Photograph by Amy Ellis Winter
CW: sexual assault, domestic violence
At approximately 8pm on 7th January 2023, a new Oxford associated term was coined: ‘Oxshag’. Unlike ‘Oxfess’ which we have all grown to love, with this new phrase came a website, a service fee, and a list. The website was temporarily taken down on 8th January 2023, due to “concerns about [their] data policy” which they “[were] taking very seriously”. The list on the website originally consisted of the full names and colleges of every person who currently holds an Oxford University email address including: students, tutors, porters, academic offices, data protection offices, and so on.
‘Oxshag’, whose motto is “For the overworked and undersexed” claimed that they are “not affiliated with any university” on their previously deleted, now reinstated Instagram account. The list, however, consisted only of the names of people or offices who are on the University of Oxford email server. Oxford student names and emails are consensually in the public domain through the Searching University of Oxford tool, however section 8.h of the ownership, liability and use terms of the website forbid the storing of personal data derived from the website.
Before the website was updated on the evening of 8th January 2023, ‘Oxshag’ stated that “by inputting your matches there is no obligation to pay anything—you only pay later if you want to find out the names of your matches”. When asked “How does payment work?” in the website’s FAQ, ‘Oxshag’ declared “once you submit your picks […] you will receive an email telling you how many matches you got. If you want to reveal the names of your matches, follow the payment link and pay a one-time fee of £3”. The updated website has reduced the fee to £1.
Prior to deleting their Instagram page, ‘Oxshag’ uploaded a post to answer the question: “Why is my name on ‘Oxshag’ when I haven’t signed up?” In their explanation, ‘Oxshag’ asserted that “without loading everyone’s names onto the website, it would be impossible to match people […] Just because your name is listed on Oxshag doesn’t mean you are participating.” The updated website has replaced this FAQ with sign up terms and conditions.
However, the Information Commissioner’s Office, the UK’s national data protection authority, says that “A name and a corporate email address clearly relates to a particular individual and is therefore personal data”. A business processing personal data electronically for its own ‘social’ purposes without an exempted purpose is required by the data protection (charges and information) regulations 2018 to register with the ICO and pay the data protection fee.
Given that ‘Oxshag’ did not appear on the data protection public register, no data controller is named and there is no privacy policy given, it is impossible to verify ICO registration.
Under Article 6 of the UK GDPR, none of the six lawful bases for processing have been applied in the operation of the website, which is a legal requirement for one to be allowed to process personal data under UK law. The six lawful bases are as follows:
- Consent
- Contract
- Legal Obligation
- Vital Interests
- Public Task
- Legitimate Interests
As this is a for-profit website that relied on the use of personal data, the data rights provided by Article 14 of GDPR have been broken. These require a data subject to be informed of the processing of their data before the disclosure of their data to another person, or in this case, the publication of their data.
This article also provides the data subject with the right to be informed how they can exercise their right to have their data removed (the “right to be forgotten”) under Article 17, yet ‘Oxshag’ provided no method for requesting removal. Upon a request made by a student via Instagram saying: “Hey please can you remove me from your list?”, ‘Oxshag’ referred the student to their latest Instagram post at the time, their “Why is my name on ‘Oxshag’?” FAQ, and provided no method nor indication that their name would be erased from the website.
As for university statutes, given that ‘Oxshag’ used the internal contact book provided by Oxford University’s email system (an element of the University’s IT Facilities), the regulations relating to ‘The Use of Information Technologies Faculties’ apply and stipulate the following:
2(1) “The University provides computer facilities and access to its computer networks only for purposes directly connected with the work of the University and the colleges and with the normal academic activities of their members.”
2(2) “Individuals have no right to use university facilities for any other purpose.”
The use of the internal email address book for a for-profit website in civil violation of data protection rights therefore violates these provisions.
Further to this, there are specific purposes provided for in these regulations which the University’s IT systems cannot be used for. These include:
7(10) “private profit, except to the extent authorised under the user’s conditions of employment or other agreement with the University or a college; or commercial purposes (including advertising commercial services) without specific authorisation”;
7(12)(d) “the deliberate or reckless undertaking of activities such as may result in any of the following: […] the violation of the privacy of other users”;
7(13) “activities not directly connected with employment, study, or research in the University or the colleges (excluding reasonable and limited use for social and recreational purposes where not in breach of these regulations or otherwise forbidden) without proper authorisation”.
‘Oxshag’ seems to violate Articles 6, 14 and 17 of the GDPR, in addition to five different elements of the IT regulations of the University of Oxford, which all students sign up to when undertaking a course of study.
Many students have expressed their discomfort and anger over this site:
“It’s highly worrying that overnight every single student at Oxford, not to mention tutors and other staff, has become associated with a publicly available website promoting sexual approaches to those listed without their consent.”
“As a victim of domestic violence who goes by a new name which has not yet been updated in my university email, I am terrified at the prospect that my abuser could easily find this and trace me to my college.”
