My Lords, I rise to move Amendment 10 in my name and the names of the noble Lords, Lord Pannick and Lord Macdonald of River Glaven. In doing so, I declare my interest as principal of Somerville College, Oxford.
The GDPR, which will be brought into effect in domestic law by the Data Protection Bill, will have an impact on many aspects of university business from procurement to the commercialisation of research. Universities up and down the land are therefore now making preparations to ensure that they will comply with the new requirements. It is immensely complex, and throughout the Committee stage issues will be raised which are pertinent to universities.
With this amendment I am concerned about one aspect of the life of universities, colleges and schools which will be severely impacted by the GDPR. It is our ability to fundraise and to maintain alumni relations, hence our amendment, which is probing at this stage. I have only recently become aware of the huge importance of alumni relations and fundraising and of the fact that they are inextricably linked. As a consequence of financial constraints and government encouragement, universities, colleges and schools are having to raise more and more money to provide the education and the excellent facilities rightly expected by students.
As far as universities are concerned, with potentially reduced tuition fees, Brexit and, despite what the Government may say, a reduction in the number of foreign students, the need to raise money will increase. At Oxford, the system that I now know best, the excellent tutorial system demands even greater resources.
I do not complain. However, with the introduction of the GDPR our alumni relations and fundraising ability will be severely limited unless we can find a way through, for example by stating that a college, school or university is not a public authority for the purposes of the GDPR. Naturally universities, including Oxbridge colleges, are concerned to ensure that personal data is processed lawfully in the course of contacting alumni for fundraising purposes, and we want to ensure that we work in the most cost-effective way. I should stress that none of the contacts made to our former students relates to cold calling. We are talking about alumni, people who spent three or more years as students, with whom we have therefore have a long-standing relationship. With regard to a college such as Somerville, our alumni feel they belong to a community and they want us to remain in close touch with them.
As the Minister, will be aware, under the GDPR, in order for the processing of personal data to be lawful at least one of the six conditions set out in article 6 of the GDPR must apply. The most important change to the lawfulness conditions by the GDPR concerns the consent condition. The GDPR sets a high standard for consent requiring a positive opt-in, and unless opt-in consent has been obtained, or is obtained in future, current and future contact with alumni will be limited. It is clear that existing consents are unlikely to meet the GDPR standard and as a result all fundraising and alumni databases might have to be rebuilt from scratch and/or a huge exercise undertaken to secure explicit consent from all our former students if the consent condition were to be relied on by colleges to justify their processing of alumni data. This is an enormous administrative task and hugely time-consuming. At Somerville, we are already grappling with the new consent standard, and it is both difficult and detrimental.
I understand that when the Council for Advancement and Support of Education—CASE—met DCMS and the Information Commissioner in May it was suggested that the legitimate interest condition could, in appropriate circumstances, be relied on by fundraisers. However, this condition does not apply to processing by public authorities. While the GDPR contains no definition of public authority, Clause 6(1) states:
“For the purposes of the GDPR, the following (and only the following) are ‘public authorities’ and ‘public bodies’ under the law of the United Kingdom—
a public authority as defined by the Freedom of Information Act 2000”.
The Freedom of Information Act 2000 contains in Schedule 1 a list of public authorities which includes, at paragraph 53,
“the governing body of … a university receiving financial support under section 65 of the Further and Higher Education Act 1992”,
and,
“any college, school, hall or other institution”,
of such a university. It is clear that universities, colleges and schools fall within this definition of public authority, which would mean that the legitimate interest
condition could not be applied and they would have to rely on either the public interest condition or the consent condition.
I know that the Bill team recently had a meeting with UUK at which this issue was discussed. Oxford University was not present, but this was not due to lack of interest or concern; it was agreed that Cambridge should represent the interests of Oxbridge as a whole. At this meeting, the Bill team was apparently clear that it had put exemptions in the Bill to protect the position of universities. I am glad that there is no policy dispute, but I have to say that my noble friends and I have been unable to identify the exemptions.
The Minister may say that it is a matter that will be dealt with by guidance, but I regret that in my view guidance will not suffice. This is a matter of huge importance to universities as well as to colleges and schools, and there needs to be clarity in the Bill. I look forward to the Minister’s response. If, as I suspect, we do not reach agreement today, I would be grateful if the Minister’s office could arrange a meeting with interested Peers so that we might discuss this further. I beg to move.