Student data sharing: policies

Jen Persson made this Rhyddid Gwybodaeth request to Y Cwmni Benthyciadau i Fyfyrwyr

This request has been closed to new correspondence from the public body. Contact us if you think it ought be re-opened.

Roedd y cais yn rhannol lwyddiannus.

Dear Student Loans Company Limited,
under the Freedom of Information Act 2000, please can you provide the following information:

1. Copies of any internal or external policy document that relates to or may be inferred to relate to the processing of social media data of applicants or students, as far back as any such practice began, and provide that date.

2. A copy of the single model privacy notice made available by SLC to any potential applicant for any type of funding (whether loan or maintenance grant) accessible through the SLC application that may have been relevant to the processing of personal data on social media as of
a) January 2017
b) January 2018
c) the date of receipt of this request

3. A single list of any and all types of social media / platform sources listed individually, (ie Facebook, Twitter) and any other third-party data sources (national or international) about individuals who may come under SLC scrutiny for the purposes of detection or prevention of fraud that
a) have been used or with the intent to use to scan personal data in such cases to date
b) might potentially be used, even if not already been so, given lack of account holding or available data.

4. A copy of any draft or live Data Protection or Privacy Impact Assessment for any such processing and /or profiling of individuals, or creation of infererred data about them from persoanl data available to you via their social media after May 25, 2018, and any Statutory Codes of Practice on Data Sharing to which you may adhere

5. The monetary amount(s) at or above which any applicant may be scrutinised and what types of payment and purposes they are intended (for example whether these are for maintenance loans, fees loans, and whether or not the student will enter into a process designed to begin recouping any of the money paid out.)

6. For how many individuals you currently hold any such personal data collected from, or inferred from the use of their social media accounts, or other third party sources (such as data brokers) and the planned retention period for such profiles, or data.

7. Correspondence with staff of the DfE, and OfS, between September 1, 2017 and September 1, 2018 regards policy on social media data sharing, or other information sharing matters. related to the Higher Education and Research Act 2017 or intended preparations for its related regulations (Cooperation and Information Sharing) 2018.

Thank you for your consideration.
Sincerely,

Jen Persson

SLC FOI Requests - Do Not Reply, Y Cwmni Benthyciadau i Fyfyrwyr

This is an automated response to let you know that your email has been
received by the Student Loans Company Limited ("SLC").

SLC's Freedom of Information Office is only able to deal with requests for
information under the Freedom of Information Act 2000 ("FOIA"). If your
email relates to a request for information under the FOIA, a separate
acknowledgement will be issued with a request reference.

If your email is in relation to a student finance application or account
enquiry, and you have provided sufficient details to identify your account,

your email will be passed to the relevant department. Alternatively,
please contact us using the contact details available at
https://www.slc.co.uk/contact.aspx.

If your email is not a customer enquiry then it has been passed to the
relevant department.

SLC's Freedom of Information Office is unable to advise response timescales

for other departments.

dangos adrannau a ddyfynnir

FOI Requests, Y Cwmni Benthyciadau i Fyfyrwyr

Dear Ms Persson

Thank you for your email dated 02/11/2018.

Your request is being considered under the terms of the Freedom of
Information Act 2000 (“FOIA”).

Your request has been allocated reference 244-18.

We will respond to you under the terms of the FOIA and within 20 working
days.

We will contact you further for clarification of your request if this is
considered necessary.  

Yours sincerely

Louise Chapman | Legal Executive
Student Loans Company
100 Bothwell Street, Glasgow G2 7JD
e: 32080  t: 0141 306 2080

[1]www.slc.co.uk
Follow us at [2]Twitter/SLCcomms for the latest corporate news and updates

dangos adrannau a ddyfynnir

References

Visible links
1. file:///tmp/www.slc.co.uk
2. file:///tmp/www.Twitter.com/SLCcomms

FOI Requests, Y Cwmni Benthyciadau i Fyfyrwyr

Dear Ms Persson

I refer to your recent email dated 02/11/2018 requesting the following
information under the Freedom of Information Act 2000 (“FOIA”):

"1. Copies of any internal or external policy document that relates to or
may be inferred to relate to the processing of social media data of
applicants or students, as far back as any such practice began, and
provide that  date.

