Sharing information under the law

Ad hoc or one-off data sharing

The University may receive requests for personal data from individuals or organisations who are not the data subject. Examples include:

• the police asking for information about people involved in a criminal investigation
• lawyers asking for information on behalf of a client
• organisations investigating fraud
• journalists requesting information about students, staff, or alumni 

In all these situations there is a legal framework for responding. Please check each request with the data protection team. Even if the requester is stressing the urgency on the phone or in repeated emails, do not panic and request the information be made in writing. Obtaining information about someone by deception or “blagging” is common approach that the ICO often highlights.

Routine or repeated sharing

The University may wish to share personal data for specific purposes with another organisation or multiple agencies. In these cases, a Data Sharing Agreement, Information Sharing Agreement or Data Sharing Protocol should be set up to define:

• what data will be shared
• how the sharing will be fair and lawful under data protection law
• the roles and responsibilities of each party in regard to the data
• a regular review date to monitor processes and outcomes

A template may be provided by another organisation and be acceptable. The following is a University template for these situations:

• Data sharing agreement template (.docx)

In all cases consult the data protection officer by emailing dataprotectionofficer@essex.ac.uk