The EU draft regulation on data protection seeks to strengthen the meaning of consent and gives it greater importance as a legitimate basis for the processing of personal data.  The draft regulation maintains the helpful condition for processing based on the data controller's legitimate interests provided that these do not override the interests or fundamental rights and freedoms of the data subject.  However, this latter basis for legitimate processing does not apply to "public authorities" in the performance of their tasks which will have to ensure that they can demonstrate compliance with other conditions. Universities currently in receipt of funding from the Higher Education Funding Council for England are currently classified as "public authorities" under the Freedom of Information Act 2000.  Will there be a level playing field for all those institutions designated for the purpose of their students being eligible for a student loan?