2. A copy of the single model privacy notice made available by SLC to any
potential applicant for any type of funding (whether loan or maintenance
grant) accessible through the SLC application that may have been relevant
to the processing of personal data on social media as of
a) January 2017
b) January 2018
c) the date of receipt of this request

3. A single list of any and all types of social media / platform sources
listed individually,  (ie Facebook, Twitter) and any other third-party
data sources (national or international) about individuals who may come
under SLC scrutiny for the purposes of detection or prevention of fraud
that
a) have been used or with the intent to use to scan personal data in such
cases to date
b) might potentially be used, even if not already been so, given lack of
account holding or available data.

4. A copy of any draft or live Data Protection or Privacy Impact
Assessment for any such processing and /or profiling of individuals, or
creation of infererred data about them from persoanl data available to you
via their social media after May 25, 2018, and any Statutory Codes of
Practice on Data Sharing to which you may adhere[sic]

5. The monetary amount(s) at or above which any applicant may be
scrutinised and what types of payment and purposes they are intended (for
example whether these are for maintenance loans, fees loans, and whether
or not the student will enter into a process designed to begin recouping
any of the money paid out.)

6. For how many individuals you currently hold any such personal data
collected from, or inferred from the use of their social media accounts,
or other third party sources (such as data brokers) and the planned
retention period for such profiles, or data.

7. Correspondence with staff of the DfE, and OfS, between September 1,
2017 and September 1, 2018 regards policy on social media data sharing, or
other information sharing matters. related to the Higher Education and
Research Act 2017 or intended preparations for its related regulations
(Cooperation and Information Sharing) 2018."

Response
I have reviewed your request and in consultation with the appropriate
departments within SLC I have concluded that this information cannot be
released as the cost of complying with your request would exceed the
appropriate limit set out in the Freedom of Information and Data
Protection (Appropriate Limit and Fees) Regulations 2004.  The limit
applying to SLC is £450 or 2.5 days (calculated to be 18 hours of staff
time at £25 per hour).

The information is therefore exempt under section 12(1) of the FOIA and in
accordance with section 17(1) of the FOIA this letter constitutes a
Refusal Notice in respect of your request.

By way of explanation, your request is wide-ranging as it covers all
processing of social media data of student finance applicants/students for
all and any purposes.  Only question 3 makes reference to fraud prevention
and detection purposes.  SLC processes (or has processed) student finance
applicant/student social media data for a number of different purposes,
including:
·        fact verification for fraud prevention and detection purposes;
·        dealing with both public posts and private messages from social
media users (Student Finance England and Student Finance Wales customers
via Facebook and Twitter);
·        hosting Facebook Live Q&A sessions; and
·        responding to enquiries on The Student Room forum.

In addition, in relation to question 6 there is no account/system
indicator that would allow us to identify the individuals in question,
therefore a manual exercise would be required to be undertaken – this
alone would exceed 18 hours of staff time.  

Due to the wide-ranging nature of your request, if you were able to
refine/narrow your request to a particular type of processing, or indicate
a preference in terms of the questions to be answered, we would be in a
position to answer as many of your questions as possible up to the FOI
appropriate costs limit of £450, subject to any further statutory
exemptions applying.  Any refined request would be progressed as a new
request for information.

Internal review process

If you are dissatisfied with the handling of your request, you have the
right to ask for an internal review.

Internal review requests should be submitted within two months of the date
of receipt of the response to your original request and should be
addressed to the Freedom of Information Office, Student Loans Company
Limited, 100 Bothwell Street, Glasgow, G2 7JD,   Email:
[SLC request email].  Please remember to quote the reference number
above in any future communications.

