RCSI Student Privacy Policy

We invite you to read this privacy policy (“Policy”), which explains our data protection practices and how we handle your information in the context of your education and the administration of your studies at RCSI (the “Services”). This Policy describes the types of information collected and created in the context of your studies at RCSI, how and why we use such information, who we share it with, and your legal rights.

When we refer to “RCSI”, we mean the Royal College of Surgeons in Ireland, which is the controller of your personal information. We also use the “College”, “we”, “us” and “our” to refer to RCSI in this Policy.

Please also read the RCSI Student Agreement and the other RCSI regulations and policies referenced in it, which set out the terms governing your role and position as a student at RCSI. Violating these rules or aspects of such policies may lead to disciplinary action, and may render you liable to disciplinary sanctions or penalties, including suspension, or in some cases expulsion/discontinuation.

Information We Collect, and How We Use It

RCSI collects and processes your personal information for the purposes of ensuring the safe and effective management and administration of your studies as an RCSI student; to ensure compliance with the requirements of the Student Agreement and related policies; and pursuant to legal obligations to which it is subject. This data may include sensitive information, for example information relating to your health or medical circumstances, where it is necessary to collect and process such information for the purposes outlined in the Student Agreement and to provide RCSI support services to you.

For example, we may collect or receive the following information: Application information:

• When you apply to RCSI, or register as a new student, or register annually as a student, as the case may be, and from time to time, you provide, as appropriate, your name, contact details, application details, CV/resumé, academic results and references, and confirmation that you have not been expelled from any academic institution. We use this information to manage and administer you role, position and journey as a student at RCSI, including to verify and validate your application.
• Government Sponsors When registering, you may also provide other information, such as contact details of your government sponsors and next-of-kin. We may correspond with your government sponsors in connection with any continuance, and/or progress, in the College, in connection with your academic examination results, or, in cases of emergency, in relation to your health and general welfare.
• Next-of-kin: We may correspond with your nominated next-of-kin, in cases of emergency, and in relation to your health and general welfare.
• Medical examinations or procedures. You may be required to undergo certain medical examinations and/or procedures, which may include blood tests, vaccinations, and other appropriate medical tests and/or procedures, as required by RCSI. We process the results of your medical examinations and/or procedures to ensure your own well-being and protection, as well as that of, patients, healthcare staff, fellow students, RCSI staff members and RCSI itself. More information is available in the Blood Borne Viruses Policy at Annex [C]
• Alcohol and drug testing. In certain cases, such as where recommended by the RCSI Disciplinary Committee (who may make such recommendation on reasonable suspicion that a student may be using drugs, or as part of a student’s rehabilitation monitoring), you may be required to undergo alcohol or drug testing. More information is available in the Alcohol, Drug and Substance Misuse Policy at Annex [E]
• Vetting (Police Clearance) and criminal information. If work or activities you undertake constitutes “relevant work or activities” within the meaning of the National Vetting Bureau (Children and Vulnerable Persons) Act 2012 (as amended) (“Vetting Act”), RCSI will submit an application to the National Vetting Bureau for a vetting disclosure relating to you. In addition, during your study, you are obliged under RCSI policies to promptly disclose to the RCSI Associate Director for Academic Affairs details of any criminal investigations1 and criminal convictions other than “spent” convictions, together with details of any pending criminal charges against you. We may use this information to determine if you are permitted to carry out “relevant work or activities” under the Vetting Act and/or to determine if you are suitable to continue as a student in RCSI. More information is available in the Vetting (Police Clearance) Disclosures Policy at Annex [I]
• College communications. We will communicate with you during the application process and throughout your time as a student at the College for various purposes, including College notifications and updates. Such communications may occur by email or post, over the phone, and, in limited cases, by SMS.
• CCTV. Your image may be captured on CCTV on RCSI’s campuses. Such images will be processed in line with RCSI’s CCTV Policy at Annex [G].
• Recorded lectures. Where lectures are recorded for the purposes of facilitating and enhancing the student experience, you may be photographed and/or filmed as part of group scenes in classes or and any contributions you make in class may be recorded. These recordings are likely to be hosted on Panopto, Microsoft Azure, (or whatever video hosting platform is best suited) and will be made available on Moodle.
• Simulation skills sessions. Where sessions are recorded for the purposes facilitating and enhancing the student experience, you may be recorded for feedback purposes.
• College videography and photography: RCSI will capture select College events and student activities through videography (live or recorded) and/or photography. This video and photography is archived for the College records and may also be used for the purposes of promoting the College’s activities through the media, digital channels and on marketing materials.
• IT monitoring. Where a formal investigatory (or similar) process is required and approved as appropriate by RCSI’s senior managers, RCSI may, in very limited circumstances, review the content, logs, metadata and/or other administrative information concerning communications made and activities undertaken using RCSI’s computing resources in line with the IT Acceptable Usage Policy at Annex [H] and the Student Agreement.
• Research. We routinely collect Central Applications Office (CAO) data, student feedback and examination results for internal quality assurance purposes. We may use such information in an aggregated and anonymised manner to inform the continuing development and improvement of the student experience. We may share such aggregated information where it is of value to the research community, particularly with regard to the education of healthcare professionals, and it may be submitted for publication (subject to relevant ethical approval). We may also participate in, or facilitate research that requires 1 Criminal investigations include being arrested or interviewed under caution by a police officer whether in the Republic of Ireland or elsewhere. Privacy Policy 2019-2020 3 data collection via surveys and / or focus groups. Relevant student groups may be invited to participate in such research on the understanding that participation is voluntary and the data will always be anonymised.
• Analytics. Learning analytics will be performed on individual student performance throughout the academic year to produce aggregate, anonymised reports which will identify where additional support and interventions may be required to enhance the overall educational experience at RCSI and take individual action. The aggregate data may be used by RCSI in the future for research purposes.

