3Set - Work Package 1 - SCS Database documents

Data Protection Policy for Client Data on the Student Counselling Service (SCS) Database

Introduction
The SCS Database collects client data from Irish Higher Education student counselling services in compliance with ethical (code of conducts) and GDPR regulations. This personal data is processed under a public interest basis (Article 6 of General Data Protection Regulation) with explicit consent and scientific/statistical purposes acting as safeguards (Article 9a & 9j). The terms of the data transfer are outlined in agreements between the SCS Database and the counselling services.
The reason for collecting client data is for the improvement of student mental health through identifying trends, conducting evidence-based research, improvement of services, and providing statistics to inform future policy and funding decisions.
The SCS Database operates in accordance with the seven key principles relating to processing of personal data as outlined in Article 5 of the General Data Protection Regulation. This policy outlines how the SCS Database protects the rights and privacy of counselling services' clients in accordance with GDPR principles.

Lawful, fair & transparent processing:
The SCS Database obtains data from Higher Education student counselling services and processes the data under a public interest basis (Article 6 of GDPR). Data is only obtained from students who are at least 18 year old and have provided informed and explicit consent to their data being provided to the SCS Database for processing (Article 9 of GDPR). Similarly, data is only provided by counselling services to the SCS Database where there is a controller-controller (data sharing) agreement in place and where relevant parties (ethics, GDPR officer etc.), from the institution where the counselling service is based, are informed of the SCS Database. The SCS Database maintains legal agreements with all individuals who have access to the data.

Purpose limitation:
The SCS Database stores personal data for purposes that are specific, lawful and clearly stated. The SCS Database for Higher Education student counselling services processes client data for the following reasons:

• To produce an annual national report for the sector, and allow counselling services to make comparisons to national sector statistics;
• For the identification of mental health trends;
• As a source of national statistics for funding applications; and,
• As a source of data for conducting evidence-based research on student mental health.

The purpose of these processes/outputs is to benefit students as current and future users of student counselling services. These processes are conducted under a public interest basis. Clients of counselling services are informed through their counselling service's confidentiality statement about the database and the purpose behind the database.

Minimisation of processing:
All data transferred to the database will be de-identified. No date of birth, postcodes, addresses, student names will be included in the data. As part of the database policy, the variables collected by counselling services will be reviewed regularly by the Steering Committee. The Steering Committee will check whether the variables are still relevant to the purpose of the database, and recommend variables for deletion or addition. The SCS Database reviews its Data Protection Impact Assessment regularly.

Data accuracy/quality:
The SCS Database will only contain de-identified data transferred from student counselling services. The SCS Database performs checks on the data received to identify any irregularities or outliers. If an individual is concerned that their data is inaccurately held on the database, they should contact their counselling service. The counselling service will be able to confirm the accuracy of the data held, and what data was transferred to the SCS Database.

Storage limitation:
In line with best practices in research, for example Horizon 2020, the data will be preserved long-term for research purposes. In the event of termination of the database, for example owing to a lack of funding, the data will be archived in UCD under the control of the School of Psychology.

Integrity, security & confidentiality:
The SCS Database takes appropriate security measures against unauthorised access. The database is only accessible to a limited number of users. Authorised users require passwords to access the database. The SCS Database maintains a Record of Processing Activities (ROPA) in regard to data received, stored and processed. The ROPA is reviewed annually for any irregularities. The security measures are reviewed and updated regularly. Researchers who wish to use the SCS Database must apply through a formal process and their proposal vetted. Proposals are considered in context of the added benefit to student mental health research, the added benefit to student counselling service users as well as security of the data, GDPR and ethical considerations. The SCS Database maintains legal agreements with any individuals who undertakes data analysis using the SCS Database. Freedom of Information requests should only be made in regard to national statistics and not based on individual student counselling services. HEIs are responsible for Freedom of Information requests related to their own student counselling service statistics.