If you are not content with the outcome of the internal review, you have
the right to apply directly to the Information Commissioner for a
decision.  The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House  
Water Lane  
Wilmslow  
Cheshire  
SK9 5AF

Yours sincerely

Louise Chapman | Senior Legal Executive
Student Loans Company
100 Bothwell Street, Glasgow G2 7JD
e: 32080  t: 0141 306 2080

[1]www.slc.co.uk
Follow us at [2]Twitter/SLCcomms for the latest corporate news and updates

dangos adrannau a ddyfynnir

References

Visible links
1. file:///tmp/www.slc.co.uk
2. file:///tmp/www.Twitter.com/SLCcomms

Dear Louise / FOI Requests,
I refer to my FOI request made on 02/11/2018 and your reply on December 3, 2018, with regards to the processing of social media data by the Student Loans Company.

Your response confirms that SLC processes (or has processed) student finance applicant/student social media data for a number of different purposes, including fact verification for fraud prevention and detection purposes.

Your response suggested that I might narrow the request. However it does not set out what
information can be provided within the appropriate limit, and is therefore not in accordance with section 16. However, I would be pleased to accept your suggestion to narrow the request rather than appeal.

As such, this request pertains only to fraud prevention and detection purposes, and the SLC Counter Fraud Service.

Given you mention a lack of electronic counting method, I therefore narrow the request further in Q6, for the purposes of assessing students who claim parental / guardian estrangement. I expect that this should also make the manual count, in relation to question 6, for the number of individuals about whom the SLC Counter Fraud Service currently stores any form of digital record assessment, created from social media accounts, very small.

1. SLC Counter Fraud Service Policy document: Copies of each SLC Counter Fraud Service policy document with regards to the processing of social media data of applicants or students, as far back as any such practice began, and should clearly indicate that date.

2. SLC Counter Fraud Service Privacy Notice: A copy of a potential three single model privacy notices made available by SLC to any potential applicant for any type of funding (whether loan or maintenance grant) accessible through the SLC application that may have been relevant to the processing of personal data on social media as of
a) January 2017
b) January 2018
c) the date of receipt of this request

3. SLC Counter Fraud Service Social Media in [Potential] Use List: A single list of any and all types of social media / platform sources listed individually, (ie Facebook, Twitter) and any other third-party data sources (national or international) about individuals who may come under SLC Counter Fraud Service scrutiny for the purposes of detection or prevention of fraud that:
a) have been used or with the intent to use to scan personal data in such cases to date
b) might potentially be used, even if not already been so, given lack of account holding or available data.

4. SLC Counter Fraud Service Risk Assessments: A copy of any draft or live Data Protection Assessment or Privacy Impact Assessment for any such SLC Counter Fraud Service processing and /or profiling of individuals, or creation of inferred data about them from personal data available to you via their social media after May 25, 2018, and any Statutory Codes of Practice on Data Sharing to which the SLC may adhere, for these purposes.

6. Total Number of Students under Estrangement related Scrutiny by the SLC Counter Fraud Service: For how many individuals the SLC Counter Fraud Service currently holds in digital format, any such personal data collected from, or inferred from the use of their social media accounts, or other third party sources (such as data brokers) and the planned retention period for such profiles, or data.
ie. This asks, for how many individuals the SLC Counter Fraud Service has processed social media in the past, and still holds, for example in any electronic folder on a shared drive for use by the service, only where under scrutiny related to familial estrangement.

7. SLC Counter Fraud Service comms: Correspondence with staff of the DfE, and OfS, between September 1, 2017 and September 1, 2018 regards policy on SLC Counter Fraud Service social media data sharing, or other information sharing matters, related to the Higher Education and Research Act 2017 or intended preparations for its related regulations (Cooperation and Information Sharing) 2018 for the purposes of fraud prevention and detection."

Since you suggested I may narrow my response, I ask that you reconsider a Refusal Notice and process this narrowed version of the request. I appreciate this may take a further 20 days and be treated to all reasonable intents, as a new request.

I would be grateful if you can provide any and all information, up to and not exceeding the request cost limits. Thank you for your consideration.

