Keeping secrets

Today’s reporting of the data protection leak at the University of Greenwich highlights the issues around information security for universities.

The BBC report is not explicit, but it seems that the papers for a university research committee were published on the university’s website, and that these papers included personal data relating to students.

There are disappointingly few
 files like this in most university offices

This highlights the twin pressures universities face in relation to information. On the one hand, the Information Commissioner expects universities to proactively publish lots of information, and this would include committee minutes and papers. On the other hand, universities – like all other bodies – have very clear responsibilities to properly protect personal data. Which would include not publishing it on the web.

Universities are habitually collegiate places. And despite their scale – and some are very large indeed – many decisions are people decisions, meaning that the collegiate bodies which take decisions have to have personal information in front of them. So they have to deal with personal data – and sometimes sensitive personal data – within a notionally public context.

Universities typically have procedures in place to square this circle – classifying papers in accordance with FoI schemes, so that when written, authors think about whether it should be disclosed. And then the papers are published or withheld depending on judgments made. This is, I expect, how the Greenwich situation occurred – a mis-classification, or a correct classification which slipped through the net. Or in fact slipped onto the net.

Some universities – notably the Russell Group – have been campaigning for exemption from the Freedom of Information Act. That argument is made more sharply in relation to research and the commercialisation of research, where the exemptions available under FoI legislation have, universities argue, been found wanting.

At heart this is a question of autonomy, and the extent to which universities are public bodies. Universities have autonomy because that enables them to be better universities. But autonomy doesn’t place them outside the law. The balance to be struck is between removing some of the nonsensical FoI burden – Paul Greatrix is always good value for money on this – whilst enabling public accountability.

If it were down to me, I’d happily see some tightening of FoI exemptions for universities around research, to help protect intellectual property and enable collaboration with industry, but in general openness is a good. A complete exemption will remove the sunlight from university business, and without that disinfectant things won’t always be as clean as one would like.

High finance

Are you sitting comfortably? Good. Then I’ll begin.

Once upon a time universities in the UK were funded by the state, through an arms-length body which was fairly non-interventionist, and received money to cover every-day operating costs and salaries, and money for building projects and other capital costs. Polytechnics and higher education colleges were funded by the state too, though in their case it was through local authorities and later an arms-length body. There was money to give students grants, too, so that they could afford to study instead of work.

More people started to go to university, and polytechnics and colleges got called universities too, but the amount of money they received didn’t keep up with the extra costs. The arms-length body invented some very clever ways to get universities to do a great amount more for a little extra more, and then tell them that it wasn’t a one-off effort, but the new normal. And so, especially in the former polytechnics, resource got stretched very thin. There was still money for recurrent costs and capital, but less than it used to be, given the extra students they were teaching. And the money, being thinly spread by the state, meant that there was less to fund students during their study.

Everyone saw that this couldn’t last. And so after much deliberation a scheme was agreed to ask students to pay towards the cost of their study, and a fund was set up so that students could borrow, at a reasonable rate, to support themselves whilst at university. Did this work? Not really. More and more people went to university; students continued to struggle to pay for their time at university; universities struggled to put in place good facilities; and class sizes went up. It wasn’t right. Another think was needed.

And so another think happened: and this time universities were allowed to charge a lot more in fees, and a much bigger fund was put in place, so that they could borrow to do this. But the government allowed universities to charge higher fees than they had budgeted for, and so paying for the bigger fund meant that universities received less and less in grants, both for particular annual costs and for capital projects. And the whole thing was still too expensive …

It isn’t much of a story, I know, but put some detail in and it’s not far off a history of UK higher education funding since the 1970’s. I haven’t taken up a creative writing course – don’t worry! – the point of this is to illustrate why universities are taking to borrowing money.

The UK HE sector has moved from being directly publicly funded to being publicly funded via a market mechanism. That is, most home tuition fee income comes via the Student Loans Company, which is definitely public money, but depends upon students actually choosing to go to the university in question. This is life and death for some universities, and for all it is critical in determining how much resource there is to spend. Student recruitment matters more than ever, and universities therefore like to present their best face – hence the need for investment in facilities, in staff and so on. Additionally, investment requires a stock of money; tuition fee income comes in flows. So a pile of borrowed cash, which can then be re-payed over time, makes a lot of sense.

There’s two other lessons to be learned from this, which arise from how universities are going about their borrowing.

Universities are borrowing in new ways. Yesterday for instance, Cardiff University announced it had issued a bond worth £300m, at a historically low rate of interest (there may be a paywall on this link, sorry). Other universities have issued bonds too: Liverpool (£250m), Manchester (£300m), Cambridge (£350m) and De Montfort (£110m) – this isn’t an exhaustive list.

Bond issues are long term – 30, 40 or 50 years, typically. Universities pay interest annually on the amount borrowed, and at the end of the period are liable to repay the whole amount. The interest rates are low at the moment – Cardiff is paying 3.1% on its borrowing, meaning that it must repay interest at £9.3m per year – but this will be cheap, particularly if, or when, inflation rates rise. Cardiff gets this low rate because it is regarded as a very safe investment – rated as Aa2 by Moody’s, which means it is regarded as “high quality and … subject to very low credit risk“.

And this leads on to the two other important things about university management which I hinted at.

Firstly, if you’re committed to repaying a lot every year – remember the £9.3m per year that Cardiff is signed-up to – you need to be sure that you can afford it. And that means that the investments you make from the capital need to show a return – additional students with additional fee income; more research grants with additional overheads; reduced operating costs with actual savings in expenditure. These conversations already happen in universities, but they’ll be a little sharper where there’s a loan repayment in mind. And in the larger universities, where perhaps there’s been a little more slack in the past, things will tighten up.

Secondly, stability is the watchword. The low interest rates achieved by universities (you’d bite the hands off a bank offering a fixed-rate mortgage at 3.1% for 40 years) only come about because of the very good credit rating they receive – the Aa2 in Cardiff’s case. This is based on an assessment of the long term risk that the university won’t pay the debt. A more unstable funding scenario doesn’t necessarily mean that loans won’t be available, but they do affect the interest rate. So uncertainties about fee levels, student number caps, research funding, all contribute to difficulties in other universities getting such good rates.

I don’t imagine that many university senior managers started their careers thinking that they’d be engaging in high corporate finance, but it’s an inevitability given the move to the market that we’ve seen. The universities that do best will be those that become the sort of organisations that can deliver in a good business-like way without changing their core values. And they’ll all live happily ever after.