Our response to the General Data Protection Regulation 2018 (GDPR)
The GDPR will make a series of major changes to the rules governing data storage and processing. The Information Commissioner's Office (ICO) will oversee the implementation of these changes as they apply to legal systems in the UK - read their GDPR guidance document, along with further information across their website. The GDPR will be enforced from 25 May 2018.
The University of Stirling's alumni relations and fundraising team (the Directorate for Advancement) will process personal information relating to alumni on the grounds that it is in the 'legitimate interests' of the University to do this and is also beneficial to the individuals concerned (Article 6(1)(f) of GDPR).
This statement applies to external relations data, managed by the Directorate for Advancement, but other departments that may hold your information for different purposes may process data under different grounds.
Use of data by other University departments
The data you give us whether online, by email, telephone or post may be made available as appropriate to our academic and administrative departments, recognised University of Stirling alumni clubs and associations. Under the GDPR, the above comments about data processing grounds will be considered when sharing data, to ensure that data subjects' wishes are respected and of course to make sure the data processing is lawful.
This internal data sharing is primarily done to allow University departments to engage with alumni and other contacts who fit a particular set of criteria (e.g. geographic location, graduation year, subject of study). Wherever possible, data shared for such purposes will be anonymised to leave only the information pertinent to the planned activity, with personally identifiable information being removed. Primary responsibility for external engagement data remains with the Directorate for Advancement, whose staff will process communications on behalf of other departments, maintain data security, and process requests for removal from contact lists (or removal from the database itself).
Sharing your data
We will not disclose your data to third parties without your consent, except where they are acting as authorised agents for the University for the above purposes or where we are permitted or required to do so by the Act.