Sincerely,
Jen Persson

SLC FOI Requests - Do Not Reply, Y Cwmni Benthyciadau i Fyfyrwyr

This is an automated response to let you know that your email has been
received by the Student Loans Company Limited ("SLC").

SLC's Freedom of Information Office is only able to deal with requests for
information under the Freedom of Information Act 2000 ("FOIA"). If your
email relates to a request for information under the FOIA, a separate
acknowledgement will be issued with a request reference.

If your email is in relation to a student finance application or account
enquiry, and you have provided sufficient details to identify your account,

your email will be passed to the relevant department. Alternatively,
please contact us using the contact details available at
https://www.slc.co.uk/contact.aspx.

If your email is not a customer enquiry then it has been passed to the
relevant department.

SLC's Freedom of Information Office is unable to advise response timescales

for other departments.

dangos adrannau a ddyfynnir

FOI Requests, Y Cwmni Benthyciadau i Fyfyrwyr

Dear Ms. Persson,

Thank you for your email dated 3 December 2018.

Your request is being considered under the terms of the Freedom of
Information Act 2000 (“FOIA”).

Your request has been allocated reference number 285-18.

We will respond to you under the terms of the FOIA and within 20 working
days.

We will contact you further for clarification of your request if this is
considered necessary.

Yours sincerely,

Lucia Spadaro

Lucia Spadaro| Legal Executive
Student Loans Company
100 Bothwell Street, Glasgow G2 7JD

www.slc.co.uk
Follow us at Twitter/SLCcomms for the latest corporate news and updates

From: Jen Persson <[FOI #529948 email]>
To: FOI Requests <[SLC request email]>
Date: 03/12/2018 23:41
Subject: Re: Freedom of Information request - Student data sharing:
policies (SLC FOI ref 244-18)

Dear Louise / FOI Requests,
I refer to my FOI request made on 02/11/2018 and your reply on December 3,
2018, with regards to the processing of social media data by the Student
Loans Company.

Your response confirms that SLC processes (or has processed) student
finance applicant/student social media data for a number of different
purposes, including fact verification for fraud prevention and detection
purposes.

Your response suggested that I might narrow the request. However it does
not set out what
information can be provided within the appropriate limit, and is therefore
not in accordance with section 16. However, I would be pleased to accept
your suggestion to narrow the request rather than appeal.

As such, this request pertains only to fraud prevention and detection
purposes, and the SLC Counter Fraud Service.

Given you mention a lack of electronic counting method, I therefore narrow
the request further in Q6, for the purposes of assessing students who claim
parental / guardian estrangement. I expect that this should also make the
manual count, in relation to question 6, for the number of individuals
about whom the SLC Counter Fraud Service currently stores any form of
digital record assessment, created from social media accounts, very small.

1. SLC Counter Fraud Service Policy document: Copies of each SLC Counter
Fraud Service policy document with regards to the processing of social
media data of applicants or students, as far back as any such practice
began, and should clearly indicate that date.

2. SLC Counter Fraud Service Privacy Notice: A copy of a potential three
single model privacy notices made available by SLC to any potential
applicant for any type of funding (whether loan or maintenance grant)
accessible through the SLC application that may have been relevant to the
processing of personal data on social media as of
a) January 2017
b) January 2018
c) the date of receipt of this request

3. SLC Counter Fraud Service Social Media in [Potential] Use List: A single
list of any and all types of social media / platform sources listed
individually, (ie Facebook, Twitter) and any other third-party data
sources (national or international) about individuals who may come under
SLC Counter Fraud Service scrutiny for the purposes of detection or
prevention of fraud that:
a) have been used or with the intent to use to scan personal data in such
cases to date
b) might potentially be used, even if not already been so, given lack of
account holding or available data.

4. SLC Counter Fraud Service Risk Assessments: A copy of any draft or live
Data Protection Assessment or Privacy Impact Assessment for any such SLC
Counter Fraud Service processing and /or profiling of individuals, or
creation of inferred data about them from personal data available to you
via their social media after May 25, 2018, and any Statutory Codes of
Practice on Data Sharing to which the SLC may adhere, for these purposes.