“Upsetting is putting it lightly. It feels violating to be sucked into a strange sex game without any knowledge of it beforehand; the lines crossed here are astounding. Not only was consent not sought prior to the site going up, it is also publicly available, proving worrying for safety reasons. The original caption to their Instagram post was pushing for a progressive, sex-positive stance against “conservatism”, but there is nothing more progressive than respecting people’s boundaries, especially when it comes to being sexualised unwittingly. Cultural, religious and purely personal reasons are all valid. At university level, I thought we had progressed beyond these demeaning sexual power plays, especially at a university like Oxford.”
“It’s very reminiscent of ‘Facemash’ (matching instead of ranking university peers’ attractiveness) minus any of the code (Elo rating on ‘Facemash’ versus direct matchmaking on ‘Oxshag’) that made ‘Facemash’ at least somewhat technically interesting, even if both are almost equal in their misogyny.”
“This makes me uncomfortable from a religious perspective. I’m a Muslim and I’m sure many other Muslims would object to being on that list. Also, there are men in that list that have sexually assaulted me, and they have the option to choose me, which is deeply uncomfortable and against my consent.”
“It scares me that, in theory, there is nothing to stop the founder leaking the results, but also that anyone can go on there, enter your email and fill out the form. Tutors could get framed which could lead to them losing their jobs and relationships can be ruined.”
“For any unwitting people who find this website – don’t worry, it’s perfectly okay to be disgusted by your own inclusion in a sex game without consent that reduces you to a ‘desired shag’. Please don’t be tricked into thinking being appalled by this means you’ve ‘internalised’ any kind of conservatism, it just means you understand that ‘Oxshag’ isn’t breaking down sexual stigmas in any meaningful way like it purports to be doing.”
(This student quotation was initially posted as a comment in response to the caption of an Oxshag Instagram post depicting two people stood outside the Radcliffe Camera dressed in bondage gear. The initial caption read: “How can they? Have they no shame? If this sounds like your reaction to this picture, chances are you’ve internalised the lineage of sexual conservatism projected onto us. It’s time to break with tradition, to quite literally fuck the system. Dress how you like, shag who you want to and don’t feel guilty about it. This Valentines Day embrace some no strings attached fun with Oxshag.” The above comment was then deleted, and the post’s caption was changed to: “Dress how you like, shag who you want to and don’t feel guilty about it. This Valentines Day embrace some no strings attached fun with Oxshag.” This post was later deleted and replaced with a post detailing the FAQ concerning the inclusion of names without signing up. The student of the deleted comment then sent it in to an Oxford Blue editor and consented to its use in this article.)
“As someone on the ace spectrum, I feel really disgusted and degraded at the thought of having my name included on a casual hookup site without my consent. Aside from the fact that they have objectively broken the law under the Data Protection Act 2018, the careless and casual nature of the site contributes to a damaging sort of hookup culture, with the added effect of objectifying women and nonbinary people. There is also a risk that people will try to look up names on the site to find out the deadnames of trans students who have not yet changed their names in the university system.”
“I think it’s incredibly creepy that people have put our names into this software without anyone consenting to this, and especially that they have taken this without any of us even being aware. I hope the University can do something to take this down as it is definitely a privacy concern – especially since this is publicly available and some people might have safety concerns because of this.”
‘Oxshag’ has been contacted for comment and have responded – see update below.
All student quotations were sent in before ‘Oxshag’ updated its website.
All facts correct at time of publishing.
With special thanks to Oliver Jones-Lyons.
Edited: 20:50pm, 8th January 2023
The Instagram of ‘Oxshag’ has since been relaunched and the Instagram post depicting two people stood outside the Radcliffe Camera dressed in bondage gear has been reinstated along with a new post titled ‘Introducing Oxshag’.
Edited 19:10, 9th January 2023
Under the Right of Reply, the creator of ‘Oxshag’ has told The Oxford Blue.
“Unfortunately, Oxshag will no longer be running this term.”
“Whether or not you choose to believe me, I started this genuinely with the best of intentions. I thought that it would spice up the Oxford casual sex scene (which is underwhelming and/or hard for a lot of people). As a concept, Oxshag isn’t dissimilar from something like Tinder, just a more effective way of matching compatible people together, leading to a more enjoyable experience for everyone.”
“I will admit that I made some poor choices with the initial website, which were not as carefully considered as they could have been and may have been surprising for some. I apologised for this, and after receiving complaints I immediately reworked the website so that you had to opt-in for your name to be listed.”
“But putting it in perspective, your name and college, if not publicly available on the Oxford Search website (which they are for the vast majority), can almost always be found somewhere on the internet. Like seriously, it’s your name and college?! The site was only up for a few hours and the data that was available was seriously unlikely to cause any harm. While this doesn’t excuse the fact that I fucked up, what happened was an innocent mistake that has been blown massively out of proportion.”
“What could have been a fun event has been now ruined by the loud minority. Loosen up a bit, have a laugh, and take life a bit less seriously. I think those who are the most against Oxshag are probably the most in need of it.”
“At the beginning of next term, after a period of reflection (and some more resoundingly mediocre casual sex), I hope attitudes will have changed and I will poll the community to see if people would like me to give this another crack…”
“See you then,
The Oxshagger ;)”
The website and Instagram account linked to ‘Oxshag’ have since been taken down and the operations of ‘Oxshag’ have been suspended.