DATA PROTECTION POLICY

Last Updated: June 2021

Review Date: June 2024

BHASVIC Data Protection Policy

TABLE OF CONTENTS

1. OVERVIEW
The college needs to keep certain information about employees, students and other users to allow it to monitor performance, achievement, and health and safety, for example. It is also necessary to process information so that Personnel can be recruited and paid, courses organised and legal obligations to funding bodies and government complied with. Data is not just data held on computers but includes information held in written records Protecting the confidentiality and integrity of personal data is a key responsibility of everyone within the College. As an organisation that collects, uses and stores personal data about its employees, students, governors, parents, suppliers and customers, the College recognises that having controls around the collection, use, retention and destruction of personal data is important in order to comply with the College’s obligations under Data Protection Laws and in particular its obligations under UK GDPR. If you have any queries concerning this Policy, please contact our Data Protection Officer, who is responsible for ensuring the College’s compliance with this policy.

Back to table of contents

2. ABOUT THIS POLICY
This Policy (and the other policies and documents referred to in it) sets out the basis on which the College will collect and use personal data, either where the College collects it from individuals itself, or where it is provided to the College by third parties. It also sets out rules on how the College handles uses, transfers and stores personal data. It applies to all personal data stored electronically, in paper form, or otherwise. College Personnel will be directed to this Policy when they start and may receive periodic revisions to it. This policy does not form part of the formal contract of employment, but it is a condition of employment that employees will abide by the rules and policies made by the College. Any failure to follow the policy can therefore result in disciplinary proceedings. Any member of personnel who considers that the policy has not been followed in respect of personal data about themselves should initially raise the matter with the designated Data Protection Officer. If the matter is not resolved it should be raised as a formal grievance or complaint. Any questions or concerns about the interpretation or operation of this policy should be taken up with the Data Protection Officer.

Back to table of contents

3. DEFINITIONS
3.1. College – Brighton Hove and Sussex Sixth Form College
3.2. College Personnel – Any College employee, Governor, worker or contractor who accesses any of the College’s personal data and will include employees, consultants, contractors, and temporary Personnel hired to work on behalf of the College.
3.3. Controller – Any entity (e.g. company, organisation or person) that makes its own decisions about how it is going to collect and use personal data. A Controller is responsible for compliance with Data Protection Laws. Examples of personal data the College is the Controller of include employee details or information the College collects relating to students. The College will be viewed as a controller of personal data if it decides what personal data the College is going to collect and how it will use it. A common misconception is that individuals within organisations are the Controllers. This is not the case it is the organisation itself which is the Controller.
3.4. Data Protection Laws – The UK GDPR (General Data Protection Regulation) and all applicable laws relating to the collection and use of personal dataand privacy and any applicable codes of practice issued by a regulator including in the UK, the Data Protection Act 2018.
3.5. Data Protection Officer – The Data Protection Officer is Tara Davies and can be contacted at 01273 552200. dpo@bhasvic.ac.uk
3.6. ICO – the Information Commissioner’s Office, the UK’s data protection regulator.
3.7. Individuals – Living individuals who can be identified, directly or indirectly, from information that the College has. For example, an individual could be identified directly by name, or indirectly by gender, job role and office location if you can use this information to work out who they are. Individuals include employees, students, parents, visitors and potential students. Individuals also include partnerships and sole traders.
3.8. personal data– Any information about an Individual (see definition above) which identifies them or allows them to be identified in conjunction with other information that is held. It includes information of this type, even if used in a business context. Personal data is defined broadly and covers things such as name, address, email address (including in a business context, email addresses of Individuals in companies such as firstname.surname@organisation.com), IP address and also more sensitive types of data such as trade union membership, genetic data and religious beliefs. These more sensitive types of data are called “Special Categories of personal data” and are defined below. Special Categories of personal data are given extra protection by Data Protection Laws.
3.9. Processor – Any entity (e.g. company, organisation or person) which accesses or uses personal data on the instruction of a Controller. A Processor is a third party that processes personal data on behalf of a Controller. This is usually as a result of the outsourcing of a service by the Controller or the provision of services by the Processor which involve access to or use of personal data. Examples include: where software support for a system, which contains personal data, is provided by someone outside the business; cloud arrangements; and mail fulfilment services.
3.10. Special Categories of personal data– personal data that reveals a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data (i.e. information about their inherited or acquired genetic characteristics), biometric data (i.e. information about their physical, physiological or behavioural characteristics such as facial images and fingerprints), physical or mental health, sexual life or sexual orientation and criminal record. Special Categories of personal data are subject to additional controls in comparison to ordinary personal data.