6. Total Number of Students under Estrangement related Scrutiny by the SLC
Counter Fraud Service: For how many individuals the SLC Counter Fraud
Service currently holds in digital format, any such personal data collected
from, or inferred from the use of their social media accounts, or other
third party sources (such as data brokers) and the planned retention period
for such profiles, or data.
ie. This asks, for how many individuals the SLC Counter Fraud Service has
processed social media in the past, and still holds, for example in any
electronic folder on a shared drive for use by the service, only where
under scrutiny related to familial estrangement.

7. SLC Counter Fraud Service comms: Correspondence with staff of the DfE,
and OfS, between September 1, 2017 and September 1, 2018 regards policy on
SLC Counter Fraud Service social media data sharing, or other information
sharing matters, related to the Higher Education and Research Act 2017 or
intended preparations for its related regulations (Cooperation and
Information Sharing) 2018 for the purposes of fraud prevention and
detection."

Since you suggested I may narrow my response, I ask that you reconsider a
Refusal Notice and process this narrowed version of the request. I
appreciate this may take a further 20 days and be treated to all reasonable
intents, as a new request.

I would be grateful if you can provide any and all information, up to and
not exceeding the request cost limits. Thank you for your consideration.

Sincerely,
Jen Persson

dangos adrannau a ddyfynnir

FOI Requests, Y Cwmni Benthyciadau i Fyfyrwyr

19 Atodiad

Dear Ms Persson

I refer to your recent email dated 3^rd December 2018 requesting the
following information under the Freedom of Information Act 2000 (“FOIA”):

“1.  SLC Counter Fraud Service Policy document: Copies of each  SLC
Counter Fraud Service policy document with regards to the processing of
social media data of applicants or students, as far back as any such
practice began, and should clearly indicate that date.

2. SLC Counter Fraud Service Privacy Notice: A copy of a potential three
single model privacy notices made available by SLC to any potential
applicant for any type of funding (whether loan or maintenance grant)
accessible through the SLC application that may have been relevant to the
processing of personal data on social media as of
a) January 2017
b) January 2018
c) the date of receipt of this request

3. SLC Counter Fraud Service Social Media in [Potential] Use List: A
single list of any and all types of social media / platform sources listed
individually,  (ie Facebook, Twitter) and any other third-party data
sources (national or international) about individuals who may come under
 SLC Counter Fraud Service scrutiny for the purposes of detection or
prevention of fraud that:
a) have been used or with the intent to use to scan personal data in such
cases to date
b) might potentially be used, even if not already been so, given lack of
account holding or available data.

4. SLC Counter Fraud Service Risk Assessments: A copy of any draft or live
Data Protection Assessment or Privacy Impact Assessment for any such  SLC
Counter Fraud Service processing and /or profiling of individuals, or
creation of inferred data about them from personal data available to you
via their social media after May 25, 2018, and any Statutory Codes of
Practice on Data Sharing to which the SLC may adhere, for these purposes.

6. Total Number of Students under Estrangement related Scrutiny by the SLC
Counter Fraud Service: For how many individuals the SLC Counter Fraud
Service currently holds in digital format, any such personal data
collected from, or inferred from the use of their social media accounts,
or other third party sources (such as data brokers) and the planned
retention period for such profiles, or data.
ie. This asks, for how many individuals the SLC Counter Fraud Service has
processed social media in the past, and still holds, for example in any
electronic folder on a shared drive for use by the service, only where
under scrutiny related to familial estrangement.

7. SLC Counter Fraud Service comms: Correspondence with staff of the DfE,
and OfS, between September 1, 2017 and September 1, 2018 regards policy on
 SLC Counter Fraud Service social media data sharing, or other information
sharing matters, related to the Higher Education and Research Act 2017 or
intended preparations for its related regulations (Cooperation and
Information Sharing) 2018 for the purposes of fraud prevention and
detection."

