Preventive action - or legal conflict

Institutions must ensure that they are not hit by new laws governing human rights and the gathering of data, warns Alison Goddard

If one of your students owes the university money, what do you do? Withhold her degree result? What if she then sued senior staff for blocking access to her exam marks, arguing in court that they formed part of the data on her held by the university?

What if she sued because she had failed to get a job as she could not demonstrate that she had passed her degree? Or what if she did get the job and won access to the confidential reference that you wrote and that formed part of her employer's records?

These questions and others will be tested in the coming years, following new legislation.

The Data Protection Act 1998 will come fully into effect on March 1. It is longer and more complex than existing legislation and will have significant consequences for universities and colleges.

"One of the interesting aspects is that withholding exam results is one of the holds that universities have over students who don't pay their fees. That will be very difficult to sustain in future," said Andrew Charlesworth, senior lecturer in law at the University of Hull.

Under the act, after 40 days a university must respond to a student's request for access to an exam result, as this forms part of the data the institution holds on him or her. Withholding marks "cannot be sustained indefinitely without falling foul of the act," said Mr Charlesworth.

Institutions could risk a fracas outside an examination room by banning a defaulting student from sitting exams. Examiners could delay marking scripts until the student has paid, but this strategy poses its own problems. Mr Charlesworth said: "It provides all kinds of opportunities for lost scripts. Also, if you have a borderline candidate, it throws the result into confusion as there is an extended time period for the moderation of marks."

The act has other implications for exam results. The practice of posting exam results in a public place could breach the Data Protection Act, as could announcing the results at graduation.

"If you ask all the students in advance for consent, you go some of the way towards addressing that issue, but the problem is that consent can be withdrawn," said Mr Charlesworth.

Students and staff will be entitled to see all the information an institution holds on them, with some exemptions, including exam scripts. Confidential references by a tutor are also exempt, but confidential references received by a tutor are not, so students could get access to the reference from their school on their application form, if the university keeps it. The Universities and Colleges Admissions Service is aware that students will be able to see school references.

"Confidential references are potentially quite damaging, not just for the person on whom they have been written but on those who wrote them. If you are writing a reference you can have a major effect on someone's life and career. In the United States, people are suing referees who have written rude things about them," said Mr Charlesworth.

Universities collect a great deal of information about their students. More and more are centralising data collection and issuing swipe cards to serve as proof of identity, provide access to buildings and membership of the sports centre. Students will be entitled to see all this information. Moreover, if universities want to use the data for management purposes or commercial ventures with other bodies, they will have to obtain permission from their students to do so.

But there is a clash between the Data Protection Act and the Freedom of Information Bill, said Chris Pounder of law firm Masons. Requests for data made under the Freedom of Information Bill could be denied if they were viewed as requests for data under the Data Protection Act. "It is essential to modify the interface between data protection and freedom of information because there is a real risk that bona fide FOI access requests could be treated as access to personal data. This would mean that they have to be considered under data protection rules laid out in the bill," said Dr Pounder.

The Human Rights Act 1998, the main provisions of which will be implemented on October 2, will also affect higher education. Alison Castrey, of law firm Veale Wasborough, warned that under its terms universities will have to demonstrate that sanctions are "proportionate". Students who can demonstrate "an obvious and dire effect" as a result of information being withheld could also have a case. For example, a student who was offered a job but needed a degree result to take it up could show an economic loss if information were withheld.

"The Human Rights Act is going to intrude all over the place and jump out and bite," said Max Weaver, deputy provost of London Guildhall University. Under Article 6, for example, students are entitled to a fair and public hearing within a reasonable time by an independent and impartial tribunal established by law.

At present in each pre-1992 university, disputes are settled by a visitor who has a jurisdiction that the UK courts have found to be exclusive. "The question is whether the visitor is sufficiently independent and whether the hearing is public. When the Human Rights Act becomes available in the UK courts, students and employees of a university will be able to get part-way through a hearing, and if they don't like the way it is going, they can throw in this extra appeal," said Mr Weaver. "The student will be able to toss in a hand grenade of some power that will send the university running for cover," he added.

The Human Rights Act could also have implications for the withholding of degree results, he said. If a student has an unpaid accommodation bill, for example, withholding his degree could conflict with the HRA. "The existence of the HRA will give greater force to intuitive arguments. A student could argue the debt is unrelated; that he has earned his degree. The withholding of a degree for unrelated debt may well fall foul of the HRA," said Mr Weaver.

Unlike private-sector bodies, which can choose to take legal risks, universities and other public bodies are constrained by their image and, therefore, more likely to follow legal declarations even when they disagree with them. "It would be very difficult for a university to proceed in a way that had been declared by the courts to not be right," added Mr Weaver.

But the extent to which universities are public bodies affects the rights that staff and students will have under the HRA. It contemplates two different kinds of public authority - those that are public authorities for all purposes, and private bodies, any of whose functions is of a public nature. The law, however, does not define these categories. David Feldman, dean of law at the University of Birmingham, said: "It is important to distinguish public authorities from non-public ones. It is also important to distinguish all-purpose public authorities from limited-purpose public authorities, because the latter is not a public authority in relation to an act if the nature of the act is private.

"In relation to their particular functions in conducting publicly funded teaching and research, it is much more likely that universities will be regarded as limited-purpose public authorities. This means that the systems for many student admissions ... and student discipline are likely to have to comply with convention rights. The position may be different in relation to staff, students on self-funding courses, and teaching and research projects that are not supported from public funds."

The problems posed by the legislation are compared to those of the millennium bug. "You could have lawyers combing university procedures looking for conflicts with the Human Rights Act," said Mr Weaver. Universities, said Mr Charlesworth, should be updating their data collection systems in the same way systems were upgraded before 2000.