Student mental health data sharing guide issued by UUK

Julian Sladdin and Andy Cornforth of Pinsent Masons have been commenting after Universities UK issued guidance to universities to help them understand “when and how to involve families, carers or trusted contacts when there are serious concerns about a student’s safety or mental health”.

The guidance was developed in conjunction with Papyrus, a charity focused on the prevention of suicide in the young, and is supported by the UK’s data protection authority, the Information Commissioner’s Office (ICO).

Cornforth said the guidance helps “de-mystify a previously grey area” and demonstrates that data protection principles can support common sense approaches to handling difficult situations.

The guidance makes clear that university and college staff should not see data protection law as being a barrier to sharing information when it is necessary and proportionate to do so. In the context of preventing loss of life, or serious physical, emotional or mental harm, it is more important for universities to act swiftly than to become bogged down in legal complexities.

Information commissioner John Edwards has said that universities and colleges “should not hesitate to share students’ personal data to prevent serious harm to the physical or mental well-being of a student in an emergency situation, or protect a life”. He said: “Data protection law allows this, and you won’t get into trouble if you share information with someone who is in a position to help a student at risk.”

Cornforth said that it can be more challenging for universities and colleges to assess the necessity and proportionality of data sharing when the situation is less acute, for example where a crisis point has perhaps not yet been reached but looks to be on the horizon. In this regard, he said the UUK’s central message is that institutions should be proactive.

Cornforth said: “Universities should develop clear policies and procedures around when and how family members, carers and trusted contacts can be involved when there are concerns about a student’s mental health. In addition, universities and colleges should engage students in open conversations at the outset as to when information might be shared with trusted contacts, and students should also be made aware that in certain circumstances personal information could be shared even when they have not given their consent.”

Cornforth said that consent may not be the most appropriate lawful basis to rely on for sharing personal data between university mental health support services and the NHS.

“There can be real issues when personal data is processed on the basis of consent, if there are circumstances in which a refusal to give such consent can be overridden,” Cornforth said. “In these instances, are we really asking for consent in the first place? It’s not really freely given. It’s not really a genuine choice. ICO guidance says that ‘if you would still process the personal data without consent, asking for consent is misleading and inherently unfair’. Organisations should therefore only ask for consent for processing in circumstances where, if such consent was refused, there would be no necessity for the processing to take place irrespective of the refusal.”

“Where processing is necessary, such necessity is reflected in each of the other lawful bases for processing personal data under Article 6 of the UK GDPR. What’s really important then, is that there is transparency at the outset as to, if consent is to be used, the circumstances to which it applies, and the circumstances in which the university will decide to share on the basis that it believes such sharing to be necessary. This is where open conversations fit in about how and when trusted contacts might become involved when there are serious concerns about mental health,” he said.

Higher education expert Julian Sladdin said: “Higher education providers increasingly have to deal with situations where they need to balance the interests of student’s mental health and well-being against concerns about breaching the student’s rights under data protection. These decisions often have to be taken in complex and urgent situations where there is risk of self-harm or suicide. The latest UUK guidance with its recommendations around how providers can engage students early by using an opt in process at enrolment to designate a trusted emergency contact, check in processes and improved suicide prevention planning will hopefully ensure that the sector is better equipped to deal with these issues when they arise.”

“However, careful implementation will be important. One vital area will be training staff to carry out better risk assessments in emergency cases and avoid the understandable hesitancy around disclosure of personal data with or without consent when there is urgent need for intervention,” he said.        

Pinsent Masons was part of the Information Sharing Taskforce set up by UUK which helped to put together the guidance.