Legal Bases

We rely on a number of legal bases to collect, use, share, and otherwise process the personal information we have about you for the purposes described in this Policy. This means that we may rely on the following when processing your personal information:

• as is necessary to perform the Student Agreement and to provide the Services;
• where you have consented to the processing (noting that you may revoke such consent at any time);
• for RCSI to comply with a legal obligation, a court order, or to exercise and defend legal claims;
• to protect your vital interests, or those of others;
• where you have made the information public;
• where necessary in the public interest;
• and where necessary for the purposes of RCSI’s, or a third party’s, legitimate interests, such as those of visitors, members or commercial partners. In certain cases, described in more detail below, we may process ‘sensitive’ or ‘special categories’ of information, such as relating to your health.

Along with the above list, we may process such information:

• where necessary for RCSI to carry out obligations and exercise specific rights in the context of social security and social protection law;
• where necessary for the purposes of preventive or occupational medicine, medical diagnosis, the promotion and provision of health or social care or treatment or the management of health or social care systems and services;
• and where necessary for reasons of public interest in the area of public health.

Our Legitimate Interests

Where we rely on legitimate interests, we may process your information in line with the following interests:

• Keeping the College safe and secure. We may process your information as is necessary to pursue our and our students’ legitimate interests in ensuring the College is safe and secure, such as by implementing and enhancing physical and technical security measures and protections, protecting against fraud, spam and abuse, and enforcing our Student Agreement.
• Providing, developing and improving the Services. We may process your information to provide the Services and develop and improve them over time. For example, we may carry out analyses to determine where additional support and interventions may be required to enhance the educational experience at RCSI for you and/or others (including the student body generally).
• Providing seamless Services with our affiliates. Where the Services require the engagement of affiliated organisations, we share your information with such affiliates to provide and improve the Services. For example, we may disclose vetting (police clearance) information to student placement sites where appropriate.
• Continuing the relationship between you and RCSI after you graduate. Upon graduation, RCSI will continue to engage with you through the Alumni Relations Office in both our and your legitimate interest to keep you up to date on College matters described above.
• Advancing the College's mission. Upon graduation, RCSI will continue to engage with you to seek your support for student initiatives in the context of the legitimate interests of advancing the College’s mission to ‘educate, nurture and discover for the benefit of human health.’

