The General Data Protection Regulation (GDPR) protects the rights of individuals by setting out certain rules as to what organisations can and cannot do with information about people. A key element to this is the principle to process individuals’ data lawfully and fairly. In order to meet the fairness part of this we need to provide information on how we process personal data.
This Fair Processing Notice satisfies this element of legislation and is designed to highlight the areas of Data Protection which may be of particular concern to contracted and/or former staff, and to help those people understand how information about them will be used. It will also provide guidance on your individual rights and how to make a complaint to the Information Commissioner’s Office (ICO), the regulator for data protection in the UK.
Separate Fair Processing Notices are available for the Public, contracted Students and Suppliers.
More widely, ACM is committed to meeting the entirety of its responsibilities to current and former staff under the General Data Protection Regulation (GDPR) and related legislation taking these matters very seriously. We will always ensure personal data is collected, handled, stored, shared, retained and disposed of in a secure manner.
For the purpose of your data protection, ACM is the recognised ‘controller’ of your data. A number of legal entities trade as ACM. These include ACM Commercial Ltd, ACM Education Ltd, The Academy of Contemporary Music Ltd, ACM Guildford Ltd, ACM London Ltd, ACM Birmingham Ltd and Industrication Ltd. Regardless of which legal entity you liaise with, we make the same Data Protection Officer available to you, who can be contacted about any of the content held herein via:
Data Protection Officer
The Academy of Contemporary Music Rodboro Buildings
Bridge Street Guildford Surrey
GU1 4SB United Kingdom
Telephone: +44 (0) 1483 500 800 Email: firstname.lastname@example.org
The legal basis by which we will process and may have already processed data about you:
While you are a staff member at ACM and after you cease to be a staff member, ACM needs to collect, store, use and disclose certain data about you. ACM needs to process this data in order to function effectively as an organisation. Personal data is processed for administrative, academic, statutory, support and health and safety purposes. All such personal data shall be collected and held in accordance with GDPR.
Under the General Data Protection Regulation our legal basis for processing this information about you as a staff member will be that processing is necessary:
- ○ “For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.” This means the information is needed for the delivery and administration of your employment with ACM.
- ○ “For compliance with a legal obligation.” This means ACM is legally required to share some information about you, for example with the Higher Education Statistics Agency (HESA). More information on this is covered below.
○ “To protect the vital interests of a data subject or another person.” This means that in some rare circumstances it may be necessary to share information about you, for example to the emergency services.
If you leave the employment of ACM, the legal basis for continuing to process your personal information would then be:
○ “Necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject.” This means it is reasonable to expect that ACM would contact you if it had a query about any post-termination obligations, a matter relating to a time in which you were employed and/or in relation to a statutory/legal obligation it may have.
If you were a staff member of ACM before May 25th 2018 (the date on which GDPR came into effect), it is important for you to remember that your personal data was already protected another way, by way of The Data Protection Act (The DPA). The DPA established a framework within which information about living individuals can be legally gathered, stored, used and disseminated. At its core were eight Data Protection Principles, which ACM and other organisations needed to abide by. These specified that personal information must be:
- ○ Processed fairly and lawfully, and only if certain conditions are met
- ○ Obtained for specified and lawful purposes, and not used for purposes other thanthose for which it was gathered
- ○ Adequate, relevant and not excessive
- ○ Accurate and where necessary kept up to date
- ○ Kept for no longer than necessary
- ○ Processed in accordance with individuals’ rights
- ○ Kept secure
○ Not transferred outside the European Economic Area unless certain conditions are met
GDPR builds on these requirements and states that from 25 May 2018 information must be:
- ○ processed lawfully, fairly and in a transparent manner in relation to individuals;
- ○ collected for specified, explicit and legitimate purposes and not further processed ina manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
- ○ adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
- ○ accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
- ○ kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals;
- ○ processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
GDPR also requires that:
○ “the controller shall be responsible for, and be able to demonstrate, compliance with the principles.”
These protections apply to information in electronic form and also many types of data in paper form. Further information about the Data Protection Act and the General Data Protection Regulation is available from the Information Commissioner’s Office at www.ico.org.uk .
How and why does ACM use your personal data?
Staff personal data is processed primarily for, but not limited to, the following purposes:
- ● the administration of prospective, current and past employees including self-employed, contract personnel, temporary staff or voluntary workers;
- ● the recruitment and selection process;
- ● administration of non-ACM staff contracted to provide services on behalf of ACM;
- ● planning and management of ACM’s workload or business activity;
- ● occupational health service;
- ● administration of agents or other intermediaries;
- ● pensions administration;
- ● disciplinary matters, staff disputes, employment tribunals;
- ● staff training and development;
- ● ensuring staff are appropriately supported in their roles;
- ● vetting checks;
- ● assessing ACM’s performance against equality objectives as set out by the EqualityAct 2010 .
