Intern
ati
o
n
a
l
Jo
urn
a
l
o
f
E
v
al
ua
ti
o
n
and
Rese
arch in
Education (I
JE
RE)
V
o
l.3
,
No
.3
, Sep
t
em
b
e
r
20
14, pp
. 133
~141
I
S
SN
: 225
2-8
8
2
2
1
33
Jo
urn
a
l
h
o
me
pa
ge
: h
ttp
://iaesjo
u
r
na
l.com/
o
n
lin
e/ind
e
x.ph
p
/
IJERE
Data Protection Issues in Higher
Education with Technological
Advan
cements
Nigel McKel
v
ey
School of
Education, Queen’s U
n
iversity
, Belfas
t,
N
o
rt
her
n
Irel
a
nd
,
UK.
Article Info
A
B
STRAC
T
Article histo
r
y:
Received April
25, 2014
Rev
i
sed
Jun
20,
201
4
Accepted Aug 26, 2014
Adhering to law
s
whilst working or stud
y
i
ng in an educational
establishment
is often fraugh
t with challeng
es. The Ir
ish Data Protection
Act 1988
(Amendment 2003) strives
to pr
otect th
e
ind
i
vid
u
al wher
e th
eir
p
e
rsonal d
a
ta
is
potentially
being
abus
ed. The a
dvancements in t
echnologies hav
e
faci
lit
ated
educa
tional
es
tabl
is
hm
ents
b
y
im
provin
g
effici
enc
i
es
an
d reducing
costs. However,
this paper wi
ll o
u
tline
the sa
lien
t
featur
es of the s
a
id Act
and
evalu
a
te how well the law adapts
with
technolog
ies such as cloud computing
and biom
etrics. I
t
will endeavour to ali
gn the l
a
w with these techn
o
logies and
offer a
cri
tique
of are
a
s
that
ar
e
poten
tia
lly
la
c
k
ing.
Ca
se
s will
be
disc
usse
d
where pre
ceden
t
s
have been s
e
t
b
y
th
e Iris
h
Dat
a
P
r
otec
tion Co
m
m
i
ss
ioner
and as
a r
e
sult, s
uggestions for
a
data
protection p
o
licy
for High
er
Education
will be proposed. Conclusions
will
draw upon research
con
ducted an
d
suggest whether
the law,
as it sta
nds, it suitable with
the
technolog
ies
mentioned.
Keyword:
Data pro
t
ectio
n
Higher education
Tech
nol
ogi
cal
Adva
ncem
ents
Copyright ©
201
4 Institut
e
o
f
Ad
vanced
Engin
eer
ing and S
c
i
e
nce.
All rights re
se
rve
d
.
Co
rresp
ond
i
ng
Autho
r
:
Nigel M
c
Kelv
ey
,
Sch
ool
o
f
E
d
u
cat
i
on,
Qu
een’s Un
i
v
ersity,
Belfast,
No
rthe
rn
I
r
eland
.
Em
a
il: n
m
ck
el
v
e
y01
@qu
b
.ac.uk
1.
INTRODUCTION
The
Hi
g
h
er
E
ducat
i
o
n l
a
nd
s
cape
has e
vol
ved
co
nsi
d
e
r
a
b
l
y
i
n
rece
nt
y
ears as t
ech
nol
ogy
has
adva
nce
d
[1]
.
Fast
er br
oa
dba
nd c
o
n
n
ect
i
o
n
s
and m
o
re eff
i
ci
ent
net
w
o
r
k
i
ng t
ech
ni
q
u
es
have p
r
o
v
i
d
e
d
b
o
t
h
educat
ors
an
d
st
ude
nt
s
wi
t
h
m
o
re opt
i
o
ns
f
o
r t
eac
hi
n
g
a
n
d l
ear
ni
n
g
.
As
a res
u
l
t
o
f
t
h
ese ne
w a
v
e
n
u
e
s o
f
com
m
uni
cat
i
on suc
h
as
o
n
l
i
n
e di
scussi
o
n
s,
Vi
rt
ual
Lea
r
ni
ng E
n
vi
r
onm
ent
s
(
V
LEs
) an
d m
obi
l
e
t
echn
o
l
o
gi
es,
it is im
perative that data
be
protect
ed through a
policy that
is
m
a
intained a
n
d im
pl
e
m
ented s
u
ccess
f
ully. The
I
r
i
sh
D
a
ta
Pro
t
ectio
n
A
c
t 1988
w
a
s estab
lished
for
th
is
r
easo
n
and
w
a
s am
en
d
e
d
i
n
2
003
to
br
ing
it in
to lin
e
with
th
e European
Un
ion
Dat
a
Pro
t
ection
Di
rectiv
e 95
/46
/
EC and all sections are in forc
e with the exce
ption
of
Sect
i
o
n
4 (
1
3)
w
h
i
c
h
re
fers
t
o
e
n
f
o
rce
d
su
bject
a
ccess
[2
]
.
Th
is
p
a
p
e
r
will en
d
e
avo
u
r t
o
h
i
gh
ligh
t
so
me of th
e
salien
t
features
o
f
the Irish
Data Pro
t
ectio
n
Act
1
988
(Am
e
n
d
m
en
t Act 2
0
0
3
). A critical ap
p
r
aisal will al
so
b
e
co
ndu
cted
on
how th
e
a
m
en
d
e
d
act co
u
l
d
be
i
m
p
l
e
m
en
ted
in
an
Irish Hi
g
h
e
r Edu
cation
a
l In
stitu
te
in
ligh
t
of tech
no
log
i
cal adv
a
n
c
es su
ch as clo
ud
co
m
p
u
tin
g
and b
i
o
m
etrics. Fin
a
lly, a d
i
scussio
n
will refe
ren
ce an ex
isting
po
licy in
term
s o
f
h
o
w it pro
t
ects
th
o
s
e teach
i
ng an
d
st
u
d
y
ing
i
n
Hi
g
h
e
r Ed
u
c
atio
n
in
Irela
nd
. Th
e d
i
scu
ssi
o
n
will also
sug
g
e
st p
r
ov
ision
s
for
in
clu
s
ion
in
such
a p
o
licy which
are g
e
n
e
ral
i
zab
le an
d
applicab
le to
all
In
stitu
tes. Th
e
p
a
p
e
r shou
ld
serv
e to
hi
g
h
l
i
ght
t
h
e i
m
port
a
nce
of a
dhe
ri
n
g
t
o
Dat
a
Pr
ot
ect
i
on l
a
ws (
n
ot
j
u
st
be
cause c
o
l
l
e
ges
are com
p
el
l
e
d
t
o
)
but
because
other factors a
r
e als
o
im
portant s
u
c
h
as the
ri
ghts
of the
student
a
n
d staf
f m
e
m
b
er, t
h
e
pote
n
tial loss
o
f
trust th
at cou
l
d
resu
lt b
y
no
t adh
e
ring
to it an
d th
e em
p
l
o
y
ab
ility o
f
st
ud
en
ts.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
252
-88
22
I
J
ERE
Vo
l. 3
,
N
o
. 3
,
Sep
t
emb
e
r
201
4
:
1
33
–
14
1
13
4
2.
SALIENT
FE
ATURES OF THE
IRISH DAT
A
PR
OT
EC
TION ACT 19
88
(
A
M
E
N
D
M
E
N
T
200
3)
Th
e Irish
Constitu
tio
n
end
e
av
ours to
p
r
ov
id
e a n
u
m
b
e
r o
f
fun
d
a
m
e
n
t
al rig
h
t
s. Th
e
Co
urts h
a
v
e
analysed a
nd i
n
terpreted t
h
es
e rights to also include
ce
rtain une
num
erated ri
ghts.
Suc
h
hum
an rights a
r
e not
ex
p
licitly stat
ed
in
the Con
s
titu
tio
n
bu
t are in
terp
ret
e
d
b
y
th
e Co
urts as
h
a
v
i
n
g
m
ean
ing
[3
]. One
u
n
e
nu
m
e
rated
h
u
m
an
righ
t is th
e righ
t to
p
r
i
v
acy. Th
e EU
Ch
arter
o
f
Fund
am
en
tal R
i
g
h
ts: Article 8
[4] refers
t
o
t
h
e p
r
ot
ect
i
o
n of
pe
rs
onal
d
a
t
a
:
1.
Every
one
ha
s t
h
e
ri
g
h
t
t
o
t
h
e
pr
ot
ect
i
o
n
o
f
p
e
rso
n
al
dat
a
c
o
ncer
ni
n
g
hi
m
or
her.
2.
Suc
h
dat
a
m
u
st
be proces
sed
fai
r
l
y
for spec
i
f
i
e
d pu
r
pose
s
and
on t
h
e bas
i
s of t
h
e conse
n
t
of t
h
e pe
r
s
o
n
conce
r
ned
o
r
s
o
m
e
ot
her l
e
gi
t
i
m
a
t
e
basi
s l
a
id d
o
w
n
by
l
a
w
.
Eve
r
y
o
n
e
has
t
h
e ri
ght
of ac
cess t
o
dat
a
w
h
i
c
h
has
bee
n
c
o
l
l
ect
ed co
nce
r
ni
ng
hi
m
or
her,
an
d t
h
e
ri
ght
t
o
h
a
ve i
t
rect
i
f
i
e
d.
3
.
Co
m
p
lian
ce with
th
ese ru
les sh
all b
e
subj
ect
to
con
t
ro
l
b
y
an
ind
e
p
e
nd
en
t
au
tho
r
ity.
Determ
in
in
g
po
licy th
at will co
nsid
er t
h
ese p
r
ov
isio
ns can
inv
o
l
v
e
m
a
n
y
asp
ects
b
u
t
it co
u
l
d
b
e
considere
d
that
an indivi
dual
’
s right
to information is at
its
core [5].
Havi
ng access to inform
at
ion facilitates
trans
p
are
n
cy as well as accounta
b
ility
[5]. The right to inform
ation augu
rs
positively
for strengthe
n
i
ng the
knowledge of
society but is
only im
ple
m
e
n
table (a
nd
enforceable
) if protected
by law. T
h
e Freedom
of
In
fo
rm
ation (Am
e
ndm
ent)
Act 20
0
3
(F
OI
Act) en
deav
o
u
rs
to
safegu
ard
th
is righ
t. Sectio
n
1(5) of th
e Data
Pr
o
t
ection
A
c
t
1
988
an
d 200
3 pr
ov
id
es th
at:
(a)
A ri
g
h
t
co
nfe
r
red
by
t
h
i
s
Act
shal
l
not
pre
j
u
d
i
ce t
h
e exe
r
ci
se of a ri
gh
t
confe
rre
d by
t
h
e Freed
om
o
f
In
fo
rm
ation A
c
t 19
9
7
,
(b
)
The C
o
m
m
i
ssione
r an
d
In
fo
r
m
at
i
on C
o
m
m
i
ssi
one
r s
h
al
l
,
i
n
t
h
e
per
f
o
r
m
a
nce o
f
t
h
ei
r
fu
nct
i
o
n
s
, c
o
-
ope
rat
e
wi
t
h
a
n
d
p
r
ovi
de assi
st
a
n
ce t
o
eac
h
ot
he
r.
Sect
i
on
7(
7)
of t
h
e F
O
I
A
c
t
im
poses a
dut
y
o
n
pu
bl
i
c
bo
di
es t
o
a
ssi
st
peo
p
l
e
wh
o
req
u
est
inform
ation or
access to a rec
o
rd from
a public body
othe
rw
ise tha
n
unde
r
F
O
I
[2].
