Data Protection Case Studies

CONTENTS

1 Case Study -1 (Wranglia Rustick University).....................................................................1

2 Case Study-2 (Alligator Software)...............................................................................3
3 Case Study-3 (Wranglia Rustick Student’s Union)........................................................4
4 Case Study-4 (Wranglia Rustick University – Research Activities)...............................6
5 Case Study 5 (Wranglia Rustick University – eek-Vision )...........................................8
6 Important Note........................................................................................................10
7 What you might be asked to do?...................................................................................11
============================================================

1 Case Study -1 (Wranglia Rustick University)

Wranglia Rustick University is thinking of replacing its current ageing centralised
mainframe system SPLISH (Student Profile Linked Into Semester History) with a
more modern system SPLOSH (Semester Planning; Lesson Overview and Student
History). The main functions of the new system (Phase 1) will be to:

 produce individualised personalised timetables for students and staff, also

available for download via the Internet to avoid long queues at admin. offices.
Full timetables of all classes will also be on Wranglia’s Internet site, as will
class-lists.

 compile an email list of current students, available via the University’s Internet
site, so all students, staff and others can easily email all students, those in a
particular year, course or subject, or contact a particular student. This would
also allow parents and others from outside the University to contact them.

 allocate rooms for all classes, and allocate students to seminar, practical or
tutorial groups. The pilot scheme, which it is hoped to expand, allows
students with special needs (e.g. medical, social, family or religious) to avoid
having classes on particular days, dates or times, or at all.

 record module results for every past and present student. In future it will also
automatically calculate average marks, overall grades, the qualification(s)
achieved (if any) and determine whether the student progresses or fails. This
includes the grade of degree awarded.

737983610.doc © R Waixel 2022 23/03/2024 06:40

ALL RIGHTS RESERVED - r.waixel@anglia.ac.uk

 Data Protection Case Studies Page 2 of 10

 hold a photograph of every student which is used to produce a combined

student identity card, library card, and room access card. It is intended
to give only swipe card access to every room in every building. This will be
presented as a ‘health and safely measure in case of fire and for other
University monitoring purposes’, but used to measure attendance at all
lectures and tutorials and to record those who spend excessive time in the
bar or cafeteria, rather than in the library, when not in a designated class.

 produce lists of students graduating (for degrees, grouped by class and

percentage) for lists on notice boards and the graduation ceremony
programmes. The same lists are also to be made available to a supplier of T
shirts (based in the USA) so that T shirts with lists of Graduands, or
personalised Wompoms in academic dress, can be sold at the Graduation
ceremony, by mail order or even over the Internet. (“Joe Bloggs BSc Computer
Science 47% Another Wranglia success”)

It is hoped that all teaching and administrative staff will be able to directly
access and update any aspect of any student's record on the new system, from
any computer on the University network, or from home. This could improve the
productivity of most administrative staff by 'encouraging' them to work from home, at
weekends, and whilst on ‘holiday’, and converting most administrative offices into
nursery areas for families of mature students or of staff. Staff and students who are
single parent families would get preference.

To cover staff shortages, maternity leave, sickness and delays in permanent

recruitment, the University also employs a number of past and present students and
their past present and future partners in various administrative capacities, particularly
for data entry purposes. At present, unfortunately, these do not get the induction
procedures that full time staff (eventually) receive.

In the longer term it is also envisaged to enhance the system (Phase 2) to

encompass direct mailings to all past students, starting with those who have paid
their own fees, or are thought to be richer, especially those from overseas. These
could build up a list of Old Wranglonians - Alumni willing to make donations or
perhaps offer second-hand computers to replace even more aged equipment
currently used. It could also possibly be used to entice them back for further courses
by mailing them with prospectuses and special mailings and offers. The list could
also be sold to companies wishing to mail to recent graduates (e.g. offering more
Loans).

2 Case Study-2 (Alligator Software)

Alligator Software is an aggressive and expanding Software House, producing
Application Packages, bespoke business software and operating system utilities. Its
motto is "GatorSoft - Snappy Software with every byte".

