Privacy Notice for Online lectures and meetings

Staff at Manchester Metropolitan University (The University) often deliver meetings and lectures to colleagues, students and third parties external to the University online. On occasion these sessions are recorded. The University is the Controller in respect of any personal data processed during these sessions. This notice provides further information about the process of participating in one of these sessions, and also addresses instances where these sessions are recorded.

The personal data we process

We will always consider the privacy of the attendees and will only record online meetings and lectures where there is a recognised benefit in doing so. We will consider ways of reducing risk to your privacy and will offer alternatives where we are able.

By nature, the type of personal data will vary depending on the type of session being delivered. We will of course never record sessions of a confidential nature such as disciplinary meetings, grievances, one-to-one sessions or anything that is likely to contain sensitive information. Depending on how the meeting is held, the processing and/or recoding may include audio (via microphone) or video (via webcam footage) of the attendees and a list of all attendees including any in-meeting chat functions, which is likely considered to be personal data under data protection laws. Any contributions you make to the session may also be personal data.

Our lawful basis for processing such data will vary depending on the nature of the meeting. For example, lectures, tutorials and academic discussion groups will be run and recorded under ‘public task’ for the student attendees, and ‘contract’ for the staff member or external guest speaker delivering. Team meetings between University staff and other individuals are conducted under ‘contract’ or ‘legitimate interests’. For this reason, you will not be asked to give your formal consent prior to joining the session, even in instances where the session is being recorded. Out of courtesy, the staff member delivering the session may ask for your ‘informed consent’, but this is not required to meet the threshold of the lawful basis of consent under the data protection legislation.

Can I opt out of having my personal data recorded or processed?

If you would not like to be recorded or have certain details shared, please ensure your microphone and video camera are muted and switched off. Alternatively, if you do need to ask a question and are unable to do this anonymously during a recording (for example, through an anonymous chat message), you can ask the staff member to edit out the section where you spoke or were recorded, or ask them to pause the recording. They will consider your request, and satisfy this where it is reasonable to do so. Where the session is recorded, it is recommended that you do not contribute to the session if you would not like to be recorded or that you raise any concerns about the recording prior to the session taking place. Staff members are encouraged to offer ‘recording breaks’ in recorded sessions to allow audience members to contribute without being recorded, however, these may not always be provided.

To request erasure of a recording, please contact the recording owner (the staff member who delivered the session).

How is information stored and shared?

How the recordings are stored will depend on the platform being used by the member of staff. Meetings and lectures delivered on Microsoft Teams will be stored securely on Microsoft Stream (cloud storage). Recordings may also be stored locally on MMU’s servers (such as in Moodle, MMUtube, OneDrive or SharePoint) and shared with relevant individuals (i.e. members of the teaching class or professional team).

Recordings will be retained for as long as it is necessary in accordance with the University’s Retention and Disposal Schedule. Specifically, video content will be automatically retained on Microsoft Cloud storage for 21 days from the date of recording, after which point they will be deleted or moved to local storage for a minimum of 12 months (for example, to Stream, Moodle or MMUtube). Recordings of taught online sessions will be retained for up to the duration of the academic course in question (i.e. a maximum of 3 years from the end of the academic year in which it was recorded), and meeting content for current year plus one year.

Any information on Microsoft Chat (i.e. the messaging function available on teams) is stored for a period of 12 months; this includes messages that the poster ‘deletes’ from the feed. If you share a file through Teams, it will be stored on any linked OneDrive or SharePoint site, and retention will be managed locally by the site owner.

Micosoft act as a processor to MMU in the provision of storage solutions associated with Teams. All sharing is conducted under contract, in a manner compliant with the GDPR.

 Your rights in respect of the processing

The GDPR provides data subjects with the following data subject rights:

• The right to be informed – this privacy notice assists with fulfilling these obligations.
• The right of access.
• The right to rectification.
• The right to erasure.
• The right to restrict processing
• The right to data portability
• The right to object

Please note, that these rights apply in certain circumstances, for example according to the lawful basis utilised by the University. The right of access to personal information held about you exists in order to be aware of, and verify, the lawfulness of the processing. Please use the contact information below to exercise these rights.

