Records Management Section
The University of Edinburgh Records Management Section
 

Distance Education and Virtual Learning Environments: the Implications of Freedom of Information and Data Protection

On this page:

Audience

This guidance is intended for University staff involved in delivering distance education or using virtual learning environments (VLEs), including course organisers, teaching staff and administrators.

Purpose

The guidance sets out the ways in which the Freedom of Information (Scotland) Act 2002 and the Data Protection Act 1998 impact on distance education and VLEs at the University. It provides advice on how to comply with these pieces of legislation.

Scope

This guidance applies to all information created and stored in virtual learning environments and in the provision of distance education courses. It concerns integrated systems of networked online tools and resources that support and facilitate course management, learning, teaching and assessment on campus or at a distance. Examples of such systems in use at the University include WebCT, EEMeC, EEVeC and FirstClass.

How does the Freedom of Information Act affect my distance education course?

The Freedom of Information (Scotland) Act 2002 entitles anyone from anywhere in the world to request access to any information held by the University. The University must either provide the information or explain why the request cannot be met by referring to exemptions set out in the Act. This means that members of the public can request access to information held in or relating to VLEs and distance education courses, including teaching materials.

Freedom of information legislation in this area is complicated and there are currently few examples on which to base responses to requests for distance education course materials. However in two cases where teaching materials were requested both the Scottish Information Commissioner and the Information Tribunal ruled that the materials should be provided to the applicant.

These decisions have significance for all universities. Although the decisions to disclose teaching materials were specific to the circumstances, it means that the University will sometimes have to provide materials concerning distance education courses in response to freedom of information requests.

In response to a previous request this university refused to provide PowerPoint slides for one course, but on other occasions has provided the slides for a specific lecture, and the course handbook, reading list and handouts for specific courses.

What should I do if I receive a request for information concerning my distance education course?

If you receive a request for any distance education or VLE material and you have concerns about releasing it, please contact the Records Management Section at the earliest opportunity. The section will work with you to ascertain whether there are grounds for withholding the information and assist in constructing a case for doing so, if appropriate.

Further information about the types of information that might be requested, common issues and possible exemptions is provided below. When contacting the Records Management Section, please think about how these apply to your circumstances.

Presentation data and applicable exemptions

Presentation data is information such as the course syllabus, teaching materials and lecture notes, a library of documents or recordings, weblinks and a course bibliography. Presentation data held in a virtual learning environment should be disclosed, unless an exemption applies. The most relevant exemptions relate to:

  • Commercial interests. The release of some presentation data could "substantially prejudice" the University's commercial interests, for instance by allowing competing institutions to adopt material from its courses. The University operates in a competitive, global market, in which the recruitment of students is directly linked to income. The disclosure of some teaching material may therefore place the University at a commercial disadvantage as competing institutions can make use of these resources to attract more students. For this exemption to apply we must be able to demonstrate why, in the specific circumstances, the University will suffer commercially. Consider the nature and volume of the information requested, its value on its own merit (not as part of an overall course), the market in which the course operates and examples of how the University would suffer commercially or financially if the information was made public.
  • Research material. If a member of staff is undertaking research and places material relating to that research in a VLE, this may be exempt from disclosure while the research is still in progress.
  • Information otherwise accessible. This exemption might apply if the information requested is available by another route, for example in a public library or retail outlet. It also covers information accessible from the University's publication scheme. This is a list of the sorts of information that the University makes available on a routine basis.

Communications data

Communications data is information such as announcements by the course coordinator, course calendars, discussion boards, emails and blogs. Some common issues relate to:

  • Posts to discussion lists or emails by students. We would not normally expect to disclose this information. Emails from students to staff form a crucial part of the learning process and disclosure could create a barrier to learning. The exemption for "prejudice to the effective conduct of public affairs" could be applied as disclosure may be detrimental to the student and the University's ability to offer an effective learning environment would be compromised.
  • Posts to discussion lists or emails by staff. The same arguments do not apply and it should be expected that the posts of teaching staff would generally be open to disclosure, unless another exemption applies.
  • Content created by students, including student development records, diaries or blogs. Some VLEs contain this type of content, however since the University keeps these records on behalf of students and does not control them, they fall outside the scope of freedom of information and data protection provisions. Students also submit assessment material, such as essays, through VLEs. These materials are submitted in confidence, so will be considered exempt from disclosure.
  • Communications containing personal data, that is, data about living, identifiable individuals. These may be exempt from disclosure.