In light of this,
Irela
nd
ha
s
striv
e
n
t
o
b
a
lan
ce th
e
righ
t to p
r
i
v
acy and
the righ
t to
informatio
n
with
the ap
po
i
n
tm
en
t
o
f
a
Data Pro
t
ection
C
o
m
m
i
ssi
oner
(DPC
).
[
6
]
su
g
g
est
s
t
h
at
ri
g
h
t
s
can
n
o
t
si
m
p
ly
be i
n
t
e
grat
e
d
i
n
t
o
soci
et
y
w
i
t
hout
t
h
e i
n
cl
usi
o
n
o
f
m
easu
r
es to en
sure th
at v
a
riou
s in
stitu
tion
s
resp
ond
approp
riately to
d
i
fferen
t
group
s. Th
is is arg
u
a
bly an
i
m
p
o
r
tan
t
co
n
s
id
eration
in
a
so
ciety wh
ere tech
no
log
y
h
a
s th
e po
ten
tial to
affect hu
man
righ
ts and
so
the
ap
po
in
tm
en
t o
f
a Co
mm
issio
n
e
r is
n
ecessary.
Sect
i
on 2 (a)
(
i
v) oft
h
e Iri
s
h
Dat
a
Pr
ot
ect
i
o
n Act
i
o
n
1
9
8
8
an
d Dat
a
Pr
ot
ect
i
on (Am
e
nd
m
e
nt
)
Act
20
0
3
(DP
A
) re
fers
to
per
s
o
n
a
l
data as:
”’
p
e
rsona
l da
t
a
’ m
e
an
s
da
ta rela
ting
t
o
a
l
i
vin
g
i
n
d
i
vidual wh
o is
o
r
can
b
e
i
d
en
tified eith
er fro
m
th
e
d
a
t
a
o
r
fro
m
th
e da
ta i
n
con
j
un
ctio
n
with
o
t
h
e
r in
f
o
rma
tion
t
h
a
t
is in
, o
r
is likely to
co
me into
, t
h
e
pos
sessi
o
n
of
t
h
e dat
a
c
ont
r
o
l
l
er”
As ou
tlin
ed
in
Sectio
n
1
1
of th
e DPA, on
e
of th
e
p
o
wers
of th
e Co
mmissi
o
n
e
r is to
p
r
o
h
i
b
it o
v
e
rseas
t
r
ans
f
er o
f
dat
a
[7]
.
It
co
ul
d
be ar
gue
d t
h
at
t
h
e use of cl
o
ud c
o
m
put
i
ng
cont
rave
nes Se
ct
i
on 1
1
o
f
t
h
e
Act
;
ho
we
ver
,
t
h
e
C
o
m
m
i
ssi
oner
has p
r
o
v
i
d
e
d
som
e
gui
dance
on
ho
w t
h
i
s
obst
acl
e can
b
e
ove
rcom
e. A dat
a
cont
roller (c
ollege or unive
r
sity) is
not in breach
of the
DPA if the cloud
services utilised resi
de within a
co
un
tr
y ap
prov
ed
b
y
th
e
Eur
o
p
e
an
Un
ion
Co
mmissio
n
or
is with
i
n
th
e US
‘Safe Harb
our’
[7
]. Shou
ld
the
aforem
en
tio
n
e
d
no
t b
e
th
e case, th
e d
a
ta co
n
t
ro
ller can
still p
r
o
t
ect th
e d
a
ta sub
j
ect
(staff and
st
u
d
e
n
t
s)
b
y
u
s
ing
an
EU-ap
p
ro
v
e
d
m
o
d
e
l co
n
t
ract wh
i
c
h
ou
tlin
es
d
a
ta p
r
o
t
ection
safegu
ard
s
in
acco
rd
an
ce with
EU
st
anda
rd
s.
If
a
n
a
d
e
quat
e
c
o
n
t
ract
can
not
be
est
a
bl
i
s
he
d,
there are
n
i
n
e
altern
ativ
e m
easu
r
es set
ou
t in Sectio
n
11
(
4
)
of
t
h
e
DP
A. T
h
e
dat
a
co
nt
rol
l
e
r
n
eed
onl
y
p
r
ov
i
d
e evi
d
ence
of
ha
vi
n
g
m
e
t on
e o
r
m
o
re
of t
h
e
measures.
Th
e altern
ativ
e m
easu
r
es allow th
e tran
sf
e
r
of data
when necessary if
[8]:
(a)
R
e
qui
re
d o
r
a
u
t
h
o
r
i
s
ed by
l
a
w
(b
)
The
dat
a
s
u
b
j
e
c
t
gave
co
nse
n
t
(c)
Perform
a
nce of a c
o
ntract to
wh
ich
th
e d
a
ta
su
bj
ect is
p
a
rty
(d
)
The c
o
ntract is
entere
d i
n
to at
th
e requ
est o
f
th
e
d
a
ta subj
ect
(e)
Reaso
n
s o
f
substan
tial
p
u
b
lic in
terest
(f
)
Ob
tain
i
n
g leg
a
l ad
v
i
ce
(g
)
Pre
v
ent i
n
jury/
d
am
age
(h
)
Th
e
d
a
ta is an
ex
tract fro
m
th
e st
at
ut
ory
p
u
b
l
i
c
regi
st
er
(i)
Au
t
h
orised b
y
th
e Data C
o
mmissio
n
e
r.
It is ev
i
d
en
t
[7]-[10
]
th
at th
e
d
a
t
a
su
b
j
ect
’s
con
s
ent
ca
n
be
use
d
e
x
t
e
nsi
v
el
y
by
dat
a
co
nt
r
o
l
l
e
rs. T
h
e
q
u
e
stio
n
arises h
o
wev
e
r, as
to
th
e lev
e
l of in
fo
rm
ed
con
s
en
t th
at ex
ists. In
an
educatio
n
a
l settin
g
,
if
a
st
ude
nt
’s
gra
d
e
s
are st
ore
d
i
n
a cl
oud
para
di
gm
, how awa
r
e are t
h
ey
of
whe
r
e t
h
at
dat
a
resi
des.
[7]
r
e
fers t
o
h
o
w th
e DPA o
u
tlin
es ho
w d
a
ta sh
ou
ld
b
e
treated
b
y
stip
u
l
atin
g
th
at th
e d
a
ta sh
ou
ld
b
e
ob
tain
ed
and
pr
ocesse
d fai
r
l
y
, kept
onl
y
fo
r one
or m
o
re speci
fi
ed a
nd l
a
wf
ul
pu
r
pose
s
,
proce
ssed
onl
y
i
n
way
s
co
m
p
at
i
b
l
e
with the purposes for whic
h it was given, kept safe
and secure, ke
pt
accurate
and up-to-date,
a
d
equate,
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ERE
I
S
SN
:
225
2-8
8
2
2
Dat
a
Pr
ot
ect
i
o
n
Issue
s
i
n
Hi
g
h
er E
d
ucat
i
o
n
w
ith Technological A
d
v
ance
m
ents
(Nigel McKelvey
)
13
5
releva
nt and not e
x
cessive
, t
h
at it is
retaine
d
no longer
tha
n
is
neces
sary
for t
h
e s
p
ecifie
d
purpose
or
purposes
and
fi
nal
l
y
t
h
at
a co
py
of
an
i
ndi
vi
d
u
al
’s
pe
r
s
on
al
dat
a
be
p
r
o
v
i
d
e
d
t
o
t
h
e
m
, on re
q
u
est
.
Th
e evo
l
u
tion
o
f
techn
o
l
o
g
y
h
a
s tested th
e scalab
ility an
d
ro
bu
st
n
e
ss
o
f
cu
rren
t laws
[11] an
d
m
a
d
e
adhe
re
nce t
o
dat
a
pr
ot
ect
i
o
n g
u
i
d
el
i
n
es
di
ffi
c
u
l
t
.
W
i
t
h
cl
oud com
p
u
t
i
ng an
d bi
om
et
ri
cs oft
e
n u
s
ed i
n
conjunction
with each ot
her [12], it is necessary to l
ook at the security i
m
p
lications of
utilising
suc
h
tech
no
log
i
es with
in
an
edu
cat
io
n
a
l estab
lishmen
t an
d
wh
eth
e
r
or no
t th
e
DPA (as it ex
ists) will con
tinu
e
t
o
protect the
dat
a
subject.
3.
CLOU
D
CO
MP
UTIN
G I
N
ED
U
CATI
O
N
Techn
o
l
o
g
i
cal
adv
a
n
cem
en
ts in
Hi
g
h
e
r Edu
cation
(HE) estab
lish
m
en
ts h
a
v
e
facilitated
or
ga
ni
sat
i
ons
i
n
r
e
d
u
ci
n
g
t
h
e
am
ount
o
f
st
o
r
age
re
qui
red
i
n
or
der
t
o
m
a
int
a
i
n
a
d
m
i
ni
st
rat
i
v
e rec
o
r
d
s,
e-m
a
il
d
a
ta, stud
en
t/staff
records,
relev
a
n
t
m
e
d
i
cal d
a
ta, lib
rary
re
sou
r
ces
, resea
r
ch in
fo
rm
ation and
adm
i
ssion
s. It is
fo
r t
h
i
s
reas
o
n
t
h
at
cl
o
u
d
ser
v
i
ces ha
ve
bee
n
ad
opt
e
d
b
u
t
c
a
n
oft
e
n
be i
m
pl
em
ent
e
d i
n
a
p
p
r
op
ri
at
el
y
[1
3]
. T
h
e
d
a
ta m
a
in
tain
ed
with
i
n
HE en
v
i
ron
m
en
ts can
h
a
v
e
v
a
rying
d
e
g
r
ees o
f
sen
s
itiv
ity ran
g
i
n
g
fro
m
stu
d
e
n
t/staff
p
e
rson
al reco
rd
s to
library co
n
t
en
ts. It is t
h
erefore th
e au
tho
r
’s
o
p
i
n
i
on
th
at th
e sen
s
itiv
ity o
f
th
is d
a
ta be
categ
orised
and
prioritised
.
Th
is catego
r
isatio
n
m
a
y
h
e
lp
d
e
term
in
e wh
ich
clou
d
serv
ice sh
ou
ld b
e
established
for each data
category.
In th
e
‘cloud
’, wh
en a co
llege (d
ata con
t
ro
l
l
er)
u
s
es
su
ch
a techn
o
l
o
g
y
, th
ey are u
tilising
a
serv
ice
p
r
ov
id
er (d
ata
p
r
o
cesso
r) t
o
main
tain
th
e
data o
n
th
eir b
e
h
a
lf, in
a d
a
ta cen
t
re
[2
].
A client (colle
ge) ca
n avail of va
rious servi
ces within
the
cloud. If serve
r
space is all that is require
d
then “
I
nfra
structure as a
Service” is sufficient, however
, i
f
serve
r
s
p
ace
plus an
operating system
is require
d
then “
P
latform as a
Service”
is m
o
re
appropriate. In a
dditi
on to t
h
e cl
o
ud service(s
)
re
quire
d
, t
h
e cloud type
is an
i
m
p
o
r
tant co
n
s
ideration. Th
is
j
a
rg
on
an
d
tech
no
log
i
cal o
b
s
cu
rity can
often
lead
to a
m
b
i
g
u
ity and
thu
s
b
e
gs th
e qu
estio
n of
what d
a
t
a
pro
t
ection
issu
es m
i
g
h
t
ex
ist
with
in said p
a
rad
i
g
m
.
