BU UCU is seeking urgent clarification from the University Executive Team (UET) regarding the current staff survey process they commissioned from an external marketing company, following serious concerns raised by members about confidentiality, data-sharing, and the ability to withdraw personal data from the process.

Earlier this month, the branch formally requested that BU and the external marketing company provide a mechanism allowing staff to withdraw their survey responses and associated data prior to processing and institutional reporting.

This request followed concerns raised by members regarding confidentiality within focus groups and the wider handling of staff information during the survey process.

Since then, the branch has been informed of a potentially much more serious issue.

A member who requested a copy of their data from the external marketing company reports that the information returned to them included not only their survey responses, but also more than 50 demographic and employment-related datapoints which the external marketing company stated had been university-provided.

According to the member, the data included information relating to disability status, sexual orientation, religion, ethnicity, marital status, long-term absence flags, grade, and other personal characteristics.

This appears to indicate that substantial staff demographic data (including potentially special category personal data) has been shared externally by the university with the survey provider.

At present, it is unclear:

• what lawful basis was relied upon for sharing this data
• whether staff were clearly informed this data would be shared externally
• whether staff were given meaningful opportunity to object or withdraw
• what safeguards are in place regarding retention, access, analysis, and deletion of the data

Many staff may reasonably have assumed that participation in the survey involved providing responses directly within the survey platform itself. Members have expressed concern that they were not aware wider demographic datasets may already have been linked to their records and supplied externally by the university.

BU UCU is also concerned that members who have attempted to withdraw their data have faced uncertainty regarding whether withdrawal is possible at all.

The branch has therefore reiterated its request that staff be provided with a clear process allowing withdrawal of survey data before analysis and institutional reporting take place.

Separately, BU UCU has also raised concerns regarding:

• reports that identifiable comments from focus groups may have been shared with the university despite expectations of confidentiality
• the use of repeated pop-up prompts and external survey links on university-managed devices despite routine staff cybersecurity guidance advising caution around such practices
• growing damage to staff confidence in the independence and integrity of the process

BU UCU has now formally requested clarification from UET regarding:

• what categories of staff data were shared with the external marketing company
• the legal basis relied upon for that sharing
• what staff were told about the process
• whether staff can withdraw their data
• what confidentiality and data-protection safeguards are in place

We believe these concerns require urgent attention in order to restore staff confidence and ensure transparency around the handling of personal data.

Members who have concerns regarding their own data, confidentiality, or withdrawal rights are encouraged to contact the branch via the General Reporting Form. Members may also wish to contact the external marketing company directly via information in the many emails and pop-ups they have foisted upon staff to request information relating to their own data.

We will continue to update members as further information becomes available.

In solidarity,

BU UCU