Response

Having reviewed your request as a whole, and in consultation with the
appropriate departments within the Student Loans Company Limited (“SLC”),
I have concluded that the information that is held by SLC and which falls
within the scope of your request cannot be released as the cost of
complying with your request would exceed the appropriate limit set out in
the Freedom of Information and Data Protection (Appropriate Limit and
Fees) Regulations 2004.  The limit applying to SLC is £450 or 2.5 days
(calculated to be 18 hours of staff time at £25 per hour).

The information is therefore exempt under section 12(1) of the FOIA and in
accordance with section 17(1) of the FOIA this letter constitutes a
Refusal Notice in respect of your request.

By way of explanation, questions  6 and 7 both separately would exceed 18
hours of staff time to answer.  

By way of advice and assistance we have responded to all other questions
and provided further detail on question 6 below.  Please find below our
responses to each of your questions (our numbering uses the same numbering
as your original questions, although we note that there is no question 5).

Question 1 – Counter Fraud Services (“CFS”) policy relating to the
processing of social media data
A CFS policy covering the processing of social media data of
applicants/students is not currently held by SLC.  A company-wide Social
Media Policy which focuses on staff use of social media both personally
and via SLC’s corporate social media sites is held, and this is attached
below.  Please note that the names of staff who have reviewed or updated
this document below Executive Leadership Team level have been redacted
under section 40(2) of the FOIA.  The staff names are considered to
constitute their personal data and we have therefore decided that the
disclosure of this personal information is subject to the exemption under
section 40(2) of the FOIA (by virtue of section 40(3A) and 40(3B). If the
disclosure of the personal data would contravene any of the eight data
protection principles contained within the Data Protection Act 2018 (“DPA
2018”) the exemption under section 40(3A) and 40(3B) of the FOIA will
apply.  It is unlikely that it would be within the expectations of the
individuals concerned that their names would be put into the public
domain.  It is considered unfair to the named individuals to release
information which could be used to identify them.  Therefore disclosure
would be in contravention of the principles of the DPA 2018 which requires
personal data to be processed lawfully and fairly and the exemption under
section 40(2) of the FOIA applies.  I can advise that the Social Media
Policy is in the process of being updated to call out the specific use of
Open Source data as part of an investigation by CFS staff.

SLC is wholly owned by the Secretary of State for Education and the
Devolved Administrations and administers the policies set by them under
the relevant legislation and associated regulations.  The role of the SLC
is to administer student finance on behalf of the UK Government and the
Devolved Administrations.   SLC is issued with an Annual Performance and
Resource Agreement (“APRA”) for the year setting out priorities,
objectives and performance measures for the company. One of the key
objectives each year is to minimise, detect and deter fraud.  Best
endeavours have been made by SLC to build in the necessary rights and
protections to allow SLC to perform its duties and fulfil its applicable
data protection obligations. This included by way of example without
limitation:
• the Student Data Protection Statement (“DPS”) (pre- 25^th May 2018) and
Privacy Notice (post- 25^th  May 2018) which explain that an applicant’s
information may be used to detect and prevent fraud and/or money
laundering; and
• the Student Finance Declaration explaining the applicant’s obligations
and the conditions that may trigger withdrawal of funding.

Question 2 – Counter Fraud Services Privacy Notice
Specific CFS Privacy Notices are not, and have not ever been, held by SLC.
 Fraud prevention and provisions can be found in SLC’s (pre-25th May 2018)
DPSs and (post-25^th May 2018) Privacy Notice as follows:

Prior to 25^th May 2018 separate DPSs existed as follows:
·        Student Finance England students and sponsors
·        Student Finance Wales students and sponsors
·        Student Finance Northern Ireland students and sponsors
·        EU students and sponsors
·        Postgraduate Master’s Loans (for England, Wales and Northern
Ireland)

DPSs were released on an academic year (“AY”) basis at the application
cycle launch.  