Th
e
ob
v
i
o
u
s
issu
es
relate to
t
h
e secu
rity of t
h
e cl
oud
p
a
r
a
dig
m
selected
an
d th
e l
o
cation of
th
e d
a
ta
itself. It is i
m
p
o
r
tan
t
to
co
nsid
er t
h
e
laws/gu
i
d
a
n
c
e th
at p
a
ys particu
l
ar attentio
n
to
techno
log
i
cal
adva
ncem
ent
s
i
n
rel
a
t
i
on
t
o
d
a
t
a
pr
ot
ect
i
on. The
eP
ri
vacy
R
e
gul
at
i
o
ns
2
0
11 (S.
I
. 3
3
6
o
f
20
1
1
)
deal
wi
t
h
dat
a
pr
ot
ect
i
o
n
f
o
r
ph
o
n
e (m
obi
l
e
or
ot
h
e
r
)
, el
ect
ro
ni
c-m
a
i
l
,
SM
S and
Internet usa
g
e.
They
give
effect to
the E
U
ePr
i
v
acy
D
i
r
e
ctiv
e 20
02
/58
/
EC (
a
s am
en
d
e
d b
y
D
i
r
ectiv
e
20
06
/24
/
EC an
d 20
09
/136
/EC) [2
].
3.1. Security, Location
an
d
W
r
it
t
e
n Co
ntra
ct
Li
ke any
ot
he
r
or
ga
ni
sat
i
on,
col
l
e
ges m
u
st
st
ri
ve t
o
be m
o
re ec
o
nom
i
c
al
and t
o
l
e
ss
en
t
h
ei
r car
b
o
n
fo
ot
p
r
i
n
t
[
1
4]
. As a res
u
l
t
,
t
h
e
t
r
adi
t
i
onal
m
odes o
f
st
o
r
i
n
g l
a
rge
vol
um
es of dat
a
o
n
e
xpa
nsi
v
e se
rve
r
s
h
ous
e
d
physically on
ca
m
pus is
start
i
ng to
bec
o
m
e
re
placed
by
cloud technol
ogi
es [14].
As the
data c
o
ntroller
has
fu
ll respo
n
s
i
b
ility fo
r th
e secu
rity o
f
t
h
e data u
n
d
e
r t
h
e
DPA (Section 2
C
(3
)) [1
5
]
, it is cru
c
ial t
h
at the
co
n
t
ro
ller
b
e
assu
red
th
at th
e clo
u
d
prov
id
er will o
n
l
y ex
ecu
t
e th
eir in
st
ru
ctio
ns in
relatio
n
to
th
e
p
e
rso
n
al
d
a
ta b
e
i
n
g stored
.
Th
is assuran
ce sho
u
l
d
come in
th
e
form of a
written
con
t
ract as
stip
u
l
ated
b
y
[2
].
Cloud com
puting e
n
a
b
les col
l
eges to access a
m
u
ltit
ude of services
on
de
m
a
nd. Transparency and
co
n
t
ro
l of th
e
d
a
ta is i
m
p
o
r
tan
t
to
a d
a
ta con
t
ro
ller su
ch
as a HE in
stitu
tion
[9
]. Clo
u
d
serv
ices
d
i
min
i
sh
th
ese
capabilities and s
o
c
o
nfi
d
enc
e
in t
h
e cl
oud s
e
rvices
utilised is pa
ram
ount.
One
of t
h
e
DP
A
pri
n
ciples is
that a
dat
a
s
u
b
j
ect
ca
n r
e
q
u
est
t
h
at
dat
a
hel
d
on
t
h
em
be u
p
d
at
ed
or
i
n
dee
d
del
e
t
e
d [
1
6]
. C
l
o
u
d
pr
ovi
der
s
ca
n s
h
ar
e
disk s
p
ace
on s
e
rve
r
s with
other clients
and/or othe
r cloud provide
r
s.
If
data
is to be delet
e
d by wi
ping a
disk,
th
en
th
is m
a
y
b
e
an
im
p
o
ssible task
if an
o
t
her p
r
ov
id
er or clien
t
is u
s
in
g
th
e sam
e
d
i
sk
[1
6
]
.
W
i
t
h
reg
a
rd
to
a
HE e
n
vi
r
onm
ent
,
i
t
wo
ul
d
be
assum
e
d t
h
at
dat
a
be
del
e
t
e
d a
f
t
e
r a
s
p
eci
fi
ed
pe
ri
o
d
of
t
i
m
e
, part
i
c
ul
a
r
l
y
i
n
relatio
n
t
o
st
u
d
en
t/staff
p
e
rson
al reco
rd
s [1
7].
Th
e
d
a
ta cen
t
res with
i
n
t
h
e clo
u
d
o
f
ten
ex
ist in
m
u
ltip
le natio
n
s
wh
ich co
u
l
d
p
r
ov
e
d
i
fficu
lt und
er
th
e DPA i
n
Irelan
d
as
a resu
lt o
f
Section
11
. It is an
im
port
a
nt
aspect
t
o
c
onsi
d
er
by
t
h
e
dat
a
co
nt
r
o
l
l
e
r.
In
a
trad
itio
n
a
l co
lleg
e
or un
iv
ersi
ty, d
a
ta is b
acked
up
regu
l
a
rl
y
and st
ore
d
sec
u
rel
y
. C
l
o
ud se
rvi
ces,
o
n
t
h
e
ot
he
r
h
a
nd
, ar
e a si
ng
le po
i
n
t of
f
a
ilu
r
e
[
9
].
Should
a st
u
d
e
n
t
o
r
staf
f m
e
m
b
er
b
e
u
p
d
a
ting
o
r
r
e
tr
iev
i
ng
a
reco
rd
usi
n
g t
h
e i
n
t
e
r
n
et
(vi
a
a cl
o
u
d
pa
radi
gm
) and a l
o
ss o
f
in
t
e
rn
et co
nn
ectiv
ity o
ccurs, then
d
a
ta co
u
l
d
b
eco
m
e
inaccessible and/or inaccurate
. Suc
h
a scena
r
io could c
ontravene the
DPA where data
shoul
d
be ‘acc
essible
an
d up-
to
-d
at
e’ [7
].
C
l
ou
d ser
v
i
ces
m
i
ght
be c
ons
i
d
ere
d
an e
ffi
c
i
ent
an
d co
st
-effectiv
e
way of d
ealing
with
reg
i
stration
and
fee
pay
m
ent
s
.
It
i
s
im
por
t
a
nt
t
o
n
o
t
e
t
h
a
t
or
gani
sat
i
o
ns
t
h
at
p
r
oces
s o
r
t
r
a
n
sm
it
card
hol
der
(st
u
de
nt
) da
t
a
are requ
ired
to b
e
Paym
en
t Card
In
du
stry
Data Secu
r
i
t
y
St
anda
r
d
(
P
C
I
DSS
)
c
o
m
p
l
i
a
nt
[
1
8]
. It
m
a
y p
r
o
v
e
diffic
u
lt for a college to assi
gn liab
ility over for PCI c
o
m
p
l
i
ance to a cl
oud provide
r
as the DPA pl
aces full
respon
sib
ility for th
e
d
a
ta
with
th
e d
a
ta con
t
ro
ller (Sect
i
o
n
2
C
(3)) [1
5
]
;
[18
]
).Th
is i
n
tu
rn
raises
qu
estio
n
s
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
252
-88
22
I
J
ERE
Vo
l. 3
,
N
o
. 3
,
Sep
t
emb
e
r
201
4
:
1
33
–
14
1
13
6
o
v
e
r th
e su
itab
ility o
f
clo
ud tech
no
log
y
fo
r
reg
i
stration an
d
fee p
a
y
m
en
t p
r
ocessi
n
g
i
n
HE. The lack
o
f
speci
fi
ci
t
y
i
n
t
h
e D
P
A i
n
rel
a
t
i
on t
o
pay
m
ent
card
pr
oces
si
ng
vi
a a cl
ou
d pa
radi
gm
i
s
a pot
e
n
t
i
a
l
cause fo
r
conce
r
n.
4.
BIOM
ETRICS IN EDUC
ATION
W
i
t
h
b
i
o
m
etri
c d
a
ta co
llectio
n
i
n
clud
ing
tech
n
i
q
u
e
s su
ch
as iris scannin
g
,
vo
ice recog
n
ition
,
h
a
nd
geom
etry, fingerprints and face rec
ognition, it is i
m
portant to re
view
the curre
n
t de
finition
of
persona
l
dat
a
[
10]
.
As t
h
e dat
a
deri
ved
by
usi
n
g
bi
om
et
ri
c t
echni
que
s i
s
u
n
i
q
ue t
o
e
ach i
n
di
vi
dual
,
a dat
a
s
u
bject
can
b
e
“id
e
n
tified
”
as ou
tlin
ed b
y
[15
]
and
i
n
d
eed
th
e
Acts.
As
m
e
n
tio
n
e
d earlier,
on
e
o
f
th
e salien
t
features
o
f
th
e
Acts relates to h
o
w d
a
ta co
llected
sho
u
l
d
be “relev
an
t and not exces
sive”. Data store
d
in a
n
educat
ional
establishm
ent
shoul
d
not
unveil sensitiv
e inform
ation pertaining to an i
ndi
vi
dual suc
h
as race [7]. It
is the
aut
h
or
’s o
p
i
n
i
o
n t
h
at
bi
om
et
ric dat
a
collected in a HE envi
ronm
ent
m
a
y in
fact be “exce
ssive” as per Section
2
(1)(c)(iii) of
th
e Data Pro
t
ectio
n
Act 1
9
8
8
(Am
e
n
d
m
e
n
t
2
003
). Ask
i
n
g
stud
en
ts
for fi
ng
erp
r
i
n
ts
an
d
/
or
requesting iris
scans m
a
y be dee
m
ed excessi
ve
in order t
o
record attenda
n
ce for e
x
am
ple.
Schools a
n
d c
o
lleges a
r
e tas
k
ed with kee
p
i
n
g accurate
a
n
d a
uditable
rec
o
rds. It is esse
ntial to store
th
is in
fo
rm
atio
n
securely. Biometrics is a co
n
s
id
erati
on
where a data cont
roller m
a
y
d
eci
d
e
to
u
s
e fing
erprin
t
i
d
ent
i
f
i
cat
i
on
m
e
t
hods
. The f
i
nge
r i
s
scanne
d an
d u
n
i
q
ue p
o
i
n
t
s
i
d
e
n
t
i
f
i
e
d
on t
h
e i
m
age.
The p
o
i
n
t
s
are
t
h
en
con
v
e
r
t
e
d t
o
bi
nary
n
u
m
b
ers
and t
h
e o
r
i
g
i
n
a
l
fi
nge
rp
ri
nt
sc
an dest
roy
e
d [
19]
. Fi
nal
l
y
, t
h
e bi
nary
num
bers ar
e
en
cry
p
ted
to
a
series of d
i
g
its wh
ich
equ
a
te to
th
e stud
en
t’s id
en
tificatio
n n
u
m
b
e
r.