Contacting us

For questions or concerns about this Privacy Notice, or our use of your personal information, please contact the relevant academic member of staff in the first instance.

Our Data Protection Officer can also be contacted using dataprotection@mmu.ac.uk, by calling 0161 247 3884 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority in respect of the processing of your personal data. We would encourage you to expend our internal complaints procedure through our initial contact and the University Data Protection Officer, prior to contacting the ICO. Please contact: casework@ico.org.uk or telephone: 0303 123 1113. For any further contact information please see: https://ico.org.uk/global/contact-us/.

Updates to this privacy notice

We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

This Privacy Notice explains who we are, how and why we collect and use personal information about you, what personal data is collected and held about you when students use the NewRow virtual classroom software, our purposes and lawful bases for processing, who we share your personal data with, relevant retention periods, and how you can exercise your privacy rights.

This notice provides information that is in addition to information contained in the University’s main student privacy notice. Please do read this notice to understand our practices and if you have any questions please contact us using the contact details provided below.

Who we are

Throughout this notice, “University”, “we”, “our” and “us” refer to the Manchester Metropolitan University, an exempt charity under Schedule 2 to the Charities Act 1993 (amended by the Charities Act 2011). The University is the Data Controller in respect of the personal data you provide when using NewRow.

The University is registered as a Controller with the Information Commissioner’s Office (ICO). We manage personal data in accordance with the General Data Protection Regulation (GDPR) and the University’s Data Protection Policy.

The personal data we process

We collect and process certain data about you. This includes :

• Your full name
• Any contributions you make to the online session (either a ‘webinar’* session, or ‘virtual classroom’** session).

*The webinar sessions are generally used for larger groups (usually up to 100 audience members). When you enter a webinar session, your name will be displayed as being in attendance, which is available to all, and you are able to use the text-chat function. You will not be granted ‘live stage’ – i.e. for audio or video input to all other audience members automatically, however, the leading academic can invite you to contribute in this way.

**The virtual classroom sessions tend to be used for smaller groups, and you will automatically be added to allow audio and video input which the whole group can see and hear. The application will ask you if you wish to activate your microphone and web camera before joining. You will also have access to the text-chat function. Everyone in the classroom will be able to see who is in attendance.

The purposes of the processing

We rely on ‘public interest’ to process your data in the following way:

• In the real-time use of the software, your name will be visible to all participants, as will any inputs you choose to give. This can be by text-chat, audio or web camera. There are also other interactive functions such as ‘whiteboard’ and quizzes, where inputs may be visible to participants and to the presenter.
• Academics are able to record sessions, which will capture any inputs you make as a participant. The recording will be stored on MMUtube and made available to relevant students (i.e. students registered on the course). If the academic intends to share beyond this, they will make this clear to you. The academic will inform participants when they intend to record, and a notification will display on your screen when recording is about to take place, and when it is occurring. If you have any concerns about this, please make this known to the academic.
• Information about student and academic engagement with the software may be reviewed by MMU evaluation teams. This data will include attendance figures and session times. The data may be used to alert academics to instances where a student is not engaging with course content, which will allow the University to offer further support and guidance to that individual.

The recipients or categories of recipients of the personal data

We may disclose personal data about you to the following third parties:

• Other students and academic members of staff where there is a recognised requirement to do so.
• MMU evaluation teams to review engagement with the relevant course.

Data retention

Your personal data will only be retained for as long as it is necessary in accordance with the University’s Retention and Disposal Schedule. Specifically, we will retain recordings for the duration of the academic course in question (i.e. for a maximum of 3 years from the end of the academic year in which it was recorded).

Your rights in respect of the processing

The GDPR provides data subjects with the following data subject rights:

The right to be informed – this privacy notice assists with fulfilling these obligations.

• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object

Please note, that these rights apply in certain circumstances, for example according to the lawful basis utilised by the University. The right of access to personal information held about you exists in order to be aware of, and verify, the lawfulness of the processing. Please use the contact information below to exercise these rights.

 Contacting us

For questions or concerns about this Privacy Notice, or our use of your personal information, please contact the relevant academic member of staff in the first instance.

Our Data Protection Officer can also be contacted using dataprotection@mmu.ac.uk, by calling 0161 247 3884 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.

 Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority in respect of the processing of your personal data. We would encourage you to expend our internal complaints procedure through our initial contact and the University Data Protection Officer, prior to contacting the ICO. Please contact: casework@ico.org.uk or telephone: 0303 123 1113. For any further contact information please see: https://ico.org.uk/global/contact-us/.

Updates to this privacy notice

We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

This Privacy Notice explains who we are, how and why we collect and use personal information about you, what personal data is collected and held about you as an academic when you use the NewRow virtual classroom software. It also explains our purposes and lawful bases for processing, who we share your personal data with, relevant retention periods, and how you can exercise your privacy rights.

This notice provides information that is in addition to information contained in the University’s main staff privacy notice. Please do read this notice to understand our practices and if you have any questions please contact us using the contact details provided below.

Who we are

Throughout this notice, “University”, “we”, “our” and “us” refer to the Manchester Metropolitan University, an exempt charity under Schedule 2 to the Charities Act 1993 (amended by the Charities Act 2011). The University is the Data Controller in respect of the personal data you provide when using NewRow.

The University is registered as a Controller with the Information Commissioner’s Office (ICO). We manage personal data in accordance with the General Data Protection Regulation (GDPR) and the University’s Data Protection Policy.

The personal data we process

We collect and process certain data about you. This includes :

• Your full name
• Any contributions you make via the online session (either a ‘webinar’* session, or ‘virtual classroom’** session).

*The webinar sessions are generally used for larger groups (usually up to 100 audience members). When you enter a webinar session, your name will be displayed as presenting, which is available to all participants. You are automatically granted ‘live-stage’, where all participants will be able to see and hear you (depending on whether you have activated your microphone and or web camera).

 **The virtual classroom sessions tend to be used for smaller groups. You are automatically granted live stage, along with the other participants. The application will ask you if you wish to activate your microphone and web camera before joining. You will also have access to the text-chat function. Everyone in the classroom will be able to see who is in attendance.

The purposes of the processing

We rely on the lawful basis ‘public task’ when processing personal data in the following ways:

• In the real-time use of the software, your name will be visible to all participants, as will any inputs you choose to give. This can be by text-chat, audio or web camera. There are also other interactive functions such as ‘whiteboard’ and quizzes, where inputs may be visible to participants.
• If the session is recorded, the recording will be stored on your private page in MMUtube. You are able to make the recording available to relevant students (i.e. students registered on the course). If you intend to share beyond this, you should make this clear to the participants. You should inform participants when you intend to record.
• Information about student and academic engagement with the software may be reviewed by MMU evaluation teams. This data will include attendance figures and session times, which may be considered to be personal data. The information is used to review the success of the software and to review usage by students and staff members.

The recipients or categories of recipients of the personal data

We may disclose personal data about you to the following third parties:

• Other students and academic members of staff where there is a recognised requirement to do so.
• MMU evaluation teams to review engagement with the relevant course.
• To our contracted Processor, Kaltura. Kaltura host ‘Kaltura Capture’ and ‘NewRow’, and store any recorded information in cloud servers based in America. As the privacy legislation in place in America has not been assessed as being ‘adequate’ by the UK, Man Met have conducted an appropriate risk assessment to ensure there is an adequate level of protection in place for your data. There is also an International Data Transfer Agreement in place.

Data retention

Your personal data will only be retained for as long as it is necessary in accordance with the University’s Retention and Disposal Schedule. Specifically, we will retain recordings for the duration of the academic course in question (i.e. for a maximum of 3 years from the end of the academic year in which it was recorded).

Your rights in respect of the processing

The GDPR provides data subjects with the following data subject rights:

The right to be informed – this privacy notice assists with fulfilling these obligations.

• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object

Please note, that these rights apply in certain circumstances, for example according to the lawful basis utilised by the University. The right of access to personal information held about you exists in order to be aware of, and verify, the lawfulness of the processing. Please use the contact information below to exercise these rights.

Contacting us

For questions or concerns about this Privacy Notice, or our use of your personal information, please contact you line manager in the first instance.