Accountability:
The SCS Database operates in accordance with its Data Protection Impact Assessment, Privacy Notices for contributing individuals, controller-controller agreements, and controller-processor agreements. As part of the structure of the database, there will be an automated record of activities including recordings of log-ins and processing activities. The Steering Committee for the SCS Database meets regularly to review the database operations including reviewing documentation, assessing compliance with processing laws, and examining the relevance of variables being collected by the database.

Review of Policy
The SCS Database operates in accordance with GDPR principles and the Irish Data Protection Act 2018. The SCS Database also follows the guidelines as set out by UCD in regard to personal data and best practice for data management and protection. This Policy will be reviewed regularly in light of any legislative or other relevant developments by the Steering Committee for the SCS Database.

Data Protection Policy for Counsellor Data on the Student Counselling Service (SCS) Database

Introduction
The SCS Database collects counsellor data from Irish Higher Education student counselling services in compliance with ethical (code of conducts) and GDPR regulations. This personal data is processed under a public interest basis (Article 6 of General Data Protection Regulation). The terms of the data transfer are outlined in legal agreements between the SCS Database and the counselling services.
The reason for collecting counsellor data is to produce national statistics for the annual report which can be used to inform future policy and funding decisions. The SCS Database operates in accordance with the seven key principles relating to processing of personal data as outlined in Article 5 of the General Data Protection Regulation. This policy outlines how the SCS Database protects the rights and privacy of student counsellors in accordance with GDPR principles.

Lawful, fair and transparent processing:
The SCS Database obtains data from Higher Education student counselling services and processes the data under a public interest basis (Article 6 of GDPR). Data is only obtained from counselling staff who are at least 18 year old and have provided informed and explicit consent to their data being provided to the SCS Database for processing (Article 9 of GDPR). Similarly, data is only provided by counselling services to the SCS Database where there is a controller-controller (data sharing) agreement in place and where relevant parties (ethics, GDPR officer etc.), from the institution where the counselling service is based, are informed of the SCS Database. The SCS Database maintains legal agreements with all individuals who have access to the data.

Purpose limitation:
The SCS Database stores personal data for purposes that are specific, lawful and clearly stated. The SCS Database for Higher Education student counselling services processes counsellor data for the following reasons:

• To produce an annual national report for the sector, and allow counselling services to make comparisons to national sector statistics; and,
• As a source of national statistics for funding applications.

The purpose of these processes/outputs is to benefit students as current and future users of student counselling services. These processes are conducted under a public interest basis. Counselling staff are informed through an information sheet about the database and the purpose behind the database.

Minimisation of processing:
All data transferred to the database will be de-identified. No date of birth, postcodes, addresses, or names will be included in the data. As part of the database policy, the variables collected by counselling services will be reviewed regularly by the Steering Committee. The Steering Committee will check whether the variables are still relevant to the purpose of the database, and recommend variables for deletion or addition. The SCS Database reviews its Data Protection Impact Assessment regularly.

Data accuracy/quality:
The SCS Database will only contain de-identified data transferred from student counselling services. The SCS Database performs checks on the data received to identify any irregularities or outliers. If an individual is concerned that their data is inaccurately held on the database, they should contact their counselling service's representative for the SCS Database. The representative will be able to confirm what data from the individual were transferred to the SCS Database.

Storage limitation:
In line with best practices in research, for example Horizon 2020, the data will be preserved long-term for research purposes. In the event of termination of the database, for example owing to a lack of funding, the data will be archived in UCD under the control of the School of Psychology.

Integrity, security and confidentiality:
The SCS Database takes appropriate security measures against unauthorised access. The database is only accessible to a limited number of users. Authorised users require passwords to access the database. The SCS Database maintains a Record of Processing Activities (ROPA) in regard to data received, stored and processed. The ROPA is reviewed annually for any irregularities. The security measures are reviewed and updated annually. The SCS Database maintains legal agreements with any individuals who undertakes data analysis using the SCS Database. Freedom of Information requests should only be made in regard to national statistics and not based on individual student counselling services. HEIs are responsible for Freedom of Information requests related to their own student counselling service statistics.