A colleg
e
m
a
y d
eci
d
e
t
o
im
ple
m
ent such a
m
echanism to help
with practical issues suc
h
as
college access, attendance, libra
ry
facilities, lab
o
rato
ry
ad
m
i
ssi
o
n
, m
e
d
i
cal cen
tre
facilities and
t
r
an
spo
r
t
a
tio
n
(co
m
m
u
tin
g b
e
t
w
een
m
u
l
tip
le
ca
m
p
u
s
es) [19]. It is th
e au
th
or’s
o
p
i
n
i
on
th
at wh
ile
bi
o
m
etrics serve
to
red
u
ce
overheads a
n
d costs ove
r
ti
m
e
,
it is
ev
id
en
t (
[
1
5
]
,
p
243-
244
)
th
at pr
eced
en
ts set do
wn
b
y
th
e D
P
C
in
r
e
latio
n
to
bio
m
e
t
r
i
c atten
d
a
n
c
e
record
i
n
g in Ireland
,
req
u
i
res an ad
d
ition
a
l ‘op
t
ou
t’ sy
ste
m
run
n
i
n
g
alo
n
g
s
id
e. Th
i
s
in
ev
itab
l
y in
curs
ad
d
ition
a
l co
st
s for th
e co
lleg
e
and
m
a
y w
e
ll d
e
feat th
e pu
rpo
s
e of a b
i
o
m
etrics syste
m
.
Co
lleg
e
s in Ireland
wh
o are c
u
rre
n
t
l
y
(or are c
o
n
s
i
d
eri
n
g
)
st
ori
n
g bi
om
et
ri
c dat
a
abo
u
t
st
ude
nt
s t
o
rec
o
r
d
at
t
e
nda
nce s
h
o
u
l
d
pay
p
a
rticu
l
ar attentio
n
to
Sectio
n 2
(
B
)
of
th
e Act as it sp
ecifies th
at d
a
ta s
hould
only be c
o
llected where c
ons
ent
is ex
p
licitly g
i
v
e
n
an
d
secon
d
l
y, th
at th
e co
llectio
n
of
d
a
ta is co
n
s
i
d
ered
n
ecessary p
r
o
cessing
fo
r th
e
per
f
o
r
m
a
nce of a fu
nct
i
on (
[
7
]
,
[8]
)
.
The E
ducat
i
o
n (
W
el
f
a
re) Act
2
0
0
0
1
requires that attenda
nce rec
o
rds are
kept
but does
not
specify t
h
a
t
biom
etric data is neces
sa
ry
(or acce
ptable) for t
h
is function to
be a
c
hie
v
ed [2].
Th
e
DPA uses th
e word
“necessary” in
relatio
n
to
th
e
co
llectio
n
o
f
d
a
ta and
th
e Irish
Data Pro
t
ectio
n
C
o
m
m
i
ssi
oner
has co
nsi
d
e
r
e
d
t
h
e col
l
ect
i
o
n of
bi
om
et
ri
c dat
a
(fo
r t
h
e
pu
r
poses
of re
cor
d
i
n
g at
t
e
nd
ance) as
bei
n
g ‘n
ot
ne
cessary
’ [2]
.
The
cl
ar
i
f
icatio
n b
y
t
h
e Commiss
io
n
e
r is ev
id
en
t th
at
th
e issu
e of
deriv
i
ng
in
feren
tial sensitiv
e d
a
ta fro
m
b
i
o
m
etrics is a p
o
t
en
tial p
r
i
v
acy issu
e
for
d
a
ta subj
ects.
Obt
a
i
n
i
n
g
an
d
pr
ocessi
ng
bi
om
et
ri
c dat
a
fai
r
l
y
a
nd i
n
ac
corda
n
ce
with
Section
2(1)(a
) of t
h
e Ac
t
assum
e
s that the student
(dat
a
sub
j
ect
)
ha
s
gi
ven
co
nse
n
t
f
o
r t
h
e
dat
a
t
o
be
collected.
It c
oul
d
be ass
u
med that
st
ude
nt
s i
n
a
c
o
l
l
e
ge
wo
ul
d
be a
g
ed ei
g
h
t
een
or
o
v
er.
H
o
we
ve
r, i
t
i
s
o
f
t
e
n t
h
e
case
[
20]
t
h
at
a
fi
rst
y
ear
st
ude
nt
i
s
a
g
e
d
se
ve
nt
een
2
. In
th
is in
stan
ce, it is also n
e
cessary
for the co
lleg
e
to
gain
p
a
ren
t
al/g
uard
ian
consent,
ot
herwise
a breac
h of
the Act
is possible [21].
In
ord
e
r to
m
a
in
tain
an
d
u
pho
ld
transp
arency, th
e d
a
ta co
llecto
r
(co
lleg
e
) sho
u
l
d
m
a
k
e
th
e
m
selv
es
kn
o
w
n t
o
t
h
e
dat
a
su
b
j
ect
, p
r
o
v
i
d
e
reas
ons
fo
r t
h
e
pr
oces
si
ng
of t
h
e dat
a
and i
d
ent
i
f
y
any
t
h
i
r
d pa
rt
i
e
s t
o
whom
the bi
ometric data is
be
ing s
h
ared [7].
Adheri
ng t
o
all three
guid
elines is
neces
sary in orde
r t
o
c
o
m
p
ly
with
Secti
o
n 2D
o
f
th
e
DPA.
The
com
p
liance is m
o
re pre
v
alent
where t
h
e
biom
etric data is store
d
i
n
a cloud
para
di
gm
whe
r
e t
h
e
dat
a
s
u
b
j
ect
(an
d
i
ndee
d
t
h
e
dat
a
c
ont
r
o
l
l
e
r) m
a
y
not
kn
o
w
t
h
e
exact
l
o
cat
i
o
n
o
f
t
h
e
dat
a
.
Data retained s
h
ould
be accurate
and up-to-date [16]. Manual (and
often
electronic
)
rec
o
rds can
be
easily ed
ited
an
d upd
ated
as
r
e
qu
ir
ed
.
Sectio
n 2(
1)
(b)
of
t
h
e
Act can
b
e
d
i
fficu
lt to
imp
l
em
en
t in
relatio
n
to
b
i
o
m
etr
i
c d
a
ta.
W
h
er
e a d
a
ta
su
bj
ect
(
s
tud
e
nt)
go
es t
h
ro
ugh ph
ysical o
r
physio
lo
g
i
cal ch
an
g
e
s, the b
i
o
m
etr
i
c
data woul
d, as
a result,
be i
n
accurate. Suc
h
cha
n
ge
s m
a
y include sca
r
ring due to
burns
, eye dam
a
ge or
am
put
at
i
ons
. C
o
l
l
e
ges s
h
o
u
l
d
st
ri
ve t
o
i
m
pl
em
ent
a pol
i
c
y
or
pr
oce
d
u
r
e t
h
at
can acc
om
m
odat
e
t
h
ese chan
ge
s
with
ou
t co
n
t
rav
e
n
i
n
g
Section 2(1)(c
)(iii)
wh
ere g
a
i
n
ing
data in
an inv
a
siv
e
(o
r ex
cessiv
e
) way m
a
y b
r
each
th
e Act. Th
is co
u
l
d
p
o
t
en
tially affect an
ind
i
v
i
du
al’s
hu
m
a
n
ri
gh
t to
p
r
i
v
acy u
n
d
e
r th
e Irish
Con
s
titu
tion
.
It is
th
e au
t
h
or’s
o
p
in
io
n th
at ch
allen
g
e
s su
ch as t
h
ese a
r
e
not a
r
ticulated clear
l
y
in
th
e
Acts an
d leav
e am
b
i
g
u
ity
as a re
sult.
1
A c
h
ild <
1
8 y
ears
of age
2
2294 s
e
ve
ntee
n year ol
d fulltim
e
unde
rg
ra
duate stude
n
ts registered on t
h
e 1
st
Janu
ar
y
20
13
acro
ss all
H
E
A-
fund
ed In
stitu
tio
n
s
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ERE
I
S
SN
:
225
2-8
8
2
2
Dat
a
Pr
ot
ect
i
o
n
Issue
s
i
n
Hi
g
h
er E
d
ucat
i
o
n
w
ith Technological A
d
v
ance
m
ents
(Nigel McKelvey
)
13
7
5.
DAT
A P
R
OT
ECTION
C
ASE LAW ANALYSIS
[2]
doc
um
ent
e
d a
case
(n
u
m
ber 12
)
fr
o
m
2007
w
h
e
r
e em
pl
oy
ees at
a com
p
any
co
nt
act
ed t
h
e
C
o
m
m
i
ssi
oner
as t
h
ey
fel
t
t
h
a
t
t
h
ei
r
per
s
o
n
al
dat
a
was
bei
n
g c
o
m
p
rom
i
sed
by
t
h
e
pr
op
o
s
ed i
n
t
r
od
uct
i
o
n
of
a
bi
om
et
ri
cs sy
st
em
t
o
recor
d
t
i
m
e
and at
t
e
ndance
.
Th
e em
pl
oy
er had s
o
u
g
h
t
an
d gai
n
ed c
o
nsent
f
r
o
m
all
em
pl
oy
ees and
had p
r
o
v
i
d
ed i
n
f
o
rm
at
i
on an
d t
r
ai
ni
n
g
sessi
ons
. It
was s
u
g
g
est
e
d t
h
at
t
h
e
t
echn
o
l
o
gi
cal
m
ove
was
based
o
n
a
n
ab
use
o
f
t
h
ei
r exi
s
t
i
n
g sy
st
e
m
of rec
o
r
d
i
n
g
at
t
e
nda
nce. T
h
e ne
w sy
st
em
req
u
i
r
e
d
fi
nge
r p
r
i
n
t
dat
a
t
o
be
st
o
r
ed
t
h
at
wo
ul
d
be e
n
cry
p
t
e
d a
n
d
al
l
o
w
e
m
ploy
ees to enter a
PI
N i
n
o
r
de
r to
rec
o
rd
their
attendance. The e
m
ployees felt this was in breac
h of
the
DPA
unde
r proportionality, accuracy/sec
urity of
p
e
rson
al d
a
ta an
d
fair ob
tainin
g
.
It was m
a
d
e
kn
own
th
at
th
o
s
e who
d
i
d
no
t wish
to
in
teract with
th
e n
e
w
sy
st
em
, were not
f
o
r
ced t
o
by
t
h
ei
r em
ploy
er.
Aft
e
r
con
s
id
eratio
n, the DPC d
eci
de
d, that the employees
i
n
v
o
l
v
e
d
s
h
oul
d
use t
h
e
new
PI
N sy
st
em
, but
wi
t
h
out
t
h
e re
qui
rem
e
nt
t
o
p
r
ovi
de
bi
o
m
et
ri
c dat
a
. It
was
concl
ude
d that
no
breac
h of the Act ha
d taken place as
the
aggrieve
d employees we
re not force
d
to us
e the
biom
etrics syste
m
against thei
r wis
h
es.