Third party information

Third party data may be contained in VLEs. This includes multimedia material to augment lectures, and course materials such as images, video clips, sound recordings or documents. Any copies of third party materials should be clearly labelled with warnings about any relevant copyright restrictions in place.

When deciding whether third party information stored in the provision of distance education courses can be disclosed, it does not matter who owns the copyright in the material. Copyright does not prevent the University from providing copies of the information under freedom of information, but the applicant does not have an automatic right to reuse the documents in a way that would infringe copyright. The model letters for replying to freedom of information on the Records Management Section website make this clear to enquirers. The commercial interests exemption, outlined above, may apply where the release of copyright information would substantially prejudice the commercial interests of the copyright owner.

Other information about distance education courses

Everyday information about distance education courses or VLEs not held in a virtual learning environment may be requested, such as minutes of University meetings where courses were discussed. This type of request should be handled in the same way as it is done throughout the University, referring to the following guidance:

How does the Data Protection Act affect my distance education course?

The Data Protection Act 1998 sets out how organisations can handle personal data and gives an individual the right to access personal information held about themselves. The definition of personal data is highly complex and for day to day purposes it is best to assume that all information about a living, identifiable individual is personal data.

In the provision of a distance education course, a range of personal data will be handled, stored and used. This may include: assessment information about individual or group assignments, quizzes, surveys or self-tests along with the relevant grades, or administrative information generated by the virtual learning environment which records when and how often students use it.

The Data Protection Act contains a list of data protection principles that set out how we can use personal data. The principles and other provisions of the Act that are most relevant to the administration of distance education courses are given below.

Use information fairly

Users must be told what you will be doing with their data and who will have access to it. Students are told at matriculation that information will be used for a number of purposes, including for the administration of their studies. If your use of personal data does not fit in with the scope of the matriculation statement or you intend to disclose data to parties that students would not reasonably expect you must inform the affected students.

Keep only adequate, relevant and not excessive personal data

Only keep the data that you need to provide the course and no more. For example if you do not need information about individuals' dates of birth, you should not collect or keep that information.

Ensure that information is accurate and up to date

If any details are recorded incorrectly (for example, a student's mark for an assessment) ensure that it is corrected as soon as possible. If any personal data changes (for example, if a student changes their name), the relevant details should be updated where this is appropriate.

Keep personal data for no longer than is necessary

Only keep personal data relating to the course for the amount of time you need it. For guidance on how long to keep student records for, see the Student records retention schedule.

Adopt appropriate security measures to protect personal data from unauthorised access, amendment or deletion

Ensure that appropriate systems are in place for controlling access to data on computers and portable devices. Seek advice from your local IT support to do this. You may also find the following guidance documents useful:

The right of subject access

Students, staff, or other parties have the right to ask the University for information held about themselves, which includes information relating to the provision of a distance education course. This is treated as a subject access request. If you receive a request of this nature, follow the guidance for dealing with subject access requests.

The right to stop processing personal data

Individuals can ask the University to stop processing personal data about them if it is likely to cause unwarranted damage or distress to them or any other individual. If you receive this type of request please contact the Records Management Section for advice on how to respond.

Sensitive personal data

The requirements for using sensitive personal data are more stringent. Sensitive personal data includes data about an individual's: racial or ethnic origin, political opinions, religious beliefs, physical or mental health, sexual life or the commission of offences. Think carefully about whether you need to use this type of information in the provision of your course. If you do, contact the Records Management Section for further advice.

Why do I need to be aware of the freedom of information and data protection implications for distance education?

A failure to comply with these pieces of legislation can lead to the University being fined up to £500,000 or sued. It could also expose the University, its staff, students, research subjects and other members of the public to risks including fraud, identity theft and distress. A breach of either Act could also cause significant reputational damage to the University, which would impact on a range of its interests, activities and relationships.

What help is available?

The University Records Management Section provides advice, guidance and training on freedom of information, data protection and records management issues. If you require any assistance or would like clarification on any issues mentioned in this guidance, contact us at recordsmanagement@ed.ac.uk.

Author: Michael Gallagher and David Halliday
Version: 2

If you have any comments or suggestions regarding these pages please e-mail them to us at recordsmanagement@ed.ac.uk
Terms and conditions, legal disclaimer and copyright information

The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336

Page last updated: Wednesday February 16 2011