It is thinking of replacing its current ageing centralised mainframe administrative

systems with a more modern system based on PCs.

737983610.doc Rev 9 23/03/2024 06:40

 Data Protection Case Studies Page 3 of 10

The Personnel Department has employee records held manually - - which include
Appraisal forms containing such phrases as:

"This employee performs completely to his own satisfaction"

"This employee should go far - and quickly"

Applications other than Personnel to be replaced include Accounts, Payroll, Debtors,

Creditors and Sales Invoice processing. Other than replacing existing systems,
various departments are keen to use the new computer system.

Sales and Marketing

Currently each Sales Manager has maintained their own list of potential Sales
Contacts with whom they have done, or might do, business. Many of the sales
personnel have these on their own PCs at home or on personal organisers. A new
Sales and Marketing Manager, Mr Pike, is keen to combine these onto a central
corporate database to maximise their potential, allow unified mailings, and, most
importantly, to preserve the data for the company's use when, as often happens, a
salesman leaves. Typical information stored includes comments on the likely sales
potential and the quirks, hobbies and weaknesses of particular contacts. He has
been impressed with a turnkey system available from a US company at a particularly
reasonable price using a distributed database and fileservers based in the USA.

Security
Mr Whale, Security Manager is keen to implement an integrated security system
which will perform complete access control, using an enhanced version of the
employee's ID card, which already has their photo, signature and a barcode. In future
he hopes to convert them to being on a Smart card which will additionally log the
dates/times the employee enters/leaves the building and will also be used for logging
in/out of terminals instead of typing in a Password. The metrics data collected from
this can then be used to separate the workers from the shirkers, and fire the latter. It
will also make it more difficult for employees to illegally copy software or data onto
unauthorised machines or media and take it home, since the application software will
only work (or the data decrypt) with the smartcard in place.
The Company already has a policy of monitoring all telephone calls made from work.
This is to be extended to staff emails and to www pages visited to ensure that only
strictly business use is made of these facilities.
A CCTV facility, currently used outside the building for security, is to be extended to
cover all areas inside the building, including the toilets. This is to help guard against
theft, and prevent any substance misuse, especially after office parties.
Software Development

The Software Development Manager (Ms. P Rhana) would like to build into future
versions of any application, the hidden monitoring of end-user's hard disks for illegal

737983610.doc Rev 9 23/03/2024 06:40

 Data Protection Case Studies Page 4 of 10

editions of the company's software, which would then be disabled after a random
interval citing 'internal error 42' and giving a freephone number to call. The user’s
Name and Disk identity would, if possible, also be reported back on the Internet.
This would enable at least a proportion of illegal copies to be tracked down, and dealt
with.
Data Protection

The company has just won a large contract to produce a bespoke system for a local
Government client. As part of the ISO9000 quality questionnaire that they completed
as a potential supplier, the company had to state and confirm its adherence to 'best
practice' in an number of fields including that of Data Protection. Up till now, although
registered under the Data Protection Act 1998, the company has done little more
than fill in the forms. The task was actually performed by the Company Secretary, a
lawyer uninvolved with the activities of the business.

In order to be seen to be complying, the company had just hired a new graduate from
Wranglia Rustick University to become Data Protection Officer. He also just happens
to be the son of the Managing Director (Mr Shark). He is keen, but only marginally
conversant with Data Protection Law and practice. If he makes a success of the job,
his contract will be renewed. If he doesn't, then he stands a good chance of
‘promotion' as the company's first Sales Representative in Alaska.

3 Case Study-3 (Wranglia Rustick Student’s Union)

Wranglia Rustick All Person’s Student’s Union (WRAPSU) is an independent not-for-
profit organisation to which most Wranglia Rustick University students belong. It
elects its own officers annually and receives money from the University and other
sources. Wranglia prides itself on taking students from a wide range of countries and
backgrounds.

The Student’s Union holds its own computerised database of past and present
students including their name, address, age, sex, country of origin (to target for
‘ethnic events’ promotions); marital status and no of offspring (to identify single
parents needing child-care facilities). Students regularly come to the SU for advice.
This could cover advice on health, problems with the University’s administration
(including absence, plagiarism and non-payment of fees) and legal problems with
landlords, including but not limited to the University’s Housing Service.

