The student-led inquiry into reports of a data breach at the Cambridge Student Union (SU) has been axed and replaced with an external inquiry, causing concern among students that a “culture of secrecy and cover-ups has become endemic within the SU”.

The chair of the SU board of trustees and current SU undergraduate president, Zaynab Ahmed, told attendees at a student meeting yesterday evening (13/03) that the board of trustees had unanimously voted to block the inquiry on the grounds that the decision to launch an inquiry went beyond the remit of the student council. The students who were in charge of the inquiry subsequently said they have “serious concerns… about the ability of the SU to handle sensitive data and conduct itself professionally.”

A Varsity report earlier this year found that the SU had mishandled sensitive student data, which meant that students had been “effectively outed without even knowing it” last year. The story revealed how information about students’ sexualities, gender identities, race and disabilities, declared anonymously in some SU-run elections, was accessible to committee members running elections for other societies and J/MCRs — without the explicit permission of the students themselves.

Varsity reported that the issue was first brought to the attention of SU staff in January 2022. Nothing was done to address the concerns until as late as June 2022. Even after being initially addressed in June, the issue was not entirely resolved until October.

Following this report, the student council voted to launch a student-led inquiry to determine “the nature and full extent of the problem” and why “the incident occurred and was not resolved for over nine months after first being raised”. The council also voted to reject a motion to pass responsibility for conducting an inquiry to the board of trustees over concerns that it would cause a conflict of interest.

The trustee board of the SU, which currently consists of four elected sabbatical officers and two external trustees, have now unanimously voted to end this inquiry and recruit an external investigator. Ahmed stressed that “the board is as concerned as students”, but the announcement was met with significant unease from student attendees at the meeting.

One of the students appointed to lead the original inquiry spoke at the meeting to give “a frank description of our experience interacting with the SU”. The student said they “are yet to see any evidence that the SU took our inquiry seriously or was interested in enabling our efforts. Our interactions with the SU were met with delays, prevarication, non-responses to reasonable requests, and an unwillingness to engage with the seriousness of this issue.”

The students said they are “deeply disappointed that we have been forced to end our inquiry… Students deserve better than this slow response and the lack of respect the board has shown to students’ mandates… We are disappointed that the board does not see value in a student-led inquiry occurring alongside an external investigation… We hope the SU does not waste the external investigator’s time as they have wasted ours”.

Varsity originally revealed that the data breach had prompted the SU to report itself to the Information Commissioner’s Office (ICO), the government body tasked with policing data protection in November last year. In a statement on the SU website, which has since been deleted, the SU criticised Varsity’s reporting as “misleading” and responsible for causing the “spread of misinformation”. In the same statement, the SU said “there was no data breach… the ICO confirmed that this did not class as a data breach”.

The students who were leading the inquiry have said they are “concerned that the SU has misled its students” on this matter. The SU’s report to the ICO is now publicly available and shows the SU described the situation as a data breach and that the ICO’s findings also repeatedly refer to it as a data breach. The students who were leading the inquiry said “we expect the external investigation to identify whether the SU’s misleading statement was intentional or a result of incompetence.”

In the student members’ meeting, Ahmed acknowledged that there were problems with the SU’s original statement after a student described it as an “outright fabrication”. At the meeting Sam Carling, who originally raised concerns about the data breach last year, said the situation “really, really worries me”.

He continued: “It looks like a cover up. Quite frankly, I’m really appalled that the trustee board decided to stop the inquiry. It was commissioned by the Student Council. It had very, very clear student backing… I’m absolutely floored that the SU seem to have literally called this a data breach when talking to the ICO and yet has repeatedly said to students that this was not a data breach.”

Carling questioned the appointment of an external investigator over concerns that the investigation will “magically be spirited away”. Zaynab Ahmed defended the decision of the trustee board, and said “taking this to someone external with the time, resources and professional expertise to investigate this issue properly and thoroughly incorporating student concerns and student feedback is as serious as a board of trustees of a charity can consider an issue.”

In further comments to Varsity, Carling said: “I’m tired of hearing excuses from Cambridge SU about why it continues to stifle transparency and accountability to the students it is meant to represent - as we have now discovered, the organisation will even stoop so low as to directly lie to students in its statements.”

Carling continued: “There is absolutely no justification for shutting down the student-led inquiry that we as students demanded to be set up - it would not have interfered with an external inquiry, and I have no confidence that the replacement the SU has promised to put into place will deliver a fair and honest outcome. Despite this, I would like to reassure students that we will keep on fighting to end this culture of secrecy and cover-ups that has become endemic within the SU.”

Ahmed confirmed that the external investigator will be paid for with the SU’s “rainy day budget”. She said the external investigator will “hopefully” have been appointed by the end of next week. One of the criteria for the investigator is that the inquiry will be completed by mid-May this year.

The Sabbatical Officer team at Cambridge SU said: "“We acknowledge that our communication of this situation should have been better, and we understand and apologise for the impact this has had on students.This issue is being handled seriously, and our priority in the immediate future is to recruit an external consultant with the knowledge and expertise to investigate the concerns raised by students. Once this investigator is in post we will ensure that students have the opportunity to submit evidence and engage with the process. In the meantime we’d encourage students affected by this to submit a formal complaint using the SU’s processes: https://www.cambridgesu.co.uk/complaints/.

"Until an external investigation is concluded we are unable to comment further. Once the investigation is concluded we will be sharing a report with students at Student Council, and will make swift action on any recommendations. We want to reassure members that we are committed to transparency throughout this process, and will continue to work to rebuild trust with our members. "