This was a
n
interesting case
as no
breac
h had take
n
place, but the em
ployees
were still
not re
quired
to
co
m
p
ly with th
e em
p
l
o
y
er’s n
e
w
b
i
om
etric syste
m
. This
‘opt out’
appro
ach to bi
om
etrics was als
o
upheld
i
n
t
h
e B
o
ran Pl
ast
i
c
Packagi
n
g Lt
d. ca
se as di
scuss
e
d
by
[
15]
(
p
24
3-
2
4
4
)
. The
pot
e
n
t
i
a
l
securi
t
y
im
pl
i
c
at
i
ons
of
bi
om
et
ri
c dat
a
are o
f
co
nc
ern a
n
d t
h
e e
x
cessi
ve
nat
u
re
of t
h
e dat
a
a
p
p
ears t
o
be
un
su
pp
o
r
t
e
d i
n
rel
a
t
i
on t
o
attendance rec
o
rding. T
h
is precede
n
ce
in recording attendance
was also
uphel
d
by the office of the DPC
whe
n
a l
a
rge
seco
nda
ry
sch
ool
i
n
20
1
0
at
t
e
m
p
t
e
d t
o
a
p
pl
y
a bi
om
et
ric sy
st
em
for a
l
l
st
udent
s
t
o
reco
r
d
atten
d
a
nce (
C
ase 12
)
i
n
2
010 [
2
].Th
e C
o
mmissio
n
e
r
d
eci
d
e
d th
at an
‘op
t
ou
t’
op
tio
n
b
e
av
ailab
l
e an
d th
at
ev
id
en
ce of inform
ed
written
co
n
s
en
t b
e
k
e
p
t
for all stu
d
en
ts u
s
i
n
g
th
e syste
m
. Co
lle
g
e
s m
i
g
h
t
well face
o
ppo
sitio
n
in
i
m
p
l
e
m
en
tin
g
su
ch
a system
f
o
r said
pu
rp
oses. Delh
i Un
iversity is facin
g
co
n
t
em
p
t
as a
resu
lt
o
f
failin
g
to
introd
u
ce a
b
i
ometrics sy
ste
m
to record t
h
eir lecturing staf
fs’ attendance
as a result of a court
or
der
by
t
h
e D
e
l
h
i
Hi
gh C
o
u
r
t
[22]
. St
af
f ar
e bl
ocki
ng t
h
e
pr
o
pose
d
sy
st
em
and are t
h
re
at
eni
ng st
ri
ke act
i
o
n
as a resu
lt.
W
i
th
in
su
ch
in
stitu
tio
ns, b
i
o
m
et
ric d
a
ta
m
a
y b
e
d
eem
ed
ap
p
r
o
p
riate for p
a
rticu
l
ar staff to g
a
in
access to high
risk laborat
o
rie
s
whe
r
e da
ngerous c
h
em
ical
s
are store
d
or where m
e
di
cal records are
kept
[23].
It is the aut
h
or’s opini
on t
h
at
the re
quirem
e
nt to ha
ve
a pa
rallel ‘opt out’
syste
m
in place would
only serve t
o
increase overheads
i
n
th
e long
run
.
C
l
ou
d com
put
i
ng ca
n
be use
d
as a
m
echani
s
m
t
o
excha
nge
or s
h
are i
n
f
o
r
m
at
i
on [2
4]
. I
n
t
h
e U
n
i
t
e
d
K
i
ng
do
m
in
201
1,
D
u
rh
am
U
n
iv
er
sity w
e
r
e
in
br
each
o
f
the DPA after sharing
trai
n
i
ng
material o
n
lin
e wh
ich
mad
e
p
e
r
s
on
al d
a
ta abo
u
t
tr
ai
n
ees av
ailab
l
e
[
2
5
]
. Th
e ad
v
a
n
t
ag
es
o
f
cloud co
m
p
u
tin
g
w
e
r
e
lo
st b
y
misg
u
i
d
e
d
users
who di
d not
receive s
u
fficient traini
ng i
n
the a
r
ea
of data protection
[25]
. Si
m
p
ly anonymising t
h
e
t
r
ai
ni
n
g
m
a
nual
s
coul
d
have
pr
ot
ect
ed t
h
e
dat
a
sub
j
ect
s
and a
v
ert
e
d t
h
e breac
h. T
h
e i
nvest
i
g
at
i
n
g o
ffi
ce
r
concl
ude
d t
h
at
suc
h
or
gani
sat
i
ons
s
h
o
u
l
d
ad
h
e
re t
o
a
c
o
m
p
rehen
s
i
v
e t
r
ai
ni
ng
p
r
og
ram
m
e
i
n
dat
a
p
r
ot
ect
i
o
n
.
W
i
t
h
th
e issu
e o
f
d
a
ta pro
t
ectio
n
prev
alen
t in
clo
u
d
co
m
p
u
tin
g
[7
], it is
i
m
p
o
r
tan
t
to
ex
am
in
e leg
a
l
cases whic
h have analysed
suc
h
i
ssues.
In 2010, t
h
e case of Italy
v
Go
ogl
e [
2
6]
whe
r
e som
e
Go
o
g
l
e
execut
i
v
es u
p
l
o
ade
d
vi
deos
whi
c
h breac
he
d It
al
y
’
s DP
A
i
s
of i
n
t
e
rest
. The pr
oces
s i
nvol
ved a cl
ou
d
para
di
gm
whe
r
e dat
a
was
n
o
t
pr
ocesse
d
o
n
It
al
i
a
n ser
v
e
r
s an
d t
h
e
di
scussi
o
n
s
pert
ai
ni
n
g
t
o
t
h
e
vi
deo
’
s
cont
e
n
t
was n
o
t
upl
oade
d i
n
It
al
y
but
t
h
e
or
ga
ni
sat
i
on h
a
d a
m
a
rket
i
n
g cl
ou
d ser
v
i
c
e oper
a
t
i
ng wi
t
h
i
n
t
h
e
cou
n
t
r
y
[
26]
.
The C
o
urt
s
cl
aim
e
d juri
s
d
i
c
t
i
on
base
d o
n
‘c
ont
e
x
t
’
i
ssues
.
As t
h
e cl
ou
d
servi
ce wa
s ba
sed i
n
It
al
y
and
fo
rm
ed p
a
rt
of t
h
e
com
p
any
’
s
ov
eral
l
bu
si
ness
,
eve
n
t
h
ou
g
h
t
h
e vi
de
o i
t
s
el
f was
not
ru
n
n
i
ng
o
n
Italian
serv
ers, th
e Co
u
r
ts foun
d
Goog
le to
be in
b
r
each
[26]. It is
th
e au
tho
r
’s op
in
i
o
n
that th
is case sig
n
i
fies
the im
portance
of both data a
nd se
rvice loc
a
tion.
W
ith the uploa
d not taking place in Italy
it was a
ssum
e
d
th
at no
litig
atio
n wou
l
d b
e
po
ssib
l
e bu
t th
e case
d
e
m
o
n
s
trates th
at th
e co
urts can
clai
m
j
u
risd
iction
wh
en it
co
m
e
s to
th
e locatio
n
o
f
th
e
data (or serv
ice) itself.
6.
RIGHTS OF
THE
DATA SUBJ
E
C
T
W
i
t
h
in c
o
llege
s, stude
nts and staff all have the ri
ght to gai
n
access to the
data store
d
on them
unde
r
Sect
i
on 4
of t
h
e DPA re
gar
d
l
e
ss of age
.
Al
t
h
o
u
gh i
t
i
s
wor
t
h not
i
n
g t
h
at
st
ude
nt
s i
n
HE un
de
r 18 y
ears
of ag
e
m
u
st
have pa
r
e
nt
al
/
gua
rdi
a
n
con
s
ent
gi
ve
n
fo
r t
h
ei
r
dat
a
t
o
be st
o
r
ed
. T
h
e
dat
a
su
b
j
ect
s al
so
have
a r
i
ght
t
o
have
t
h
e
dat
a
u
pdat
e
d a
n
d/
or
del
e
t
e
d
[8]
.
It
i
s
o
n
l
y
wi
t
h
co
nse
n
t
t
h
at
a
dat
a
co
nt
r
o
l
l
e
r ca
n st
ore
dat
a
a
b
out
a
n
i
ndi
vi
dual
.
Th
ere is an
excep
tio
n
t
o
th
is p
r
o
v
i
si
o
n
howev
er wi
t
h
in
HE in
stitu
tions. Section
4(6) o
f
the DPA
makes the
poi
nt that stude
n
ts cannot
re
quest access to
t
h
eir e
x
am
ination scri
pts,
with the
exce
ption
of
m
e
di
cal
exam
inat
i
o
n
s
[
15]
.
Sect
i
on
4(
6)
(a
) o
f
t
h
e
DP
A
,
p
r
o
v
i
d
es a
r
i
ght
‘t
o re
q
u
e
s
t
t
h
e res
u
l
t
s
of a
n
ex
am
in
atio
n
at wh
ich
a person
was a cand
i
date 6
0
d
a
ys aft
e
r th
e d
a
te of th
e first pub
licatio
n
of th
e results o
f
the exam
ination’ [21]. The s
a
m
e
doe
s no
t n
ecessarily ap
p
l
y to
scrip
t
s th
at were su
bmit
ted
for an
ex
am
.
Access t
o
s
u
c
h
m
a
t
e
ri
al
wo
ul
d
have
t
o
be a
n
al
y
s
ed as t
o
w
h
et
her i
t
c
oul
d
b
e
co
nsi
d
e
r
ed
‘
p
erso
nal
dat
a
’[
2
1
]
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
252
-88
22
I
J
ERE
Vo
l. 3
,
N
o
. 3
,
Sep
t
emb
e
r
201
4
:
1
33
–
14
1
13
8
Whe
r
e t
h
e e
x
a
m
co
m
p
ri
ses o
f
q
u
est
i
o
ns an
d a st
u
d
ent
nee
d
s t
o
rec
a
l
l
t
h
e sub
j
ect
m
a
t
e
rial
t
a
ught
as
part
of academ
ic
m
odules
, it
is the position
of t
h
e
DP
C t
h
at the ri
ght
of
access under
S
ection
4
of t
h
e
DP
A
doe
s n
o
t
ap
pl
y
t
o
t
h
at
m
a
t
e
rial
[2
1]
. H
o
we
ver
,
sco
r
i
n
g/
m
a
rki
ng t
a
bl
es
whi
c
h acc
om
pany
suc
h
m
a
t
e
ri
al
, i
f
th
ey ex
ist, wou
l
d
b
e
sub
j
ect
to
co
nsid
eration
fo
r rel
ease
where a
n
indi
vidual
m
a
ke
s a reque
st
fo
r t
h
em
un
der
Sect
i
on 4 o
f
t
h
e
DP
A [2
1]
.
[21
]
ou
tlin
ed
ho
w t
h
e Co
mmi
ssio
n
e
r h
a
d
p
r
ev
iou
s
ly co
nsid
ered
a co
m
p
lain
t fro
m
an
i
n
d
i
v
i
du
al i
n
rel
a
t
i
on t
o
t
h
e
fai
l
u
re
by
a
pr
ofessi
o
n
al
b
o
d
y
t
o
f
u
r
n
i
s
h
hi
m
wi
t
h
a copy
of
hi
s e
x
am
i
n
at
i
on sc
ri
pt
s
fu
r
t
her t
o
an access
re
quest. T
h
e e
x
a
m
ination in
question invol
ved re
producing m
odel ans
w
ers from
a te
xt book.
Accord
ing
l
y, th
e Co
mm
issio
n
er con
s
id
ered th
at th
e ex
amin
atio
n
scri
pts in
th
e case d
i
d
n
o
t
co
nstitu
te
pers
onal data within the m
e
aning
of the
DPA and that
there was
no
substa
ntive breach of the Acts. The
i
ndi
vi
dual
l
o
d
g
ed
a C
i
rc
ui
t
C
o
u
r
t
A
p
peal
agai
nst
t
h
e C
o
m
m
i
ssi
oner
’
s
opi
ni
o
n
t
h
at
t
h
ere
was
n
o
b
a
si
s t
o
in
v
e
stig
ate t
h
e
matter.
