UK, US law must fix clash between privacy rights and protection of life

A web of ambiguity around personal data is stifling universities’ ability to safeguard students’ mental health, say Iria Giuffrida and Alex Hall

December 7, 2023
Concept of a person sitting with head in hands on a maze in the sea with a hand in the distance raised to illustrate UK, US law must fix clash between privacy rights and protecting lives
Source: Getty Images / Istock montage

Universities in the UK and the US are standing at a complex legal crossroads. Bound by stringent privacy laws, yet increasingly held accountable in the aftermath of tragedy, they occupy an unenviable position in systems that lack suitable legal safeguards, leaving them at the mercy of lawsuits and public outcry when things go terribly wrong.

Universities accused of hiding student suicide attempts behind GDPR” read a Guardian headline in June. This is over-simplistic, but it draws attention to a particular difficulty for those at the front line of student well-being. Universities are not hiding behind the UK-GDPR or FERPA, its US counterpart, but they are being stifled by strict data protection rules designed expressly to prevent the sharing of personal data unless specific, complex conditions can be met. Behind a requirement to protect personal information lies a web of ambiguity that universities must navigate when a student’s mental health is at stake.

In the UK, the tragic deaths of university students such as Natasha Abrahart have galvanised a movement among bereaved parents, who claim that the UK-GDPR’s implementation in universities is fatally overriding the safeguarding of students at risk of harm. Across the Atlantic, similarly heart-wrenching tragedies have also spilled over into the courtroom. Each case lays bare the fraught terrain that universities tread, where the legal imperative to protect student privacy clashes with the moral (and legal) obligation to intervene.

The call for reform found a platform in a UK parliamentary debate on 5 June, which crystallised the prevailing concern: while personal data protection is paramount, there must be mechanisms to allow the flow of critical information in serious situations. This debate is not just a matter of policy, but a reflection of a society grappling with the value it places on privacy in the face of the urgent need to protect its vulnerable young citizens within the educational sphere.

For frontline university staff, the current landscape is rife with potential missteps. Every decision to reach out or not, to involve families, to take precautionary measures, is laden with legal ramifications and the spectre of violating privacy norms. The laws, as they stand, are not just a shield but also a maze, within which the path to protecting students is anything but straightforward.

Bereaved parents in the UK have spoken out against the government’s review of student suicides, seeing it as too little, too late, and much too narrow. Their experiences reflect a shared sentiment with their US counterparts: a sense of abandonment by legislative and regulatory bodies that have failed to provide a clear and supportive framework for student welfare.

Universities are caught in a bind. On one side, they face the scrutiny and the pain of families who, in their loss, consider the institutions’ actions or inactions part of the problem. On the other, they grapple with the limitations imposed by privacy laws and regulators, often operating without the legal clarity of direction they desperately need to make informed decisions that could ultimately save lives.

While universities have developed “opt-in” schemes (in which students authorise their institutions to share their information with parents or carers in the event of a crisis), these cannot take into account students falling out with, or becoming estranged from, their parents, or simply losing trust in their institutions and withdrawing consent to share. Where the nature of a student’s relationship with their parents or carers is at the root of their mental health situation, the position becomes even more complex.

These facts call for a shift to a better approach that is both pragmatic and compassionate. Universities require clarity – privacy laws with proactive mental health protocols that can guide and protect them in identifying and acting upon the warning signs of a student in crisis. The best solution in the short term is the creation of clear actionable guidelines that universities can follow without fear of legal reprisal. This includes the development of communication protocols that align with privacy standards but allow for parental notification and involvement in certain circumstances, all within a legislative framework that unequivocally allows data-sharing well before a crisis becomes life-threatening.

It is time to construct a new paradigm – one where the protection of life and the right to privacy are not in opposition, but where each is embraced as essential to higher education’s mission to foster not just the intellect, but the whole, healthy human being. But if students are to learn in an environment in which both their lives and their privacy are valued, privacy laws must change – or, at least, be clarified.

Until that happens, universities will continue to be caught in a clash between compassion and compliance, and students and parents will continue to suffer.

Iria Giuffrida is assistant dean for academic and faculty affairs and professor of the practice of law at William & Mary Law School in Williamsburg, Virginia. Alex Hall is director of legal and compliance services and university solicitor at the University of Hertfordshire and chair of the UK Association of University Legal Practitioners.

Register to continue

Why register?

  • Registration is free and only takes a moment
  • Once registered, you can read 3 articles a month
  • Sign up for our newsletter
Please Login or Register to read this article.

Related articles

Reader's comments (2)

What we really need is a much clearer recognition that universities are not like high schools and do not have a total responsibility for the welfare of students who are, legally, adults. While I have every sympathy for bereaved parents, this movement is just an extreme extension of helicopter parenting and should be firmly resisted. Students are entitled to make their own decisions in life - some will be good and some will be bad but that is just how life is.
While there is a brief mention of the moral, as opposed to legal issues in notifying parents, the majority of this piece feels like its taken as given that notifying parents is usually the morally correct position, if only the law wasn't in the way. But this isn't clear at all. People at university who are suffering mental health difficulties, like people from all walks of life with the same difficulties, need a support network. Its also true that for many people at university, they will have been torn away from these networks, and in an unfamiler place. For many, their parents would be part of that support network. But can universities assume this to be the case? Clearly not. Are ordinary university staff capable of making such judgements? Clearly not. The truth is that this area is difficult and complex, not becuase of the law, but because the area is inherently morally complex, and i'm not sure adjustments of the law can change that.