A university lecturer who wrote to an undergraduate’s mother to outline details of the student’s studies has been reprimanded for breaching data protection rules.

Geraint Johnes, head of the economics department at Lancaster University, was told that he had made “illicit disclosures” when responding to a complaint from Jackie Gardner that her son, Christian, was getting too little tuition and too much alcohol.

She wrote: “I, very wrongly it seems, assumed that he would be fully engaged . . . he is now quite addicted to alcohol, smokes and has spent a great deal of time over the last nine months asleep.” She said her son appeared to get three hours of lectures a week.

Professor Johnes replied, explaining that Mr Gardner had at least four hours’ weekly contact time plus regular project meetings. But when Mr Gardner became aware of the exchange he complained to the university that it had released the information without his consent, according to Times Higher Education.

Andrew Okey, Lancaster’s data protection officer, confirmed that there had been a breach of the university's data protection procedures.

He informed Professor Johnes saying that he should have obtained the student’s express consent to disclose any details of his tuition to his mother, adding that he should only have answered her concerns in generic terms."

Any further “illicit disclosures” would be reported to the human resources department for disciplinary action, Mr Okey added.

“I shall also ask the academic registrar to withdraw your department’s rights to electronic access to centrally maintained student records,” he said.

Mr Gardner said: “I had spoken to the head of my college earlier about data protection and had been advised that the university could not confirm whether individuals were members of the university.

“[Other] parents had telephoned and had been told the university could not say whether a student was alive or dead. So I was very surprised that a full list of my courses was disclosed to my mother without contacting me first."

Rosemary Jay, head of the information law team at law firm Pinsent Masons, said that although the list of modules attended by Mr Gardner was personal data, revealing it was not a serious breach of his personal autonomy.

“The academic may have assumed that the student knew about the letter and had given implied consent to a reply,” she said.

The Data Protection Act is more about managing information properly than dictating what can and cannot be disclosed, she added. A university may tell parents about their children’s attendance, for example, as long as it has advised students it will make such limited disclosures unless they object.

Times Recommends

• The bright side of this winter rain
• Story behind the picture: Snow Leopard, 2008
• Times Charity Appeal: The Place2Be