided the reference may be obliged to provide a copy of the reference to the data subject if they make a subject access request. In effect this means that individuals will probably be able to see what you say about them in a reference. In some cases, for example, peer review, access may be provided by removing details of who gave the reference but releasing the text of the reference.

You should write your reference on the assumption that the data subject will be able to see what you have said about them. This does not mean that you cannot give an honest reference; the individual’s right to see what you have written about them simply enhances the robustness of the reference process.

Do not provide an oral reference; it is probable that the recipient of the reference will make some sort of a record of the conversation, either by recording it formally or by referring to it in notes, e-mails or correspondence. If the candidate later challenges the fairness of the process, the parties involved will need evidence that they followed best practice. An oral reference will seem suspicious regardless of whether or not it was a material factor in the decision.

Please see the previous section on writing about identifiable living individuals for the kind of thing to bear in mind when writing the reference.

What do I need to say if I ask someone to provide a reference?

The University will develop a policy on references at a later date. In the meantime, please take the following into account whenever you ask for a reference.

In many circumstances, a reference will qualify as personal data within the meaning of the Data Protection Act. Data subjects have a right to see the personal data that we hold about them, and this may include references we have received. Therefore, when you ask for a reference about somebody, you must not give undertakings that this reference will be kept confidential as we may sometimes be required to disclose a reference to its subject. Instead of asking for a ‘confidential reference’, simply ask for a reference, and go on to say,

‘The Data Protection Act gives individuals the right to receive copies of the information we hold about them. Please indicate whether or not you object to the disclosure of your reference to the person concerned. If you do object, please also give an explanation of the reasons for your objection. We will take this into account if the person makes a subject access request although we cannot guarantee that the reference will not be disclosed.’

You should not rely on an oral reference alone; if the candidate later challenges the fairness of the process we will need evidence to demonstrate that it was conducted in line with best practice. An oral reference with no record of its contents will seem suspicious regardless of whether or not it was a material factor in the decision.

What issues should I think about when writing minutes of Board of Examiners meetings?

For any minutes, you should consider whether it is necessary to identify people by name. This is particularly the case with minutes of boards of examiners, where the University has made a commitment not to reveal the views of individual examiners. Under data protection legislation students will be entitled to ask for anything said in the minutes about them, while freedom of information legislation will entitle them to any generic comments made in the minutes, for example, comments about the overall standard in the examinations under discussion.

The simplest way of ensuring that we do not release which examiner said what, is not to include this information in the minutes. For example, instead of saying ‘Professor Smith said that the candidate did not show enough originality of thought to qualify for a first’, say, ‘It was suggested that the candidate did not…’, or ‘An examiner said…’. It may not even be necessary to record the discussions in such detail, in which case approaches such as, ‘The candidate received a 2.I because he did not show sufficient originality of thought to qualify for a first’, are recommended.

What should I consider when creating documents which are included in our publication scheme?

We have a legal obligation to publish any information included in our publication scheme. If a document is due to be published under the publication scheme, do not include in it any information that you do not think should be published. For example, rather than refer to people by name, it might be more appropriate to refer to them by their role.

In some cases the publication scheme will limit the types of information that will be made available. For example, the publication scheme might say that the minutes of open committee business for a particular committee will be published within one month of the approval of the minutes, but that the minutes of closed business will be published at a later date, or not published at all. Alternatively the scheme might say that all information in the minutes will be published except for information which qualifies for particular exemptions set out in the Freedom of Information Act. If the scheme is limited in this way, and you decide to withhold certain pieces of information from publication, you must record how those items qualify for the exemptions set out in the publication scheme.

How should I deal with drafts?

Please refer to the Frequently Asked Questions section on the Records Management website:

What should I do now?

Review the approach that you adopt when you create records, particularly e-mails and references.

Secretaries and convenors of committees should consider which approach is most suitable for your committee and advise the committee accordingly.

What help is available?

The University Records Management Section provides advice, guidance and training on data protection, records management and freedom of information issues.

For further information please refer to our website email us at

Susan Graham

June 2005

1