It has recently been informed by the University, that due to new Data Protection
legislation, the University feels it can no longer automatically supply the Student
Union with Student’s personal details, even if the Student has signed up as a
member of the Student’s Union. The Union needs advice on whether it can
challenge this decision, or what actions it can take to prevent it having to gather and
keep up to date a separate database itself rather than relying on the University to
notify it of changes e.g. of term time address.

737983610.doc Rev 9 23/03/2024 06:40

 Data Protection Case Studies Page 5 of 10

The Union’s officers are also uncertain as to how far they can hold details about
students who have left the University, or whose status is unclear (e.g. suspended),
and whether the Student’s Union can continue to hold their details and mail them with
events details and special offers.

The Union will want all its Officers and employees to have access to all the data,
whether onsite or from their homes. It uses both paid and unpaid student volunteers,
and often their partners, to help with administrative tasks, which include, at busy
times, data entry for the Student Union’s administrative systems.

Details of the current SU Officers, including a photo; address; phone number(s) and
email addresses, will be published on the SU’s web-page so that any student can get
in touch at any time. (Motto: “You’re only a click away from Mick – get help from the
SU”).

The Union would also like to raise some additional revenue by makings available lists
of all students and their addresses to suitable organisations (e.g. record companies,
dances, gigs, night-clubs, thesis binding and typing) or even on the SU website.
Obviously some mailings (e.g. for ‘Ethnic’ music) may wish to be targeted at students
of a particular age, sex, or ethnic group. The mailing house chosen is based in the
USA, as they offered an exceptionally good deal, because they had links with a
former Wranglia Rustick student, whose appeal against expulsion the Student’s
Union successfully fought.

The Student Union also runs a Bar, and intends to install Closed Circuit television to
monitor its Offices, the Bar and Toilets to provide evidence if trouble ensues, and a
deterrent against drug-taking or drug-pushing. It wants to hold a blacklist of SU
members and others who are to be banned for unruly behaviour, together with their
photographs, to be available (amongst others) to the Friday Night Disco doormen via
WAP phones.

A smart card could be used as a SU membership card, to pay for drinks, easily flag
banned members, pay for SU products and services (including the Contraceptive
machines in the toilets), the attraction being a substantial discount if paying using
the card. The SU would refuse additional credit to those with a poor credit record,
and require prepayments (i.e. stored payments) to be made in this case.

The Union is planning to commission a new software suite (WRAPSUDEE -

WRAPSU Decision Enhancement Environment) to hold as much as possible of the
above information in a single integrated system.

4 Case Study-4 (Wranglia Rustick University –

Research Activities)

Wranglia Rustick University (WRU) is a Higher Education institution in the East of

England. As a relatively new University it is attempting to establish a name for itself
both by the excellence of its teaching and learning, but also in the field of Research.

737983610.doc Rev 9 23/03/2024 06:40

 Data Protection Case Studies Page 6 of 10

All academics are encouraged, despite heavy teaching (and sometimes also
administrative) workloads, to carry out or facilitate Research. Senior Lecturers (and
above) are encouraged to take on students studying for “Higher Degrees” (MSc,
MPhil and even PhD).

Joseph Bloggsmith is a newly appointed Research Student in the Department of

Computing And Technology Sciences (CATS). He is interested in studying the
reactions of people new to computing, and those from different ethnic origins, in the
handling of Computer Mice.

He has got his Research Proposal approved by the University Ethics committee
since they have been assured that no live mice will be used. However, his
Supervisor, Dr. Hobbs-Wakesell, has had concerns expressed to him that there may
be difficulties with Data Protection, and is seeking advice.

The Research consists of getting a sample of people drawn from University Students,
Lecturers and Administrative staff, who represent a statistically valid set of:-

a) Men and Women of different age groups

b) Experienced and novice users of computers

c) People with different ethnic groups used to European script, Arabic script, Indian
languages and Far Eastern languages (Japanese/Chinese)

d) People with visual (or other) impairments who may have difficulties using a
standard VDU, or a standard computer mouse

It is intended to carry out the Research as soon as practical (i.e. now), and again in a
year’s time on the same people, by which time it is hoped the responses of the
‘novice’ users should have changed more than the ‘experienced’ users.