Our Data Protection Officer can also be contacted using dataprotection@mmu.ac.uk, by calling 0161 247 3884 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority in respect of the processing of your personal data. We would encourage you to expend our internal complaints procedure through our initial contact and the University Data Protection Officer, prior to contacting the ICO. Please contact: casework@ico.org.uk or telephone: 0303 123 1113. For any further contact information please see: https://ico.org.uk/global/contact-us/.

Updates to this privacy notice

We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

Lecture Capture is the live recording of a teaching session that can be then be shared with students to enhance their learning experience at Manchester Metropolitan. It is in use within several rooms across the university campus. The University is the Controller in respect of any personal data processed during these recordings. This notice provides further information about this process.

The personal data we process

We will always consider the privacy of the attendees and our staff and we will only record lectures where there is a recognised benefit in doing so. We will consider ways of reducing risk to your privacy and will offer alternatives where we are able.

The Lecture Capture platform we use is called Echo360. The software records what is displayed on the projector, along with the audio from the room. The audio is captured through the presenter’s microphone, and through the several boundary microphones located at various points in the room. This means that any contributions that audience members make during the session when the recording is active will be captured. This audio is likely considered to be personal data under data protection laws. Our lawful basis for processing such data is that it is required for reasons of ‘public task’.

Staff will always make students aware that Lecture Capture is in use prior to the recording starting. There will also be signs on the doors of the rooms where it is installed, and there will be a red recording light on the lectern indicating that the capture has commenced. Staff and guest speakers are informed of the intention to record a Unit in advance of the session. Guest speakers will be asked to sign an informed consent form prior to the session taking place.

 Can I opt out of having my personal data recorded?

If you are a member of the audience and would not like to be recorded, it is advised that you do not contribute to the session when the recording is taking place. If you are concerned that this may impact your learning experience, please raise the issue with the presenting staff member prior to the session taking place. We encourage presenters to initiate recording breaks throughout the session and to make these known to the audience in their opening remarks; this will give audience members an opportunity to contribute without being recorded. Please note that it may not be possible for recoding breaks to be offered in all sessions. Alternatively you can ask the staff member to edit out the section where you spoke and were recorded, or ask them to pause the recording. They will consider your request, and satisfy this where it is reasonable to do so.

Presenting staff members are given an opportunity to opt out of the use of Lecture Capture prior to the Unit being taught. Guest speakers are asked if they would like to opt-in to recordings being taken by signing the informed consent form.

To request erasure of a recording, please contact the recording owner (the staff member who delivered the session or the Unit leader).

How are the recordings stored and shared?

These captures will automatically be published to all students registered on the unit via the University’s Virtual Learning Environment after 2 working days if the unit leader has opted-in to this method of automatic upload.  If the Unit has not been opted-in to automatic publish, the lecturer may choose at their absolute discretion to make each capture available to all students registered on the unit via the University’s VLE.

Recordings will be retained for as long as it is necessary in accordance with the University’s Retention and Disposal Schedule. Specifically, recordings made by Lecture Capture will be retained for the duration of the academic course in question (i.e. for a maximum of 3 years from the end of the academic year in which it was recorded).

We use an external company called Echo360 to provide the Lecture Capture service. In providing this service, Echo360 will have access to personal data as described above for support reasons. They are acting as a data processor on behalf of the University.

  Your rights in respect of the processing

 The GDPR provides data subjects with the following data subject rights:

The right to be informed – this privacy notice assists with fulfilling these obligations.

• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object

Please note, that these rights apply in certain circumstances, for example according to the lawful basis utilised by the University. The right of access to personal information held about you exists in order to be aware of, and verify, the lawfulness of the processing. Please use the contact information below to exercise these rights.

 Contacting us

For questions or concerns about this Privacy Notice, or our use of your personal information, please contact the relevant academic member of staff in the first instance.

Our Data Protection Officer can also be contacted using dataprotection@mmu.ac.uk, by calling 0161 247 3884 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority in respect of the processing of your personal data. We would encourage you to expend our internal complaints procedure through our initial contact and the University Data Protection Officer, prior to contacting the ICO. Please contact: casework@ico.org.uk or telephone: 0303 123 1113. For any further contact information please see: https://ico.org.uk/global/contact-us/.

 Updates to this privacy notice

We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.