Privacy notice for student misconduct complaints

Introduction

The Manchester Metropolitan University (‘the University’) is the Data Controller in respect of the personal data that is provided to us in the process of dealing with misconduct complaints. The University is registered as a Data Controller with the Information Commissioner’s Office (ICO), and manages personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the University’s Data Protection Policy.

The University collects, holds and uses certain personal information when a complaint is raised in order to investigate and determine the outcome of that complaint.

The personal data we process

When the University receives a misconduct complaint from a reporting party, we will use this information to create a misconduct complaint file. This file will be used to store all information that we process in the course of investigating the complaint, including but not limited to:

Information relating to the reporting party and the responding party

This includes:

contact details
course details or role
any relevant associated medical information
details relating to the complaint including the nature, background and effects, personal views and accounts, including witness statements
associated evidence, which may include photos, video, communication exchange or social media information).

Information relating to third-party witnesses or other relevant individuals

This includes:

name
relationship to the reported or reporting party
basic contact details
personal accounts
additional evidence relevant to the case in question.

The above information will be collected directly from the reporting and responding party, and from other third-party witnesses in the course of processing the complaint.

The purpose of the processing

The University will use the data in order to investigate the raised complaint and determine an outcome.

This processing fulfills the core functions of the University as a public authority and is conducted in the public interest. As such we rely upon the public task lawful basis to conduct this processing, and Article 9(2)(g) ‘substantial public interest’. In particular, for the purposes of preventing or detecting unlawful acts, or safeguarding individuals at risk; Data Protection Act Schedule 1, Part 2(10) and (18)).

In addition, the University has a duty to investigate complaints under the public sector equality duty and the anti-discrimination provisions of the Equality Act 2010 and the Human Rights Act 1998.

Who we share data with

It is important that you understand how information collected about you in the course of an investigation is shared with other individuals. Please take time to read and understand this section and contact us if you have any concerns.

The content of the complaintm which may contain personal details from all parties listed in ‘the personal data we process’ section, will be shared with the individuals listed below.

The reporting party

The reporting party will be provided with the outcome of any risk assessments, where these have been deemed necessary due to the nature of the complaint.

In some circumstances, they may also be provided with further information about the outcome of the panel, and the sanction received by the reported person. This will be subject to review and will only be shared where it is deemed suitable and proportionate to do so.

The responding party

The responding party will be provided with much of the information gathered by the investigating officer from all parties contained within the Panel documentation, including from the reporting party. Details of any outcomes and sanctions. This includes witness statements, evidence, and all associated material. The material will be reviewed by the investigating officer and non-relevant, potentially sensitive data will be redacted.

Third-party witnesses

Third-party witnessesincluding members of the pubic, other students, University staff and any other relevant individuals will be approached asking for their accounts. Information relating to the complaint will need to be shared with these individuals to allow for this.

Relevant University staff

Relevant University staff such as investigating officers and hearing Panel members linked to the complaint as appropriate to facilitate this investigation and to address issues identified through the investigation. These staff members will be provided with all documentation relating to the case, as well as agreed outcomes and sanctions.

Representatives

The responding party may be supported by a trade union representative or other individual who will have access to all the information shared with the reported party (see above).

The police

In some circumstances, we may be required to report information to the Police. If the reporting party has also reported the incident and/or concern to the police and they approach us for the information submitted, we may disclose this in order to support the police investigation. In addition, if the reported incident and/or concern is relevant to on-going safeguarding matters and there is a pressing need, which cannot reasonably be ignored, we may report the incident to the police.

Insurance brokers and insurers

Our insurance brokers and insurers may need to be notified where there is a possibility of a claim being raised against the University. We may need to share full details about the alleged misconduct which may include information about all involved parties.

Office of the Independent Adjudicator

If you refer a complaint to the Office of the Independent Adjudicator, there may be a need to share personal data with them in order to respond accordingly.

We will always review information for relevancy before sharing and redact and censor any personal information that is not deemed necessary to meet the purpose.

How long we hold information for

Information relating to the complaint will be retained by the University until the conclusion of the investigation plus six years.

The University will retain an anonymous record of all reports made. This information is collected for reporting purposes. This includes the development of reports for senior management and governing bodies, recording trends and providing intelligence to inform understanding of the type and scale of harassment. This will help to facilitate targeted preventive and response measures and inform policies and general practice. You will not be identifiable from this data.

Your rights and further points of contact

If you have any queries about this privacy notice or the processing of your personal data in managing the complaint process please contact the Central Student Case Management team:

For further information about the processing of your personal data by the University please see our privacy notice pages.

For information about your data subject rights (including erasure) please see our data subject rights page.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority in respect of the processing of your personal data. We would encourage you to expend our internal complaints procedure through our initial contact and the University Data Protection Officer, prior to contacting the ICO.

Please contact:

For any further contact information please see: https://ico.org.uk/global/contact-us/.