All DPSs that were available in January 2017 and January 2018 are attached
below.  In January 2017 the AY 2017/18 application cycle had not yet
launched, therefore it would be the AY 2016/17 DPSs that were available.
 In January 2018 the AY 2018/19 application cycle had not yet launched,
therefore it would be the AY 2017/18 DPSs that were available.

From 25^th May 2018 onwards, including as at the date of your request,
there has been a single Privacy Notice for all domiciles and products
which is publicly available on SLC’s website -
[1]https://www.slc.co.uk/about-us/privacy-n....  Specific
references to fraud prevention and detection can be found throughout.  

With regard to the ability to use information provided by any
student/applicant, we clearly explain to applicants that their data will
be used to process the application and to detect and prevent fraud and/or
money laundering.  We do not expressly identify that social media may be
used, nor are we required to do so.  I have included the relevant text
from the 2017/18 Student Declaration Form and DPS in Annex A attached
below.  Similar text can be found in the 2018/19 Student Declaration Form
 (available online at
[2]http://media.slc.co.uk/sfe/1819/ft/sfe_p... - pages 25
and 26) and the current Privacy Notice makes a number of references to
data being processed for fraud prevention and detection purposes,
including:

“We may use also your personal information for the following purposes:

·        to detect, investigate and prevent crime including fraud;”

SLC’s current Privacy Notice is also being updated to include specific
reference to the potential processing of publicly available Open Source
information for fraud prevention and detection purposes.  The updated
Privacy Notice will be made publicly available in early 2019.

Question 3 - Fraud Service Social Media in [Potential] Use List
CFS Teams have access to a number of social media sites including
Facebook, Twitter, LinkedIn, Instagram and My Space.  There is, however,
no definitive list available to share.  Open Source information is used as
and when necessary as part of an investigation.

Question 4 – Data Protection Impact Assessments (“DPIAs”)
A copy of the post-25^th May 2018 live DPIA on CFS’s use of social media
data is attached below.  Staff names other than SLC’s Head of Counter
Fraud Services have been redacted under section 40(2) of the FOIA for the
same reasons as set out in our response to question 1 above.

In terms of Codes of Practice, we would use the ICO Data Sharing Code of
Practice
([3]https://ico.org.uk/media/for-organisatio...)

Question 6 (no question 5)
As stated above, this question alone would exceed 18 hours of staff time.
 150 cases formed part of the estrangement exercise undertaken in January
2018.  There is currently no system flag to extrapolate this information
and all accounts and case notes would need to be checked individually to
establish which were checked against Open Source information.  .  

I can confirm that CFS case retention is in line with company policy,
however where fraud has been identified we would hold for 6 years and if a
customer was to apply for student finance again within that time previous
conduct would be taken into consideration.  

Question 7  - Counter Fraud Service communications with the Department for
Education  and Office for Students
To search for relevant communications would also exceed 18 hours of staff
time.  
       
Internal review process

If you are dissatisfied with the handling of your request, you have the
right to ask for an internal review.

Internal review requests should be submitted within two months of the date
of receipt of the response to your original request and should be
addressed to the Freedom of Information Office, Student Loans Company
Limited, 100 Bothwell Street, Glasgow, G2 7JD, or email:
[SLC request email].  Please remember to quote the reference number
above in any future communications.

If you are not content with the outcome of the internal review, you have
the right to apply directly to the Information Commissioner for a
decision.  The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House  
Water Lane  
Wilmslow  
Cheshire  
SK9 5AF

Yours sincerely

Louise Chapman | Senior Legal Executive
Student Loans Company
100 Bothwell Street, Glasgow G2 7JD
e: 32080  t: 0141 306 2080
[4]www.slc.co.uk
Follow us at [5]Twitter/SLCcomms for the latest corporate news and updates

dangos adrannau a ddyfynnir

References

Visible links
1. https://www.slc.co.uk/about-us/privacy-n...
2. http://media.slc.co.uk/sfe/1819/ft/sfe_p...
3. https://ico.org.uk/media/for-organisatio...
4. file:///tmp/www.slc.co.uk
5. file:///tmp/www.Twitter.com/SLCcomms