Accountability:
The SCS Database operates in accordance with its Data Protection Impact Assessment, Privacy Notices for contributing individuals, controller-controller agreements, and controller-processor agreements. As part of the structure of the database, there will be an automated record of activities including recordings of log-ins and processing activities. The Steering Committee for the SCS Database meets regularly to review the database operations including reviewing documentation, assessing compliance with processing laws, and examining the relevance of variables being collected by the database.

Review of Policy
The SCS Database operates in accordance with GDPR principles and the Irish Data Protection Act 2018. The SCS Database also follows the guidelines as set out by UCD in regard to personal data and best practice for data management and protection. This Policy will be reviewed regularly in light of any legislative or other relevant developments by the Steering Committee for the SCS Database.

Research Privacy Notice for Student Counselling Service Clients

Who are we?
This privacy notice is for the national Student Counselling Service (SCS) Database based in University College Dublin (UCD), Belfield, Dublin 4, Ireland. You can contact us at: scsdatabase@ucd.ie. Once the SCS Database has been established, the governance structure for the SCS Database will consist of the Steering Committee, Research Sub-Committee and Database Working Group. The current Database Working Group consists of Prof Barbara Dooley, Dr Emma Howard, Dr Zahra Farahani and Mr Chuck Rashleigh. UCD is the data controller for the SCS Database and maintains controller-controller agreements with all SCSs, and their HEIs, who contribute data to the database. UCD fully respects your right to privacy and actively seeks to preserve rights of those who share information with the University. Any personal information which you volunteer to share will be treated in accordance with Irish and European Data Protection legislation.

What is the purpose of this Privacy Notice?
The purpose of this Data Protection Privacy Notice is to explain how the SCS Database uses and processes personal data we collect and hold about you as a research participant (“you”, “your”). This notice extends to all your personal data as defined under Article 2(1) of the General Data Protection Regulation (EU) 2016/679. The processing of this data is carried out in accordance with the General Data Protection Regulation (GDPR) / Data Protection Acts 1988-2018 (“Data Protection Law”) and in accordance with this Data Protection Privacy Notice.

How do we collect and process the information?
The SCS Database is a national standardised database for SCSs in Higher Education Institutions (HEIs). It is maintained by the Database Working Group based in UCD. SCSs collect data from individuals during the routine practice of the counselling service. For example, clients’ demographic information, classification of the issues that the clients present with, and data from psychological tests. The data for the SCS Database will be a subset of the data collected by the SCS (please refer to SDS manual for more details). For clients who have provided informed consent and are 18 years or older, their pseudo anonymised data will be transferred to the SCS Database. The data will be pooled and used for national statistics and as a source for evidence-based research on student mental health.

Why do we process the information?
The potential benefits of the database are:

• Identification of trends and problematic areas in the student population (e.g. anxiety in males, eating disorders in mature students);
• Comparisons of the SCS Database with similar international databases for the purpose of best practice;
• Comparisons of SCSs within the Irish sector for the purpose of best practice;
• Establishment of a dataset which can be used for evidence-based research on student mental health, and;
• A source of national statistics for funding applications for the sector.

Ultimately, the database will provide long-term benefits to students who use the SCSs.

How long is the data kept for?
All Personal Data collected for the SCS Database will be retained in accordance with the GDPR guidelines and stored long term for research purposes.

What is the lawful basis for processing the personal data?
Data Protection Law requires that personal data must be processed under a valid lawful basis. We, the SCS Database, collect your personal data from your student counselling service in order to produce reports for the student counselling sector, undertake research relating to student mental health and for the improvement of SCSs. These data are processed under a public interest basis. In addition, consent acts as a safeguard.