Sharing Your Information

In certain cases, we may share your personal information with third parties, including service providers. Such sharing may be necessary for the purposes described in this Policy, for the management and administration of your studies as an RCSI student, or otherwise for the provision of the Services. In addition to the receipts described elsewhere in this Policy, your information may be shared in the following ways:

• Third party service providers. In the course of providing the Services, we may share your personal information with third parties who provide services to RCSI, in accordance with college policies. These third parties are contractually required to process such information on our behalf for the limited purposes we instruct, and are required to protect and secure your information.
• Third party controllers. We may share certain information with third party controllers who can use the information for their own specific purposes. For example, we are required to share information with the Department of Education and Science and the Higher Education Authority of Ireland for statistical and funding purposes. We share the results of the United States Licensing Examination (USMLE), although the College does not require all students to take these examinations. This information is required to maintain student eligibility for US Financial Aid and is used for statistical and funding purposes (Medical students only). We share information with relevant professional regulatory bodies to certify that you have completed and passed all the examinations for the award in order to facilitate registration. Details of postgraduate research projects (eg thesis title, supervisor name, course) are made available in public presentations such as researcher profile web pages and printed communications. We also make Garda vetting (police clearance) disclosures available to student placement sites where it will be held on file for the period of time that you are carrying out your student placement.
• Legal and safety reasons. We may retain, preserve, and share your personal information if we have a good faith belief that it is reasonably necessary in order to (i) respond to a legal request, such as a search warrant, court order, or other request from government or law enforcement; (ii) detect, prevent, investigate or address security issues, fraud or or suspected illegal activity; (iii) protect our or any third party’s rights, property or safety; (iv) enforce the Student Agreement or any other agreements we have with you; or (v) prevent physical injury or other harm to any person or entity, including you, other students, staff and members of the public.
• Aggregated information. We may share certain aggregated information and statistics with third parties as described throughout this Policy. For example, we may share certain aggregated information where it is of value to the research community, particularly with regard to the education of healthcare professionals.

Data Transfers

In certain cases, we may transfer personal data outside the EEA in accordance with EU data protection law for the purposes of RCSI’s administration and management of its students, including where it is necessary to provide the Services and perform the Student Agreement. We may use a legal mechanism known as the “standard contractual clauses” to protect information transferred outside the EEA. These are contracts that contain standard commitments approved by the EU Commission protecting the privacy and security of the information transferred.

You understand that we may transfer and store your data outside your home country, including to, and in, the US, as described in this Policy. The privacy protections and the rights of authorities to access your personal information in some of these countries may not be the same as in your home country. RCSI will only transfer personal data as permitted by law, and will take steps intended to ensure appropriate protection of your personal information.

Your Rights

You have a number of rights under EU data protection law in respect of your personal information:

• Access and porting. You can access much of your information by logging into the Student Gateway. If you require additional access, contact us at registry@rcsi.ie to request a copy of your information. Where legally required, we can provide your information in an easily accessible format and assist in transferring some of this information to third parties.
• Restrict, Rectify, Limit, Delete. You can also rectify, restrict, limit or delete much of your information by contacting us at registry@rcsi.ie.
• Object. If we process your information based on our legitimate interests explained above, or in the public interest, you can object to this processing in certain circumstances. In such cases, we will cease processing your information unless we have compelling legitimate grounds to continue processing, or where it is needed for legal reasons. Where we use your data for direct marketing, you can always object using the unsubscribe link in such communications or by emailing us at registry@rcsi.ie.
• Revoke consent. Where you have previously provided your consent, you have the right to withdraw your consent to the processing of your information at any time. In certain cases, we may continue to process your information after you have withdrawn consent if we have a legal basis to do so or if your withdrawal of consent was limited to certain processing activities.
• Complain. Should you wish to raise a concern about our use of your information (and without prejudice to any other rights you may have), you have the right to do so with your local supervisory authority or RCSI’s lead supervisory authority, the Irish Data Protection Commission.

Office of the Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland

Phone +353 (761) 104 800 | LoCall 1890 25 22 31 | Fax +353 57 868 4757 | email info@dataprotection.ie

Retention of Information

We may retain your information for as long as necessary in order to ensure the safe management and administration of your studies as an RCSI student, and, upon successful completion of your studies, for the administration of your records as an Alumnus of RCSI, subject to any legal obligations to further retain such information or in order to defend against legal claims.

Amendments

From time to time, we may make changes to this Policy, so please review it periodically. If we materially change our Policy, we will take steps to notify you in advance of the change, for example by emailing you or by posting a notice in Moodle.

Contact Us

Royal College of Surgeons in Ireland
Main Building
123 St Stephen's Green
Dublin 2
D02 YN77
Ireland

Our Data Protection Officer can be contacted at dataprotection@rcsi.ie