W
h
ile t
h
e m
a
tter was d
ecid
e
d
o
n
a ju
risd
ictio
n
a
l
po
in
t in fav
our
o
f
t
h
e C
o
mmis
s
io
n
e
r,
th
e Cou
r
t
no
ted
th
at t
h
e ex
am
scrip
t
s in
questio
n
were not p
e
rson
al d
a
ta with
in th
e m
ean
ing
o
f
Sectio
n 1 of
th
e DPA and
th
erefore th
e req
u
e
ster was
not en
titled
to
c
o
p
i
es of h
i
s ex
am scrip
t
s. Th
e in
d
i
v
i
d
u
a
l appealed
th
e
d
ecisio
n
of th
e Circu
it Co
urt to th
e
High
C
o
urt.
Ag
ai
n
,
t
h
e
Hi
g
h
Cou
r
t
fo
un
d in fav
our
o
f
the
Co
mmissio
n
e
r on
a
j
u
risd
ictio
n
a
l
po
in
t. Howev
e
r, th
e Cou
r
t con
s
id
ered
all o
f
th
e issu
es inv
o
l
v
e
d an
d no
ted
t
h
at
, ha
d t
h
e C
o
u
r
t
j
u
ri
sdi
c
t
i
o
n t
o
hea
r
t
h
e a
ppeal
,
i
t
wo
ul
d
ha
ve u
p
h
el
d t
h
e fi
ndi
ng
o
f
t
h
e C
o
m
m
i
ssi
o
n
er t
h
at
t
h
e exam
scri
pt
s i
n
que
st
i
on
di
d
not
c
onst
i
t
ut
e pe
rso
n
al
d
a
t
a
wi
t
h
i
n
t
h
e
m
eani
ng
of t
h
e Act
s
.
W
i
t
h
c
o
u
r
ses
no
w
bei
n
g del
i
vere
d
onl
i
n
e i
n
great
er
n
u
m
b
ers [
27]
a
nd l
e
ss
of a
foc
u
s
on
end
of t
e
rm
exam
i
n
at
i
ons, st
u
d
ent
s
are bei
n
g pr
o
v
i
ded
fee
dba
ck
and
gra
d
es o
n
cont
i
n
u
o
u
s
ass
e
ssm
ent
t
h
ro
u
g
h
Vi
rt
ual
Lea
r
ni
ng
E
nvi
r
o
n
m
ent
s
(VLEs). If a mo
du
le is
b
e
ing
assessed
on
line, it is p
o
ssible
to breac
h the
DPA s
h
ou
ld
t
h
e resu
lts/feedback
b
e
i
n
ad
vert
e
n
t
l
y
m
a
de pu
bl
i
c
. Suc
h
an i
s
s
u
e
coul
d occ
u
r
by
cl
i
c
ki
ng t
h
e wr
on
g c
h
ec
kb
o
x
. It
i
s
t
h
eref
ore
i
m
p
o
r
tan
t
fo
r staff to
b
e
m
i
n
d
fu
l in
p
r
o
t
ectin
g
th
eir stud
en
ts’ d
a
ta u
s
i
n
g
th
is foru
m
.
A related
issu
e is wh
ere
t
h
e d
a
t
a
su
b
j
e
c
t
has t
h
e
ri
g
h
t
agai
nst
a
u
t
o
m
a
t
e
d deci
si
o
n
s
bei
n
g m
a
de (
v
i
a
a c
o
m
put
er
based
sy
st
e
m
) t
h
at
affects the indi
vidual [15]
. From
a
teaching perspective, a
VLE f
acilitates autom
a
ted ass
i
gnm
ent
m
a
rking a
n
d
gra
d
e al
l
o
cat
i
o
n/
wei
g
ht
i
n
g. S
ect
i
on 6B
(i
)
of t
h
e
DP
A, h
o
we
ve
r, has a
pr
ovi
si
o
n
w
h
i
c
h d
o
es n
o
t
al
l
o
w a
deci
si
o
n
m
a
king
p
r
oces
s w
h
i
c
h i
s
s
o
l
e
l
y
con
d
u
ct
ed
us
i
ng a
u
t
o
m
a
t
e
d
m
e
t
hods
ab
o
u
t
an i
ndi
vi
d
u
a
l
,
t
h
at
produces legal
effects, to take place [15]. Colleges s
hould be m
i
ndful of this fact and e
n
s
u
re inform
ed
consent ha
s been receive
d from
students
in relati
on to
any
m
o
dules whic
h m
a
y adopt s
u
ch a
grading
app
r
oach
wi
t
h
assi
gnm
ent
s
an
d t
o
t
h
at
e
n
d, t
h
ei
r a
d
m
i
ssi
ons pol
i
c
y
.
Ho
we
ver
,
Exam
i
n
at
i
on B
o
ar
d
gui
d
e
l
i
n
es
usu
a
l
l
y
cont
ai
n a speci
fi
c p
r
ovi
si
on/
re
q
u
i
r
e
m
ent
t
h
at
wou
l
d ens
u
re a st
ude
nt
’s
pr
o
g
re
ss i
s
revi
ewe
d
by
at
least o
n
e
h
u
m
an
and
is
no
t t
h
erefore an auto
m
a
ted
d
eci
si
o
n
. Perso
n
al data h
e
ld at a
HE i
n
stitu
tio
n
can
b
e
r
e
qu
ested
b
y
t
h
ird
p
a
r
ties. Sectio
n
28
o
f
t
h
e Stud
en
t Sup
por
t A
c
t 2011
su
ppo
r
t
s th
e D
a
ta Pro
t
ectio
n
A
c
ts
[2
9]
. It
m
a
kes
a pr
ovi
si
o
n
wh
ereby
a dat
a
c
ont
rol
l
e
r m
a
y
be o
b
l
i
g
e
d
t
o
pr
o
v
i
d
e pe
rs
on
al
dat
a
st
ored
abo
u
t
a
stu
d
e
n
t
to
a local au
th
or
ity, a Min
i
ster
o
r
an aw
ard
i
ng
body w
h
er
e t
h
e pro
cessing
is fo
r a r
e
lev
a
n
t
p
u
rp
o
s
e.
Suc
h
p
u
r
p
oses
m
i
ght
i
n
cl
ude
t
h
e pr
ocessi
n
g
of g
r
ant
s
or o
f
fences a
g
ai
nst
t
h
e St
at
e [29]
.
It
wo
ul
d
be pr
ude
nt
for a co
lleg
e
or un
iv
ersity to
fu
lly in
fo
rm
stu
d
e
n
t
s of
th
is pro
cess
up
on
r
e
gistr
a
tio
n
and
ob
tain
co
nsen
t.
7.
A DAT
A
P
R
OTECTIO
N
POLIC
Y
I
N
AN EDUCAT
IONAL SETT
ING
A dat
a
pr
ot
ect
i
on p
o
l
i
c
y
for
a col
l
e
ge sho
u
l
d aim
t
o
expl
ai
n t
h
e pu
rp
os
e of t
h
e DP
A.
The pol
i
c
y
sh
ou
l
d
b
e
an
op
portun
ity fo
r
th
e co
lleg
e
t
o
articu
l
ate its
co
mmit
m
en
t to
d
a
ta pro
t
ection so
th
at it m
i
g
h
t
in
stil
co
nfid
en
ce am
o
n
g
s
t staff and
stud
en
ts. The do
cu
m
e
n
t
mig
h
t
o
u
tlin
e t
h
e p
r
i
n
cip
l
es
o
f
th
e d
a
ta
p
r
o
t
ectio
n
leg
i
slatio
n
and h
i
g
h
ligh
t
wh
ere
respon
sib
ilities lie. In
acc
ord
a
n
ce
with the DPA, th
e data con
t
ro
ller sho
u
l
d
b
e
clearly id
en
tified
.
In
add
iti
on, where cloud technologies
and/or biom
etric
syste
m
s are
in
use, the technologie
s
use
d
t
o
p
r
oce
s
s
t
h
e
dat
a
s
h
o
u
l
d
be e
xpl
ai
n
e
d
.
It wo
u
l
d
b
e
prud
en
t
for th
e po
l
i
cy to
o
u
tlin
e
pro
c
edu
r
es and
g
u
i
d
e
lin
es
for
stu
d
e
n
t
s an
d
staff alik
e. A
section
of the
doc
um
ent might stipulate the
data
subjects’
rights,
t
h
e
e
x
ce
ptions
to a
n
y rights of access to data
and
g
u
i
d
el
i
n
es
fo
r st
aff
o
n
t
h
e
di
scl
o
s
u
re
of s
t
ude
nt
dat
a
to
t
h
ird
p
a
rties. Th
e latter is p
a
rt
icu
l
arly p
e
rtin
en
t in
HE
where lect
uri
n
g staff are
often c
o
nt
act
ed
by
p
o
t
e
nt
i
a
l
em
pl
oy
ers t
o
gi
ve
re
fere
nc
es f
o
r
st
u
d
ent
s
. St
af
f
giving re
fere
nces can be problem
atic
and deserve deta
iled
gu
id
elin
es
wh
ich
are ou
tsid
e th
e sco
p
e o
f
th
is
p
a
p
e
r.
As
o
u
tlin
ed
i
n
App
e
ndix
A, a section o
n
ho
w to
protect p
e
rson
al co
m
p
u
t
ers wh
en
pro
c
essing
institu
te
d
a
ta is i
m
p
o
r
tan
t
. Gu
id
an
ce on
en
cry
p
tion
tech
n
i
q
u
e
s as well as su
itab
l
e fi
rewall in
stallatio
n
s
and
approp
riate
pass
wo
rd
s wo
ul
d
be o
f
be
ne
fi
t
.
So as t
o
gu
i
d
e st
ude
nt
s (a
nd i
n
dee
d
st
aff
)
, i
t
i
s
im
port
a
nt
t
h
at
t
h
e rol
e
of t
h
e
Dat
a
Prot
ect
i
o
n C
o
m
m
i
ssi
oner be ex
pl
ai
ne
d an
d co
nt
act
det
a
i
l
s
pro
v
i
d
ed
. To com
p
l
i
m
e
nt
t
h
i
s
, i
t
i
s
t
h
e
author’s opini
o
n that a dedicat
ed co
l
l
e
ge
Dat
a
Prot
ect
i
o
n O
f
fi
cer be est
a
bl
i
s
he
d an
d i
d
ent
i
fi
ed.
Havi
ng a
st
aff
m
e
m
b
er de
di
cat
ed t
o
t
h
e r
o
l
e
of
dat
a
pr
ot
e
c
t
i
on as m
o
re
new
t
ech
nol
og
i
e
s are i
n
t
r
o
d
u
ced i
s
i
m
port
a
nt
. T
h
e
of
fi
cer
w
oul
d r
e
vi
ew t
h
e
pol
i
c
y
i
n
l
i
ght
o
f
t
e
c
h
n
o
l
o
gi
cal
a
n
d
/
or l
e
gi
sl
at
i
v
e
chan
ges
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ERE
I
S
SN
:
225
2-8
8
2
2
Dat
a
Pr
ot
ect
i
o
n
Issue
s
i
n
Hi
g
h
er E
d
ucat
i
o
n
w
ith Technological A
d
v
ance
m
ents
(Nigel McKelvey
)
13
9
A
dat
a
p
r
ot
ect
i
o
n
p
o
l
i
c
y
wi
t
h
i
n
HE s
h
oul
d
g
o
bey
o
n
d
j
u
st
pol
i
c
y
an
d i
n
c
o
r
p
orat
e
pract
i
ce. A
col
l
e
ge
mig
h
t
striv
e
to
b
e
con
t
ex
t-aware an
d
o
f
fer stud
en
ts a
nd staff
awaren
ess in
itiativ
es as
well as train
i
n
g
sch
e
mes
whe
r
e st
a
ff m
i
ght
ea
r
n
a
dat
a
p
r
ot
ect
i
o
n a
w
ar
d
[2
9]
,[
3
0
]
.