Do you have to provide consent?
Consent must be freely given, specific, informed and an unambiguous indication of your wishes by which you (by a statement or by a clear affirmative action) signify agreement to the processing of personal data relating to you. Consent is collected by your counselling service and you can withdraw consent at any stage until the transfer of your de-identified personal data to the SCS Database. Your data will not be transferred to the database immediately and you will have at least one month interval to withdraw your consent if you wish. However, it is not possible to withdraw consent after the transfer owing to your data not being identifiable on the SCS Database.

What personal data is collected?
The categories of personal data collected include:

• Demographic information for example: age, gender, and level of study etc. (please refer to the SDS manual for more details)
• Special Category data such as the classification of the issues presented e.g. academic or anxiety (please refer to the presenting issues section for more details)
• Counselling service data for example number of sessions attended and whether they were in-person or through electronic means
• Responses to psychological tests

Has the SCS Database received approval by a research ethics committee?
Each student counselling service, who contributes data to the SCS database, has approached their institute's Research Ethics Committee and has followed any requirements made by their committee for contributing. Also, each research project conducted using the SCS Database will require ethical approval/exemption by the principal investigator's Higher Education Institution.

How is your personal data protected?
The SCS Database collects data from Irish Higher Education SCSs in compliance with ethical approval and GDPR regulations. The SCS Database takes appropriate administrative, technical, personnel procedural and physical measures to safeguard Personal Data against loss, theft, and unauthorised users’ access, uses or modifications. The data is transferred to the SCS Database in a de-identified format. The SCS Database will not receive any data related to clients’ names, eircodes, addresses or date of birth or counsellors’ notes. The SCS Database and its processors will not attempt to connect the data to any individual or to another dataset, and this term will be contained in all processing agreements. Similarly, in all agreements, there will be a clause that states that the data can only be reported at a statistical or aggregate level; neither students nor institute would be identified in the SCS Database.
The SCS Database has been developed with tight levels of security in mind and to ensure no unauthorised access. For example, any access to the database will be logged. The database makes use of encryption/decryption software. Only a limited number of individuals can access the SCS Database.

Who has access to the information and who we share it with?
Internal access:
The personal data collected from you will be accessed by the Database Working Group and the Database Lead Principal Investigator.
External access:
UCD maintains data sharing agreements with any individuals who process the personal data. The University will disclose your personal data to external third parties where we are required to do and when we have your consent to do so or when we are otherwise permitted to do so in accordance with data protection legislation. Third parties that receive Personal Data from us must satisfy us as to the measures that will be taken to protect the Personal Data. Your Personal Data will never be transferred outside of the European Economic Area or countries that are considered as providing adequate protection by the EU. External access includes:

• The SCS Database stores data on Amazon Web Services based in Ireland.
• Mental health researchers and practitioners - Researchers and practitioners may apply for access to the data from the SCS Database. There are a number of restrictions on this including that to apply for access, at least one member of the research team must be either a member of PCHEI or a clinical staff member in a contributing SCS.

What are your rights?
We process your Personal Data under a public interest basis. Under this basis you have the right to request that we:

• provide you with information as to whether we process your data and details relating to our processing, and with a copy of your personal data;
• rectify any inaccurate data we might have about you without undue delay; and,
• under certain circumstances, be restricted from or stop processing your data.

Requests for any of the above should be addressed by email to the SCS Database at scsdatabase@ucd.ieand the Data Protection Officer at gdpr@ucd.ie . Your request will be processed within 30 days of receipt. Please note, however, it may not be possible to facilitate all requests, for example, the SCS Database cannot identify an individual’s data and may need to direct you to your student counselling service to determine what personal data of yours is being stored. Please click the following link for a list of all HEI student counselling services' emails and websites: https://pchei.ie/index.php/students1/student-counselling

How can you receive further information?
For further information please see https://www.tcd.ie/Student_Counselling/3set/wp1/ or contact us at scsdatabase@ucd.ie