The research will explore HCI aspects of how the individuals, with a GUI interface,
use

a) the keyboard

b) the mouse

c) touch-screen

to perform a simple set of standardised tasks, involving choosing between

photographs of people. These photos were taken a few weeks before on the
Campus.

The details will be automatically gathered and held on a database. This is held by
the Research student on his laptop machine at WRU, which is also taken home for
working offsite. A backup copy is taken from time to time, and stored with the
student’s (current) girlfriend for safekeeping.

A Webcam and sound recording is also used to record the research subjects’ actions
and reactions to the experiments, but they are not told about this because it might

737983610.doc Rev 9 23/03/2024 06:40

 Data Protection Case Studies Page 7 of 10

make them nervous to think they were being recorded. This allows the Research
student to monitor progress with the experiment from their own home, where
necessary, without having to attend the University for long (and possibly boring)
hours.

All likely research subjects are told that the research is interesting and of importance
and their verbal consent should be obtained to hold their information for ‘research’,
unless this step is accidentally forgotten.

When data gathering is complete it is intended to send all the data to the
Researcher’s brother in the USA for processing, since he has, and more importantly
knows how to use, a suitable statistical analysis package.

The research student intends that his Doctoral Thesis will include as an Appendix,
the full details of the results, by named person, since he has had it drummed into him
that the original data must be given as fully as possible, to avoid allegations of
cheating.

As part of his activities as Research Supervisor, Dr Hobbs-Wakesell holds some

details about Joseph Bloggsmith such as:

Name, Termtime address and home address, landline and mobile telephone
numbers and email addresses.

and writes them on the whiteboard in his office, alongside those of his other
Research students. He also records their presence at, or absence from, Research
Supervisions, and the reasons given for such absence (e.g. pregnant (again); 3 rd
grandmother died).

5 Case Study 5 (Wranglia Rustick University – eek-

Vision )

Wranglia Rustick University (WRU) is a multi-site Higher Education institution in the

East of England. It sees itself as a pioneer of a new breed of Regional Universities
(UniReg) and has close teaching links with a number of Further Education (FE)
colleges in the Region, often taking students starting on courses at the regional FE
partners on to higher qualifications and awards. As a relatively new University it is
attempting to establish a name for itself both by the excellence of its teaching and
learning, but also by using innovative ways to reduce administration costs and keep
in touch with its students.

Under a new, forceful and innovative Vice Chancellor, it has pioneered eek-vision (©
all rights reserved) as its preferred software package to deliver internet based access
to details about its students and other data, still held on the University’s (ageing)
central systems.

737983610.doc Rev 9 23/03/2024 06:40

 Data Protection Case Studies Page 8 of 10

Both the current central systems (PCs accessing the central servers) and the newly
commissioned internet solution (eek-vision) access the same underlying database,
which means that response times can slow down particularly at times of high demand
from either system. Sometimes response times are so slow that users are unsure
whether they have been able to logout or to logout at all.

There are currently two main users groups for eek-vision: students and teaching
staff. Administrative staff still use the older PC systems, although one of the next
stages will be to migrate them across to eek-vision, thus providing a common
platform for WRAP-IT1, the central IT services, to support.

Students currently have access to their own record (their username is their Wranglia
ID Number WID) and a password chosen by themselves. Their initial password is set
to be their date of birth in the format “YYYYMthDD”. They can see and change their
first name(s) (not Family name), addresses, telephone and mobile contact numbers,
ethnic origin, and their own, personal email address. This latter is never used by
WPU but was provided at the request of the students union ‘to keep the students
happy’). A WRU student email address is provided of the form
ABC123@student.wranglia.ac.uk to where official WRU communications are sent,
(e.g. results, assignment resubmission details) but is seldom accessed by students
as they can’t be bothered. It is hoped to provide secure swipe-card access to the
system and to emails whereby students can log in (on site) just by swiping their
Student ID card.