W
i
t
h
i
n
du
st
r
y
expe
ri
ence
a
n
i
m
port
a
nt
c
r
edent
i
a
l
for an
y
g
r
aduatin
g
stud
en
t [31
]
, an
ex
tra cred
its in
itiativ
e, equ
i
v
a
len
t
to
th
e staff certificate, wo
uld
aid
stu
d
e
n
t
s in g
a
i
n
ing
inv
a
luab
l
e
kn
owledg
e an
d sk
ills.
8.
EDUCATION ABOUT LAW
Th
e Data
Pro
t
ectio
n
Acts
Sect
io
n
2
(A) ou
tlin
es
t
h
e
fo
llowin
g
pro
v
i
sion
[7]:
(2)
A: th
e
d
a
ta
co
n
t
ro
ller
or
data p
r
o
cesso
r sh
all tak
e
all reaso
n
ab
le step
s t
o
en
su
re t
h
at
—
(a)
Pers
ons
em
pl
oy
ed by
hi
m
or
her
,
a
n
d
(b)
othe
r pers
ons at
the
place of
wo
rk concerned, a
r
e aware of and c
o
mply with t
h
e relevant sec
u
rit
y
measures a
f
ore
s
aid.
The use
of t
h
e
t
e
r
m
“reasona
bl
e st
eps” m
a
y
resul
t
i
n
am
bi
g
u
i
t
y
. W
i
t
h
t
h
e pr
ot
ect
i
on
of
pers
o
n
al
dat
a
, i
t
i
s
t
h
e a
u
t
h
or
’s
opi
ni
o
n
, t
h
at
de
fi
ne
d
st
eps s
h
o
u
l
d
be
fol
l
o
we
d
by
d
a
t
a
pr
ocess
o
rs
so t
h
at
t
h
o
s
e af
fect
e
d
are fu
lly aware o
f
th
eir righ
ts
an
d
o
b
lig
ations.
W
ith
t
ech
nol
ogi
cal
ad
vanc
e
m
ent
s
edgi
n
g
f
o
r
w
ar
d, i
t
wo
u
l
d be
prudent
for c
o
l
l
eges to educat
e thei
r st
a
ff
an
d st
ude
nt
s acc
o
r
di
ngl
y
[
3
2]
.
Whe
n
a student logs in to a netw
ork, they are (m
ost
lik
ely), agreeing to an
Acceptable Usage Polic
y
(A
UP
)
but
a
r
e
t
h
ey
awa
r
e
of i
t
s cont
e
n
t
s
a
n
d
any
pot
e
n
t
i
a
l
i
m
pli
cat
i
ons. T
h
e
AU
P
war
n
s
st
ude
nt
s
(an
d
st
aff
)
not
t
o
e
xpect
p
r
i
v
acy
on c
o
l
l
e
ge l
a
pt
op
s/
m
a
chi
n
es
[
33]
.
Si
milarly, when
a lecturer
uses
Dropbox, em
ail or a
flash
drive t
o
update a
s
p
reads
h
eet
cont
aining stude
n
t grades
at hom
e, are they
aware
that they are
i
n
ad
vert
e
n
t
l
y
m
a
ki
ng
a c
o
p
y
of
p
r
i
v
at
e
d
a
t
a
(st
u
de
nt
g
r
ades,
nam
e
s, s
t
ude
nt
num
ber
)
on
a
n
o
n
-
ap
pr
o
v
e
d
pers
onal
m
achine. The lecturer’s
hom
e
m
a
chine m
a
y not
h
a
v
e
ad
equ
a
t
e
secu
rity so
ft
ware in
stalled
wh
ich
co
u
l
d
facilitate
stu
d
e
n
t
d
a
ta
b
e
ing
h
ack
ed
.
Dro
pbo
x also
u
s
es a cl
ou
d
prov
id
er to store its d
a
ta and
u
n
til
recently it did
not c
o
nform
to the
US
Safe
Harbour i
n
itiative [34].
[35
]
allu
d
e
s th
at a lack
o
f
ed
u
cation
ab
ou
t law is i
m
p
actin
g
on
th
e ad
m
i
n
i
strato
rs’ ab
ility,
in
educat
i
o
nal
set
t
i
ngs, t
o
m
a
ke l
e
gal
l
y
-sou
n
d
deci
si
o
n
s. E
n
s
u
ri
ng t
h
at
t
h
ei
r
ri
ght
s an
d t
h
e
ri
g
h
t
s
of t
h
e st
ude
nt
s
are
protected is
im
porta
nt.
9.
CO
NCL
USI
O
NS
Prot
ect
i
n
g dat
a
rel
a
t
i
ng t
o
st
ude
nt
s an
d ed
ucat
o
r
s i
s
an i
m
port
a
nt
and
oft
e
n di
f
f
i
c
ul
t
un
de
rt
aki
n
g
.
Whet
her t
h
e data pertains t
o
gra
d
es, attendance rec
o
rd
s
,
medical records, adm
i
ssi
ons, fina
nce,
re
search, or
b
i
o
m
etrics, th
e law in
Irelan
d
ex
ists to
p
r
o
t
ect b
o
t
h
th
e d
a
t
a
co
n
t
ro
ller and
th
e d
a
ta sub
j
ects. Tech
no
log
y
in
th
e fo
rm
o
f
cl
o
u
d
co
m
p
u
ting
h
a
s
facilitate
d
a m
o
re econo
m
i
ca
l an
d efficien
t cam
p
u
s
ad
m
i
n
i
stratio
n
.
Th
e
sam
e
h
o
w
ev
er
can
no
t b
e
said
for b
i
o
m
etrics
if th
e techn
o
l
og
y cann
o
t
b
e
im
p
l
e
m
en
ted
in its en
tirety with
ou
t
requ
iring
th
e ad
d
ition
a
l o
v
e
rh
eads o
f
an
ob
lig
atory o
p
t
-ou
t
syste
m
ru
nn
ing
in
p
a
rallel. Su
ch
technolo
g
i
es
h
a
v
e
raised
questio
n
s
aroun
d
th
e lo
cation
o
f
d
a
ta, its
secu
rity, tran
sp
aren
cy an
d
pu
rpo
s
e.
Wh
ile th
e DPA has
mad
e
strid
e
s toward
s adap
ting to
clo
u
d
and
bio
m
e
t
rics, it h
a
s rem
a
in
ed
stead
fast in
its resilien
ce in
p
r
o
t
ectin
g
the indi
vidual. Neve
rtheless,
technol
ogy is continuing to evolve
a
n
d will continue to be adopte
d
by HE
estab
lish
m
en
ts.
The Irish DPA and the
EU
Directive 95/46 t
h
at re
qui
red it, pl
ace the
onus of
responsi
bility for
data
pr
ot
ect
i
on
o
n
t
h
e dat
a
co
nt
r
o
l
l
e
r [
36]
.
H
o
weve
r, i
n
t
h
e
case of cl
ou
d ser
v
i
ces, t
h
e pr
o
v
i
d
er c
o
ul
d
be
con
s
i
d
ere
d
a
dat
a
p
r
oc
esso
r
[3
6]
. T
h
i
s
be
com
e
s di
ffi
cul
t
t
o
i
n
t
e
r
p
ret
whe
n
a cl
ou
d
pr
o
v
i
d
e
r
m
a
y oft
e
n
det
e
rm
i
n
e ho
w
t
h
e
dat
a
i
s
p
r
ocesse
d a
n
d
al
so t
h
e e
x
t
e
nt
t
o
whi
c
h t
h
e
d
a
t
a
i
s
p
r
oces
se
d
[3
6]
.
A
n
e
x
am
ple
m
i
ght
be
a cl
o
u
d
p
r
ovi
der
de
ci
di
ng
w
h
at
ki
nd
o
f
dat
a
ba
se
dat
a
i
s
st
o
r
ed
wi
t
h
i
n
an
d i
n
d
eed
ho
w
t
h
e
d
a
t
a
i
s
b
ack
ed
up
. The clien
t
(co
lleg
e
) m
i
g
h
t
find th
em
selv
es
in
a d
i
fficu
lt positio
n
if th
ei
r ro
le (u
nd
er th
e DPA)
can
no
t b
e
clearly d
e
fin
e
d. It is th
e au
tho
r
’s op
in
ion
th
at a clearer
d
e
fin
ition
of bo
th
a
d
a
ta co
n
t
ro
ller and
d
a
t
a
pr
ocess
o
r i
s
re
qui
red i
n
t
h
e c
ont
e
x
t
o
f
cl
o
u
d
com
put
i
n
g.
I
n
o
r
der t
o
co
nt
i
nue
pr
ot
ect
i
n
g
dat
a
co
nt
r
o
l
l
e
rs an
d
d
a
ta subj
ects,
it is also
su
gg
ested
t
h
at the DPA fu
rt
h
e
r cl
ari
f
y
pa
rt
i
c
ul
ar s
ubse
c
t
i
ons
pe
rt
ai
ni
n
g
t
o
t
h
e
pr
ocessi
ng
of
pay
m
ent
cards (w
he
n pay
i
n
g
f
ees) usi
n
g a cl
ou
d
para
di
gm
, t
h
e p
h
y
s
i
cal
de
l
e
t
i
on o
f
dat
a
f
r
om
a
share
d
di
sk i
n
t
h
e cl
o
u
d
, t
h
e
u
pdat
i
n
g
of
bi
o
m
et
ri
c dat
a
fol
l
owi
n
g
phy
si
ol
ogi
cal
c
h
an
ges
and
t
h
e e
x
cept
i
on t
o
a right
of ac
ces
s to e
x
am
ination sc
ri
pts when conducted
en
ti
rely on
lin
e.
[3
2]
re
fer
s
t
o
h
o
w
pu
bl
i
c
t
r
ust
i
n
p
r
o
f
es
si
onal
s
is
essen
tial
for so
ciety to
fu
n
c
tio
n safely an
d
effect
i
v
el
y
and
al
so arg
u
es t
h
at
st
udent
s g
r
a
duat
i
n
g sh
o
u
l
d
be t
a
ug
ht
t
h
e im
port
a
nce
of
dat
a
pr
ot
ect
i
o
n
i
n
an
at
t
e
m
p
t
t
o
advance k
n
o
wl
e
d
ge an
d p
r
om
ot
e com
p
l
i
a
nce. Trai
ni
n
g
st
af
f and st
ude
nt
s a
l
i
k
e i
s
a wort
h
w
hi
l
e
endea
v
ou
r.