How can you make a complaint?
For making a complaint you can contact the University College Dublin’s Data Protection Officer at gdpr@ucd.ie or by writing to the Office of the DPO, Roebuck Castle, University College Dublin, Belfield, Dublin 4, Ireland.
You have a right to lodge a complaint with the Office of the Data Protection Commissioner (Supervisory Authority). While we recommend that you raise any concerns or queries with us first at scsdatabase@ucd.ie, you may contact that Office at info@dataprotection.ie or by writing to the Data Protection Commissioner, Canal House, Station Road, Portarlington, Co. Laois.

How often is the privacy notice reviewed?
This Privacy Notice will be reviewed annually or more frequently if necessary to consider changes in the law and the experience gained from the Notice in practice.

Categories of presenting issues: A guide on capturing clients’ concerns in Student Counselling Services in HEIs

The aim of collecting presenting issues/clients’ concerns as part of the standardised national database for the student counselling services in Ireland is to present concerns which clients bring to the services including:

• Specific circumstances which cause clients distress
• Psychological and emotional experiences/symptoms which may result from these circumstances or may perpetuate them.
• As part of our consultation with PCHEI members, we sought their feedback on the PCHEI/AUCC main categories of presenting issues/clients’ concerns. As a result, the following 17 categories were derived, which consist of 15 PCHEI/AUCC former main categories, SEXUAL ASSAULT, and RISK TO OTHERS.

For the first pilot phase of the national database, we propose collection of these 17 categories following the instructions outlined below:

• Some categories overlap. This is a strength which ensures that the range of clients’ experiences are reflected in our reporting. For example, for a client who presents with anxiety around financial issues, both ANXIETY and SERVICES, WELFARE & EMPLOYMENT are applicable categories. Another example would be a client with the presentation of an eating disorder which has been formally diagnosed. In this case, both EATING PROBLEMS and DIAGNOSED MENTAL HEALTH CONDITIONS are applicable.
• For the national database, we would like services to report on all the applicable presenting issues and highlight the top presenting issue for each client.
• We would recommend all the applicable presenting issues are collected as part of the intake process and as you go during the sessions and that the top presenting issue is collected as part of the case closure process.
• The clinical judgment of the counsellors is expected to be the source of data for presenting issues. However, counsellors may like to draw from clients’ self-report or the scores from the outcome measures in their decision making.

EXPERIENCE OF ABUSE

Historic or current experience of physical, emotional, sexual, domestic, or online abuse and/or neglect by the client. Includes bullying, harassment, discrimination, and other crimes against the client. This category includes trauma broadly.

ACADEMIC

Issues with performance and participation in a client’s academic occupation. Includes course choice, exam failure, issues with motivation, managing workload, placement issues, plagiarism, procrastination, & academic discipline issues. Also includes negative impacts on academic performance by other presenting issues.

ANXIETY

Captures client’s experiences of excessive fear/anxiety, including social anxiety, worry, panic, stress, obsessive or intrusive thoughts, phobia, post-traumatic stress, etc.

ADDICTIVE BEHAVIOUR

Includes client’s dependency/addiction or problematic misuse of alcohol, drugs (prescription or illegal), gambling, pornography, sex, internet, gaming. Subcategories also include problems in client’s family or close social network.

DEPRESSION, ANGER & MOOD CHANGE

Captures client’s experiences of low mood, mood swings, emotional numbness, feelings of hopelessness, irritability & anger. Diagnoses of “clinical” depression can be coded under Diagnosed Mental Health Conditions.

EATING PROBLEMS

Includes restricted eating, compulsive eating, binge eating, purging behaviour, and other issues related to food. Diagnosed EDs (Anorexia Nervosa, Bulimia Nervosa, EDNOS, OFSED) can be coded in Diagnosed Mental Health Conditions.

LOSS

Includes client’s experiences of grief or loss including bereavement, prolonged grief, break-up/separation/divorce from close relationships, loss of family stability from various circumstances, and loss of health/ hopes/plans/expectations.

DIAGNOSED MENTAL HEALTH CONDITIONS

The pre-2010 agreed category for coding pre-existing or emerging clinical diagnoses of so-called mental health disorders, including Dx of Mood Disorder, Anxiety Disorder, Eating Disorder, Psychotic Disorder, Personality Disorder, ADD/ADHD, Autism Spectrum Disorder, Substance Use Disorder, etc. NB: This category is mainly used in 2 cases: (1) when clients identify pre-existing diagnoses to their counsellor/service, or (2) when a counsellor is confident in making a diagnosis during counselling.

PHYSICAL HEALTH

Includes any medical or physical health issue which is either having an impact on a client’s mental health or is a result of other problems (e.g., sleep and appetite difficulties).

INTERPERSONAL

Includes any interpersonal difficulties: distress in friendship or family relationships, relationship with housemates/classmates, supervisors, break-up of romantic relationships or romantic rejection, difficulty starting/building connections with others, loneliness, or isolation, etc.

SELF & IDENTITY

Captures a broad range of issues related to a client’s view of themselves or how they are viewed by society, including difficulties with self-esteem & confidence, self-criticism, perfectionism, gender identity & expression, racial / ethnic / cultural identity, negative body image, etc.

SERVICES, WELFARE & EMPLOYMENT

Captures any issues regarding a client’s basic needs, including financial hardship, accommodation issues, homelessness, unemployment or under-employment, workplace difficulties, legal problems, immigration, and naturalization issues, etc.

SEXUAL

Includes any medical, psychological, and relational difficulties with sex and sexual interactions which cause clients distress, e.g., concerns or fears about sex, loss of libido, erectile dysfunction, vaginismus, etc.

SEXUAL ASSAULT

Historic or current experience of any sexual contact or behaviour inflicted on the client without their explicit consent. It can involve forcing or manipulating someone to witness or participate in any sexual acts.

SUICIDALITY & SELF-HARM

Captures client experiences of suicidal thoughts/feelings, suicide plans or preparations, past suicide attempts, and self-harm behaviour (with or without suicidal intent).

RISK TO OTHERS

Any past or current risk to others from the client which in the clinician’s judgement represent a clinical challenge in counselling. Risks to others may include physical, sexual, emotional, or other harm/threat of harm from the client, either historic or current.

TRANSITIONS

Captures distress from liminal experiences which may be difficult for clients, e.g. Transition to: college, work, another level of education, a new social context, another country/culture, a new identity as a graduate, etc.

Standardised Dataset Manual

Introduction

This document contains the proposed variables (e.g. gender, age, and ethnicity) for a common dataset across the Irish Higher Education student counselling sector. For a standardised dataset, apart from identifying which variables should be included, it is also important to identify how the variables are collected. For example, should the responses for gender be categorised as: male, female, and other, or; male, female, and non-binary. The dataset is divided into two sections: Section A and Section B.
The data in Section A would be collected on a per client basis. There will be two forms of the dataset, the ‘minimum dataset’ and an ‘maximum dataset’. The minimum dataset is a limited number of variables which we would like any service contributing to the dataset to provide. The ‘maximum dataset’ being all of the variables that the national dataset will collect and that we recommend. While we would like services to collect the variables at the maximum level, we understand that some services may have limited resources and can participate from the minimum level anywhere to the maximum level.

Minimum Dataset: Sessions Offered, Sessions Attended, Counselling Type, Client Status, End of Therapy, Age, Gender, Sexual Orientation, Geographical Region, HEAR, DARE, Mature, Study Level, Study Field, Study Year, Presenting Issues While Section A is collected on a per client basis, Section B data would be collected on a per counselling service basis. This data would be used to provide an overview of the Irish Higher Education student counselling sector.