Back to table of contents

4. COLLEGE PERSONNEL GENERAL OBLIGATIONS
4.1. All College Personnel must comply with this policy.
4.2. College Personnel must ensure that they keep confidential all personal data that they collect, store, use and come into contact with during the performance of their duties.
4.3. College Personnel must not release or disclose any personal data:
4.3.1. outside the College; or
4.3.2. inside the college to College personnel not authorised to access the personal data, without specific authorisation from their manager or the Data Protection Officer; this includes by phone calls or in emails.
4.4. College personnel must take all steps to ensure there is no unauthorised access to personal data whether by other College Personnel who are not authorised to see such personal data or by people outside the College. Unauthorised access could be orally or in writing, accidentally or otherwise
4.5. College Personnel must ensure that any personal data which they hold is kept securely

Back to table of contents

5. DATA PROTECTION PRINCIPLES
5.1. When using personal data, Data Protection Laws require that the College complies with the following principles. These principles require personal data to be:
5.1.1. processed lawfully, fairly and in a transparent manner;
5.1.2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
5.1.3. adequate, relevant and limited to what is necessary for the purposes for which it is being processed;
5.1.4. accurate and kept up to date, meaning that every reasonable step must be taken to ensure that personal data that is inaccurate is erased or rectified as soon as possible;
5.1.5. kept for no longer than is necessary for the purposes for which it is being processed; and
5.1.6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
5.2. These principles are considered in more detail in the remainder of this Policy. In addition to complying with the above requirements the College also has to demonstrate in writing that it complies with them. The College has a number of policies and procedures in place, including this Policy and the documentation referred to in it, to ensure that the College can demonstrate its compliance. Other policies include • Data retention policy • Rights of Individuals Policy • Data breach policy

Back to table of contents

6. LAWFUL USE OF PERSONAL DATA
6.1. In order to collect and/or use personal data lawfully the College needs to be able to show that its use meets one of a number of legal grounds. The detailed grounds are listed on the ICO’s website: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulationgdpr/lawful-basis-for-processing
6.2. In addition, when the College collects and/or uses Special Categories of personal data, the College has to show that one of a number of additional conditions is met. The detailed additional conditions are on the ICO’s website: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulationgdpr/lawful-basis-for-processing/special-category-data/
6.3. The College has carefully assessed how it uses personal data and how it complies with the obligations set out in paragraphs 6.1 and 6.2. If the College changes how it uses personal data, the College needs to update this record and may also need to notify Individuals about the change. If College Personnel therefore intend to change how they use personal data at any point they must notify the Data Protection Officer who will decide whether their intended use requires amendments to be made and any other controls which need to apply.

Back to table of contents

7. TRANSPARENT PROCESSING – PRIVACY NOTICES
7.1. Where the College collects personal data directly from Individuals, the College will inform them about how the College uses their personal data. This is in a privacy notice. The College has adopted the following privacy notices: Privacy Notice for Students Privacy Notice for Evening Language students Privacy Notice for Staff Privacy Notice for Governors
7.2. If the College receives personal data about an Individual from other sources, the College will provide the Individual with a privacy notice about how the College will use their personal data. This will be provided as soon as reasonably possible and in any event within one month.
7.3. If the College changes how it uses personal data, the College may need to notify Individuals about the change. If College personnel therefore intend to change how they use personal data they must notify the Data Protection Officer who will decide whether the intended use requires amendments to be made to the privacy notices and any other controls which need to apply.

Back to table of contents

8. DATA QUALITY – ENSURING THE USE OF ACCURATE, UP TO DATE AND RELEVANT PERSONAL DATA
8.1. The College only collects and processes personal data to the extent that it is required for the specific purpose(s) notified to the Individual in a privacy notice (see paragraph 7 above) and as set out in the College’s record of how it uses personal data. The College will also ensure that the personal data it holds is accurate and kept up to date.
8.2. All College personnel that collect and record personal data shall ensure that the personal data is recorded accurately, is kept up to date and shall also ensure that they limit the collection and recording of personal data to that which is adequate, relevant and limited to what is necessary in relation to the purpose for which it is collected and used.
8.3. All College personnel that obtain personal data from sources outside the College shall take reasonable steps to ensure that the personal data is recorded accurately, is up to date and limited to that which is adequate, relevant and limited to what is necessary in relation to the purpose for which it is collected and used. This does not require College personnel to independently check the personal data obtained.
8.4. In order to maintain the quality of personal data, all College personnel that access personal data shall ensure that they review, maintain and update it to ensure that it remains accurate, up to date, adequate, relevant and limited to what is necessary in relation to the purpose for which it is collected and used. Please note that this does not apply to personal data which the College must keep in its original form (e.g. for legal reasons or that which is relevant to an investigation).
8.5. The College recognises the importance of ensuring that personal data is amended, rectified, erased or its use restricted where this is appropriate under Data Protection Laws. The College has a Rights of Individuals Policy and a Rights of Individuals Procedure which set out how the College responds to requests relating to these issues. Any request from an individual for the amendment, rectification, erasure or restriction of the use of their personal data should be dealt with in accordance with those documents.

