0 Shortlist Search
Enter your keyword, course, subject or interest
EC Default Banner

Student Personal Learning Support Plan Privacy Notice

Who is collecting the information?

Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

Why are we collecting it, and what are we doing with it (Purpose)?

We collect this information to assess your learning support needs. The Learning Support Advisers (LSA) can then make recommendations to teaching staff and LDTs for reasonable adjustments in the classroom/learning environment and for alternative assessment arrangements. The LSA will also note in the PLSP any future support meetings with you.

What personal data do we collect?

Personal data

  • Name (first name, surname)
  • Date of Birth
  • Student Number
  • Address
  • Telephone number
  • Email address
  • Parent/Key worker (if applicable)
  • Third Party Contact (if applicable)
  • Course title
  • Scottish Candidate Number
  • Campus
  • Carer
  • Care experienced
  • Education and qualifications history

Special Category Personal Data

  • Disabilities/Learning Support needs
  • Evidence of disability

How are we collecting this information? What is the source?

Most of the information is collected directly from the student, but we also generate information by screening the student if they disclose dyslexia.

The lawful basis for the processing

Under data protection law, the lawful basis for processing your data is Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject” and Article 6(1)(e) “Processing is necessary for the performance of a task carried ut in the public interest or in the exercise of official authority vested in the controller” The College is required to provide support an make reasonable adjustments under the Equalities Act 2010. The Post-16 Education (Scotland) Act 2013 requires the College to provide quality, fundable courses and appropriate support for students. For special category personal data, the lawful basis is Article 9(2)(g) “processing is necessary for reasons of substantial public interest, based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.” Where you have authorised that your progress at college is communicated to a parent or guardian or another organisation, then the legal basis is consent (Article 6(1)(a)). It’s important to note that consent can be withdrawn at any time. Please communicate with your Learning Support Adviser (LSA) if you wish to withdraw your consent.

Who we share the information with

We use the information on the PLSP to make recommendations to teaching staff and Learning Development Tutors (LDTs) for reasonable adjustments in the classroom/learning environment and for alternative assessment arrangements.

We may share personal data with dyslexia assessors and support suppliers (third-party suppliers). All data is shared to support the students' disclosed needs.

If you are a student within the school-college partnership, we ask your Guidance Teacher for information about and evidence of your learning support needs. We also share information with Local Authorities, e.g. social work.

Where you have requested that an individual or organisation is kept up to date with your progress at college, we do this but only with your written permission.

All sharing is carried out securely, and with appropriate documentation in place.

How long do we hold the personal data? 

We retain the data in your PLSP for 5 years, after which the information will be securely destroyed in accordance with college procedures.

Individuals’ rights in relation to this processing

Under data protection law, you have a number of rights; some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing, and the College would be required to process your request within one month.

The rights that apply to this particular processing are:

  • Right to be Informed – i.e. a privacy notice.
  • Right of Access – this means you have the right to access your personal information.
  • Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
  • Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request that your personal data be deleted.
  • Right to Data Portability – this means you have the right to request your information in a machine-readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
  • Right to Restriction – this means you can restrict the processing of your information and links with some of the other rights.
  • Right to Object – this means you can object to how your data is used.
  • Right to be informed of automated individual decision-making (including profiling) – we do not use this for OH purposes, and therefore this does not apply.

Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time, and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

Complaints to the UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance, please contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome, then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO guides on the ICO website.

You can email them at casework@ico.org.uk, call them on 0303-123-113, or you can send a letter to them at the following address:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF