Personal data on more than one million young people and their parents is being sold to advertisers by the Universities and Colleges Admission Service (UCAS), the university applications body which is the go-to place for approximately 700,000 students enrolling on university courses each year.
As revealed first by The Guardian, UCAS was paid upward of £12 million for handing over emails and addresses of subscribers to mobile phone and drinks companies.
This data is sold via commercial arm UCAS Media, and has been gathered by media giants such as Vodafone, O2 and Microsoft, as well as student accommodation provider Pure Student Living. Red Bull recently promoted three new drink flavours by sending sample cans to 17,500 selected students, and the market for targeting university students is said to be worth in the region of £15 billion a year.
In another twist, users signing up for UCAS Progress, a two-year-old group established to serve pupils aged 13 and looking for post-16 courses, is also collecting data. Children who sign up for the scheme are encouraged to receive email marketing from “carefully selected third parties”. UCAS Progress has defended its actions by saying that it only puts advertisements from education and training providers on its website, and is adamant that it does not email the children directly.
Applicants are able to opt out of receiving these messages, although this does mean missing out on certain emails regarding course information and potential career opportunities.
Emma Carr, deputy director of the privacy lobby group Big Brother Watch, told The Guardian that UCAS is acting within the law, but slammed the ‘underhand' measures being used.
“UCAS is perfectly within the law to sell on this information, but the way they are doing so, as is the situation with most data gathering organisations, is underhand,” she said. “It goes far beyond what students would expect them to do with their data.”
A spokeswoman for UCAS said: "UCAS and UCAS Media comply strictly with all applicable laws and regulations, in the way in which we handle personal data. Ucas Media has strict guidelines for the different groups that we may cover, based on the age sensitivities of our audiences. For example, UCAS Media does not accept political, alcohol or tobacco related products for marketing."
On learning the news, an ICO spokesman told SCMagazineUK.com that this is the latest sign that people need to learn about how their data could be used.
“It's crucial people are aware of how their personal information is being used by an organisation,” the group said via email.
“Where a company wants to use that information for marketing, it should be clear from the outset, and ensure it has the individual's consent, which must be freely given, specific and informed."
Andrew Rose, analyst at Forrester Research and formerly a CISO in the legal sector, told SCMagazineUK.com urged UCAS and other firms to adopt a more ‘civilised' way to serve marketing, but added that users can help themselves by checking the terms and conditions.
“Beware the “carefully selected third parties” tick box, which is usually preceded by a triple negative question so you don't know if ticking the box gets you more mail or less,” he told us via email.
“It seems that UCAS have been adhering to regulation here as they do make it possible for students to opt out of direct marketing, but I understand that this also means they miss out on relevant content such as education and careers mailings too, which is hardly ideal. Unfortunately, the model is set to incentivize the monetization of collected data, and that leads data holders down a tempting path, where fast food outlets and running shoe manufacturers will pay tempting amounts to access your data - and, hey - if they haven't opted out, they've agreed right?
“It's a shame but lots of firms do this, and as big data repositories collect more of your data, it's likely to happen more.”