It
i
s
t
h
ere
f
o
r
e t
h
e
aut
h
or
’s
opi
ni
o
n
t
h
at
t
h
e
p
r
o
p
e
r i
m
pl
em
ent
a
ti
on a
n
d ad
he
re
nce t
o
t
h
e
pri
n
ci
pl
es
ens
h
ri
ne
d
wi
t
h
i
n
a c
o
m
p
rehe
nsi
v
e
dat
a
pr
ot
ect
i
on
pol
i
c
y
s
h
o
u
l
d
f
o
rm
par
t
of
t
h
e c
u
r
r
i
c
u
l
um
i
n
HE.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
252
-88
22
I
J
ERE
Vo
l. 3
,
N
o
. 3
,
Sep
t
emb
e
r
201
4
:
1
33
–
14
1
14
0
In
li
g
h
t
o
f
th
e p
r
i
v
acy co
n
c
ern
s
raised
ab
ov
e,
HE In
stitutio
n
s
sho
u
l
d
rev
i
se th
eir data pro
t
ection
policies to s
p
e
c
ifically instruct acad
emics not to
uploa
d
any personal da
ta belonging
to stude
nts to
cloud
serv
ices e.g
.
Dropb
ox
and
to
cater fo
r po
tential in
tro
d
uction
of
bi
om
etric
syste
m
s. This
study propose
s that
th
ese
g
u
i
d
e
lin
es are app
licab
l
e
to
all HE In
st
itu
tes in
Ireland
.
ACKNOWLE
DGE
M
ENTS
Th
e au
tho
r
wou
l
d
lik
e t
o
ackn
ow
ledg
e t
h
e
su
ppo
r
t
and
gu
id
an
ce
o
f
Prof
. Lau
r
a Lundy, Schoo
l of
Edu
catio
n,
Queen
’s Un
iv
ersity, Belfast.
REFERE
NC
ES
[1]
Trustwave,
“Data Secur
i
ty
Program fo
r Higher Edu
cation”, 2013. Availab
l
e:
https://www.trus
twave.com/downloads/Trustwav
e
-Highe
r-Ed-D
a
ta-Security
.pdf
.
Last accessed
8th December
2013.
[2]
Office of
the Data Protection
Commissione
r, “Data Protection
”
, 2013. Available:
http://www.
dataprotection.ie/ViewDo
c.
asp?
fn=%2Fdocuments%2Flegal%2FL
awOnDP.
h
tm&CatID=7&m=l.
Las
t
accessed 8th
December 2013
.
[3]
Keane, R., “Judges as Lawmakers: Th
e
Irish
Experien
ce”, Pap
e
r deliver
ed
at
the National Univer
sity
of
Irelan
d
Galway
Law So
ciety
,
2004.
[4]
EU, “Charter
of Fundamental Rights
of the Eu
ropean Union
”
, 2010. Av
ailable: http://eur-
lex.europa.eu/LexUriServ
/LexUr
iServ.do
?
u
r
i
=OJ:C:2010:083:038
9:0403:en
:PDF. Last
accessed
8th December
2013.
[5]
Chakraborty
, S
.
, “Right to Information and its R
ealization: Role of Highe
r Education in India”,
Calcu
tta Law
Time
s
, pp. 2, 20
10.
[6]
Paré, M., “Inclusion of Studen
t
s with
Disabilities in
the Ag
e of Tec
hnolog
y: The Need for
Human Rights
Guidance
”,
Edu
c
ation
Law Jour
nal,
vo
l/issue: 2
2
(1), pp
. 39-61
,
2012.
[7]
Carey
,
P., “Data
Protection
-
A Practical Guid
e
to
Irish and
EU Law”, Dublin
: Rou
nd Hall, 2010
.
[8]
Data Protection
Commissioner
(DPC),
“Data Protection Acts 1988 and 2003 - A guide for d
a
ta con
t
rollers”,
Ireland
: Brunswick Press Ltd
,
20
09.
[9]
Nicholson, J., “Cloud C
o
mputi
ng'
s Top Issues f
o
r Higher E
ducation”, 2
009. Availab
l
e:
http://www.univ
e
rsity
business.co
m/ar
ticle/cloud-
computings-top-issues-hi
gher-ed
u
cation.
Last accessed 28
th
Decem
ber 2013
.
[10]
Cehic, M. and
Quigley
,
M.,
“Ethical Issues Associ
ated with Biomet
ric Technolog
ies”,
Managing Mod
e
rn
OrganisationsTh
rough Inform
ati
on Te
chnolog
y
,
Proceed
i
ngs of
the
2005 Infor
m
ation Resourc
e
s Managem
e
n
t
Association In
ternation
a
l Conf
er
ence, pp
. 540-54
3, 2005
.
[11]
Rotenberg
, M., “
P
reserving Privacy
in
th
e Inform
ation
Society
”
,
UNESCO Infoet
hics
, 1998
.
[12]
Sussman, A., “Biome
trics
and C
l
oud Computing”, Biometr
i
cs Con
s
ortium Conference
,
2012.
[13]
Intel, “Protecting Health
care Data in
th
e Cloud: GNAX Health and Intel”, 20
11
.
Available:
http://www.intel.com/content/d
am/www/
public/us/en/documents/solution-brie
fs/gnax-health-and
-intel-pro
tect-
healthcar
e-data-in-the-
cloud-brief.pdf. Last ac
cessed 30th Decem
ber 2013.
[14]
Hignite, K., “Low-Carbon Co
m
puting”, National Associatio
n of College and University
Business Officers
(NACUBO): EDUCAUSE, 2009.
[15]
Lambert, P., “Data Protect
ion
Law in Ir
eland
- So
urces and
I
ssues”, Dublin: Claru
s
Press, 2013.
[16]
S
m
ith, R.
, “
H
ea
d In”,
Law Soc
ie
ty Gazet
t
e
, vol/is
sue: 104(10)
, pp
. 24-27, 2010.
[17]
University
College Dublin (UCD), “UCD Reco
rds Mana
gement and Freedom of Info
rmation”, 2003.
Available:
http://www.ucd.ie/foi/recordk
/
co
ll_ret.h
tml. Last
accessed 17th
Februar
y
2014
.
[18]
Blackwell, C
.
and Gahan, M., “
P
CI DS
S
com
p
l
i
anc
e
- m
eeting
the dem
a
nds
”,
Data Protection
Ireland Journal
,
vol/issue:
2(6), p
p
. 10-13
, 2009
.
[19]
Identi Metrics (IDM), “Bio
metric Student
Identification
:
Practical Solutions
for Accountability & Security
in
Schools”,
ident
i
Metrics,
2009.
[20]
Higher Edu
c
ati
on Authorit
y
(
H
EA), “New Entran
ts
b
y
In
stitution
,
Gend
er and
Age”,
2013. Avai
labl
e:
http://www.hea.ie/sites/d
e
fau
lt/f
iles
/ft_ug_new_entrants_2012-13
_b
y
_
ag
e.x
l
sx
.
Last accessed 3rd
Januar
y
2014
.
[21]
Fennell, S., “Data Subjects
and Examinations”,
in
fo@dataprotection.
ie, 2014
.
Last accesse
d 9
t
h Januar
y
2014.
[22]
Garg, A., “Biometric attendance on cards, DU
tells Delhi hig
h
court”, 2013. Availab
l
e:
http://www.
hindustantimes.
c
om/India-
news/New
Delhi/DU-faces-contempt-
notice-for-not-sta
rting-biometric-
attendance/Article1-1048716.aspx. Last
accessed 14th
Februar
y
2
014.
[23]
J
e
rdan,
T.
,
and
Call
ahan
, M
.
,
“
P
rivac
y
Im
pact
As
s
e
s
s
m
e
nt for the
Biom
etri
c
s
Acces
s
Contr
o
l S
y
s
t
em
at
th
e
Transportation S
ecurity
Lab”, U.S. De
partmen
t
o
f
Homeland Security
, 2011.
[24]
McKelvey
, N.
and Houston-Callagh
an,
E., “Th
e
Ca
pab
ili
ties
a
nd Vulnerabi
lit
i
e
s of the C
l
oud
”,
Internationa
l
Journal of Engin
eering and
Tech
nology
, vol/issue: 2(6), pp. 1062-
1075, 2012
.
[25]
ICO, “Univer
s
ity
published
personal d
a
ta in
on
line tr
aining
manua
l”, 2012.
Available:
http://www.ico.o
r
g.uk/news/latest
_news/2012/university
-
publish
e
d-persona
l-data-
i
n-online-trainin
g
-manual-
01032012. Last
accessed 9th
Jan
u
ar
y
2014.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ERE
I
S
SN
:
225
2-8
8
2
2
Dat
a
Pr
ot
ect
i
o
n
Issue
s
i
n
Hi
g
h
er E
d
ucat
i
o
n
w
ith Technological A
d
v
ance
m
ents
(Nigel McKelvey
)
14
1
[26]
Harris, A., “Th
e
Legal Stand
i
ng
of Data in
a Clo
ud”,
Disse
rtation,
-
Dublin Institute
of
Technolo
g
y
, 2012
.
[27]
Allen, E., and S
eaman, J., “Lear
n
ing on demand. Online
edu
cation in the United
States, 2009”, Needham: Sloan
Center
for Onlin
e
Edu
cation, 201
0.
[28]
Irish Statu
t
e Book, “Student
Support Act 2011”, 2011. Availab
l
e:
http://www.irish
s
tatutebook
.ie/p
d
f/2011/en
.act
.2
011.0004.pdf
. Last acce
ssed 4th
Januar
y
2014
.
[29]
Law Society
of
Ireland
, “Cer
tificate in
Data Protection
Practice”, 2014. Available:
http://www.lawsociety
.ie/S14-
Certificate-in-D
ata-Protection-Practice.
aspx. Last accessed 6th
Januar
y
2014.
[30]
PDP, “PD
P
Training”, 2014. Availa
ble: http://www.pdp.ie/training/.
Last accessed 6th Janu
ar
y
20
14.
[31]
Tomlinson, M.,
“Graduate Emplo
y
ab
il
ity
and
Student Attitude
s
and Orien
t
ations to th
e Labour
Market”,
.
Journ
a
l
of Edu
c
ation
an
d Work
, vol/issue: 20(4)
, pp
. 285
-304, 2007
.
[32]
Naughton, M.,
Callan
a
n, I
., Gu
erandel,
A.
and
Malone, K
., “Medical stude
nts'
knowledge o
f
data pro
t
ection
legisla
tion
”
.
Clinical Governance
, vo
l/issue: 17(
1), pp
. 28-38
, 20
12.
[33]
Koty
k
,
J., “What is
a Reasonable
Expectatio
n of Pr
ivacy
in the Information Contain
e
d o
n
a Workplace
Computer
?
”
,
Ed
ucation
Law Jou
r
nal
, vol/issue: 2
2
(2), pp
. 223-22
9, 2013
.
[34]
Reeves, C., “Dropbox amends privacy
po
licy
to conform to
in
ternational Safe Harbor
Laws”, 2012. Available:
http://www.westhost.com/blog/2
012/02/
29/dropb
ox-amends-privacy
-po
l
icy
-
to
-con
form-to-international-safe-
harbor-laws/. Last accessed 3rd
J
a
nuar
y
2014
.
[35]
Findlay
, N
., “In-
School Administrato
rs' Knowled
g
e of Edu
c
ation
Law”,
Edu
c
atio
n Law Journal
, vol/issue:
17(2
)
,
pp. 177-202
, 20
07.
[36]
Hustinx, P., “Data Protection an
d Cloud Compu
ting under
EU law”, Th
ird Euro
pean C
y
ber Security
Awarenes
s
Day
- European
Parliament,
201
0.
Evaluation Warning : The document was created with Spire.PDF for Python.