Keeping secrets

Today’s reporting of the data protection leak at the University of Greenwich highlights the issues around information security for universities.

The BBC report is not explicit, but it seems that the papers for a university research committee were published on the university’s website, and that these papers included personal data relating to students.

There are disappointingly few
 files like this in most university offices

This highlights the twin pressures universities face in relation to information. On the one hand, the Information Commissioner expects universities to proactively publish lots of information, and this would include committee minutes and papers. On the other hand, universities – like all other bodies – have very clear responsibilities to properly protect personal data. Which would include not publishing it on the web.

Universities are habitually collegiate places. And despite their scale – and some are very large indeed – many decisions are people decisions, meaning that the collegiate bodies which take decisions have to have personal information in front of them. So they have to deal with personal data – and sometimes sensitive personal data – within a notionally public context.

Universities typically have procedures in place to square this circle – classifying papers in accordance with FoI schemes, so that when written, authors think about whether it should be disclosed. And then the papers are published or withheld depending on judgments made. This is, I expect, how the Greenwich situation occurred – a mis-classification, or a correct classification which slipped through the net. Or in fact slipped onto the net.

Some universities – notably the Russell Group – have been campaigning for exemption from the Freedom of Information Act. That argument is made more sharply in relation to research and the commercialisation of research, where the exemptions available under FoI legislation have, universities argue, been found wanting.

At heart this is a question of autonomy, and the extent to which universities are public bodies. Universities have autonomy because that enables them to be better universities. But autonomy doesn’t place them outside the law. The balance to be struck is between removing some of the nonsensical FoI burden – Paul Greatrix is always good value for money on this – whilst enabling public accountability.

If it were down to me, I’d happily see some tightening of FoI exemptions for universities around research, to help protect intellectual property and enable collaboration with industry, but in general openness is a good. A complete exemption will remove the sunlight from university business, and without that disinfectant things won’t always be as clean as one would like.

More fun with the NSS

The NSS data - about which I posted earlier this week - allows you to compare specific universities. I've analysed the data to show how the different university mission groups compare over the last six years.

For each mission group I've calculated the mean satisfaction score for each year across the mission group's members, unweighted by the number of students at each institution. The 'satisfaction score' is the proportion of students who agreed with the statement 'Overall, I am satisfied with the quality of my course' (Question 22 of the NSS.)  The mission group membership for each year is that at August 2015 - that is, I haven't taken account of historic changes, such as the addition of four members to the Russell Group in 2012.

Although there are clearly differences between the mission groups, with sustained differences over time, its important to recognise that the data show a large amount of satisfaction whatever the mission group - scores range in 2015 from 85% satisfaction to 89% satisfaction. Although every Vice-Chancellor will say that there's room for improvement, its a good solid performance.

I've also been a little mischievous - the 1994 Group folded a few years ago but I've resurrected it for this comparison. It was formed of research-intensive universities, like the Russell Group, but they tended to be smaller and, as their informal strap-line had it, 'elite but not elitist'.  Most of the former 1994 Group members are no longer in a mission group, but the pattern of performance shows that mission group alone should not be taken as a guide to a university's performance.

Do the data necessarily mean that teaching and the student experience are better at the Russell Group? Not necessarily. Remember - the data show student satisfaction, which might be higher at Russell Group universities for other reasons. Maybe Russell Group universities are better at managing expectations; maybe the students at Russell Group have more realistic expectations of university because their family has a history of going to university already - they have the social capital to know what to expect and to make the most of it. But of course it is also possible that students at Russell Group universities just do have a better experience ...