Back to table of contents

9. PERSONAL DATA MUST NOT BE KEPT FOR LONGER THAN NEEDED
9.1. The College does not keep personal data longer than is necessary for the purpose or purposes for which the College collected it.
9.2. The College has assessed the types of personal data that it holds and the purposes it uses it for and has set retention periods for the different types of personal data processed by the College, the reasons for those retention periods and how the College securely deletes personal data at the end of those periods. These are set out in the Data Retention Policy.
9.3. If College Personnel feel that a particular item of personal data needs to be kept for more or less time than the retention period set out in the Data Retention Policy, for example because there is a requirement of law, or if College Personnel have any questions about this Policy or the College’s personal data retention practices, they should contact the Data Protection Officer for guidance.

Back to table of contents

10. DATA SECURITY
The College takes information security very seriously and the College has security measures against unlawful or unauthorised processing of personal data and against the accidental loss of, or damage to, personal data. The College has in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction.

Back to table of contents

11. DATA BREACH
11.1. Whilst the College takes information security very seriously, unfortunately, in today’s environment, it is possible that a security breach could happen which may result in the unauthorised loss of, access to, deletion of or alteration of personal data. If this happens there will be a personal data breach and College Personnel must comply with the College’s Data Breach Notification Policy. Please see paragraphs
11.2 and 11.3 for examples of what can be a personal data breach.
11.2. personal data breach is defined very broadly and is effectively any failure to keep personal data secure, which leads to the accidental or unlawful loss (including loss of access to), destruction, alteration or unauthorised disclosure of personal data. Whilst most personal data breaches happen as a result of action taken by a third party, they can also occur as a result of something someone internal does.
11.3. There are three main types of personal data breach which are as follows:
11.3.1. Confidentiality breach - where there is an unauthorised or accidental disclosure of, or access to, personal data e.g. hacking, accessing internal systems that a College Personnel is not authorised to access, accessing personal data stored on a lost laptop, phone or other device, people “blagging” access to personal data they have no right to access, putting the wrong letter in the wrong envelope, sending an email to the wrong student, or disclosing information over the phone to the wrong person;
11.3.2. Availability breach - where there is an accidental or unauthorised loss of access to, or destruction of, personal data e.g. loss of a memory stick, laptop or device, denial of service attack, infection of systems by ransom ware, deleting personal data in error, loss of access to personal data stored on systems, inability to restore access to personal data from back up, or loss of an encryption key; and
11.3.3. Integrity breach - where there is an unauthorised or accidental alteration of personal data.

Back to table of contents

12. APPOINTING CONTRACTORS WHO ACCESS THE COLLEGE’S PERSONAL DATA
12.1. If the College appoints a contractor who is a Processor of the College’s personal data, Data Protection Laws require that the College only appoints them where the College has carried out sufficient due diligence and only where the College has appropriate contracts in place. 12.2. The College will only use Processors who meet the requirements of the GDPR and protect the rights of individuals. This applies to both new and existing suppliers. Once a Processor is appointed they will be audited periodically to ensure that they are meeting the requirements of their contract in relation to Data Protection. Any contract where the College appoints a Processor must be in writing.
12.4. The College is considered as having appointed a Processor where they have engaged someone to perform a service and as part of it they may get access to personal data. Where the College appoints a Processor the College, as Controller, remains responsible for what happens to the personal data.
12.5. GDPR requires the contract with a Processor to contain the following obligations as a minimum:
12.5.1. to only act on the written instructions of the Controller;
12.5.2. to not export personal data without the Controller’s instruction;
12.5.3. to ensure personnel are subject to confidentiality obligations;
12.5.4. to take appropriate security measures;
12.5.5. to only engage sub-processors with the prior consent (specific or general) of the Controller and under a written contract;
12.5.6. to keep the personal data secure and assist the Controller to do so;
12.5.7. to assist with the notification of Data Breaches and Data Protection Impact Assessments;
12.5.8. to assist with subject access/individuals rights;
12.5.9. to delete/return all personal data as requested at the end of the contract;
12.5.10. to submit to audits and provide information about the processing; and
12.5.11. to tell the Controller if any instruction is in breach of the GDPR or other EU or member state data protection law.
12.6. In addition, the contract should set out:
12.6.1. The subject-matter and duration of the processing;
12.6.2. the nature and purpose of the processing;
12.6.3. the type of personal data and categories of individuals; and
12.6.4. the obligations and rights of the Controller.

Back to table of contents