Students can also view (but not – it is hoped - change) their results, view timetables,
change their tutorial / practical groups (but not lectures), send each others emails
and use an instant messaging service. All emails and instant messages are stored
by the system for 30 days [regardless of whether the user has ‘deleted’ them] in case
of breach of ‘acceptable use guidelines’ which are displayed at the start of each login
session. Such emails can be accessed by WRAP-IT computer system
administrators. All emails are automatically wiped totally and permanently by the
system, after 30 days to save space on the server, regardless of whether they have
been read, saved or ‘deleted’.

Access is provided using standard internet protocols and is therefore possible from
public terminals at WPU, from Internet PCs at term-time addresses or Internet Cafes
in the locality, or wherever in the world they might be.

All Teaching staff from both WPU and its regional partner colleges have got access
to all students details (but excluding student’s personal emails) both at WPU and its
regional partners via the eek-vision system. Regrettably their level of skill,
knowledge and proficiency in using the system varies dramatically. Their access is
via a (public) Username consisting of their Staff email identity (e.g. AB123) and a
(secret) password, chosen by the staff member, but initially set to their staff ID
number [as on their staff card]. They too have access from onsite, or from their
home or even when conducting ‘research’ at far flung corners of the world (with
Internet access).

1
WRAP-IT Wrangla And Partners Information Technology

737983610.doc Rev 9 23/03/2024 06:40

 Data Protection Case Studies Page 9 of 10

Teaching staff can view all the data students can see, and additionally change the
marks for modules for which they are named as the module leader. This ‘module
leader’ data isn’t always completed, correct or kept updated, so staff have been
known to get a colleague to do make the required changes, or they swap
passwords/identities to facilitate entry of revised marks.

Data is held about all previous students, indefinitely, to allow staff to produce
references easily. WRAP-IT are working on an ‘expert system’ [provisionally called
expert-eek] to produce a reference letter. This will include the student photograph,
and text automatically generated, based on the student’s transcript, without staff
having to go to the bother of doing so personally. This will be especially useful when
staff who have known the student best, might have left the University, as the new
vice-chancellor’s purges begin to bite.

Any administrator from any part of the University or the Regional Partners, can view
and change any of the data for any student, although by convention they usually only
do so for ‘their own’ students. The information on which student belongs to which
site or administrator is known to each administrator, although these fields on the
database are incomplete and somewhat suspect even when there is data, due to a
recent major organisational shake up.

Other Customers of eek-vision

Eek-vision has been developed by WRAP-IT originally just for WRU but then later
sold on, with variations, to other Universities in the UK, Europe, and it is now hoped
to target the USA. Wranglia employs a graduate Research Student to sell the
system, on a commission basis, worldwide, and has given him a notebook PC to
demonstrate the system on. WRAP-IT has a considerable amount of test data both
‘snapshots’ from Wranglia live data, and from elsewhere, which it uses to test new
versions of the eek-vision systems.

One of the most convincing sales arguments when selling the system to potential
new customers, is the way it handles large volumes of student data. A
‘Demonstration DVD’ has been produced, with once-live data, now mostly outdated,
from a number of Universities in a number of formats, and this is left with potential
customers. A copy of the data is also on the Notebook computer.

A passing Consultant has mentioned in one of her reports that the University and
WRAP-IT may be breaching one or more aspects of Data Protection legislation.

6 Important Note
The organisations and people in these Case Studies are entirely fictional.
Ideas as portrayed do not necessarily represent best, good or even adequate
data protection procedures or practices.

737983610.doc Rev 9 23/03/2024 06:40

 Data Protection Case Studies Page 10 of 10

7 What you might be asked to do?

 Go through Case Study(s) above listing the actions / features / functionality and
determine whether and if so which DP Principle(s) they might be breaking?
 Consider how important is that breach i.e. compliance or best practice?
 What action(s) might you recommend to the client organisation and/or specific
employees, to avoid or minimise such breach(s)?

Happy Hunting – Bob Waixel.

737983610.doc Rev 9 23/03/2024 06:40