We may disclose your data to certain outside organisations as outlined in this Fair
We may use copies of the data, including sensitive personal data, which we hold about you for the purpose of testing our IT systems. If your data is used for system testing, it will be copied to a test environment and used with data on other students to test changes to our IT systems in a realistic way. This is done to ensure that changes will be effective and will not cause loss or damage to data. The data about you which we hold in our live systems will not
be affected. Your data will not be kept in the test environment for longer than is necessary for testing purposes. Data in that environment will not be used for purposes other than testing. We will also apply appropriate security precautions to the data.
What personal data does ACM collect?
ACM collects personal data from teaching and non-teaching staff. The volume and nature of the personal data collected is described below, but is not limited to the data items specified:
- ● Initial application:
- ○ name and address
- ○ national insurance number
- ○ contact details (telephone number, email address)
- ○ self-declaration of permission to work in the UK and upload of passport/visacopy if necessary
- ○ relevant qualifications or indication of highest qualification held
- ○ professional development / training and membership of any professional body
- ○ employment history
- ○ supporting statement
- ○ Referee details
- ○ Criminal record disclosure
- ○ Data captured for equal opportunities monitoring (gender, date of birth,nationality, marital status, sexual orientation, religious belief, ethnicity)
- ○ Declaration about any disability as defined under the Equality Act 2010
- ● Once a candidate has been made an offer of employment:
- ○ Bank details
- ○ Emergency contact details
- ○ Qualification information required to be shared with HESA
- ○ Data captured for equal opportunities monitoring (as above)
- ○ Health information
- ○ Certain positions also require a DBS compliance check to be completed
○ A photograph for your Staff ID card
Further personal data captured about an employee is likely to relate to any performance or
appraisal process and any information needed to maintain a sickness/absence record.
Some of this information, such as your ethnicity, medical information and information about disabilities, is classed as “sensitive” personal data under the Data Protection Act. Under the General Data Protection Regulation sensitive data covers information consisting of racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation. Sensitive personal data is subject to extra legal protection and we have to meet an additional set of conditions in order use the data fairly and lawfully.
Sensitive data about you, for example relating to your health, may be shared with restricted departments within ACM to ensure that you have access to appropriate services and support. Sensitive personal data may also be used to monitor equality of opportunity and access to higher education, but will not be used to make decisions about you. For further information about sensitive personal data, see ACM’s Data Protection Policy.
Your Staff Profile
In the normal course of employment, your work contact details will be made available via ACM systems. This may include name, job title, work location, work email address and work telephone number. Your Line Manager and other Senior Managers (as necessary) at ACM may request access to your personal contact details for the purpose of your line management, only as necessary, should there be times at which you are unable to be contacted by way of ACM-operated communications platforms. This may extend to sharing of emergency contact details, if the need arises.
Information, such as CVs/career credits, photos and specialisms, may be made available in a public manner, where relevant to promote ACM’s work, for example in our prospectus and on our website.
ACM Communications Platforms
ACM’s email and other communications services are provided by third parties and you are bound by their terms of service. ACM undertakes that data held within these services is held in accordance with GDPR legislation. ACM has contracts in place with these providers to ensure the protection of ACM owned personal data.
Staff email addresses are issued and used for communicating about ACM business, and are monitored to ensure compliance with our Data Protection and associated policies, as well as legislation such as The Prevent Duty.
For safeguarding and crime prevention purposes, we may operate CCTV systems that cover your work areas. Please refer to our CCTV policy for more information.
Who else has access to my my data?
ACM is required to share personal data with certain other organisations in order to meet statutory requirements or to provide services to students. Sharing will always be undertaken in line with the requirements of data protection law, either through the consent of the individual, or another relevant legal gateway. The personal data that is actually shared will always be limited precisely to what the other organisation needs to meet its requirements or deliver its services.
Although we do not transfer data outside of the European Economic Area (EEA) as a matter of course of usual business, if this disclosure involves the transfer of your data outside the European Economic Area (EEA), we will inform you of this in advance, along with information
about the safeguards in place. The data will only be transferred outside the EEA if one of the conditions set down in the Data Protection Act has been met, or in compliance with the conditions of transfer outlined in the General Data Protection Regulation.
Your data may also be sent to different companies/departments within the ACM group where this is necessary for our day to day administration. The full list of ACM Group companies is: The Academy of Contemporary Music Ltd, ACM Commercial Ltd, ACM Education Ltd, ACM Guildford Ltd, ACM London Ltd, ACM Birmingham Ltd, Industrication Ltd, Metropolis London Music Ltd.
ACM will make some disclosures of personal data to third parties where appropriate. These third parties include:
- ● Higher Education Statistics Agency (HESA)
- ● UK Visas and Immigration
- ● HM Revenue and Customs (HMRC)
- ● Pension schemes
- ● Research sponsors/funders
- ● Trade unions
- ● Potential employers (where a reference is requested)
- ● Benefits Agency as required by the Social Security Administration Act 1992
- ● Child Support Agency as required by the Child Support Information Regulations2008 (no.2551)
- ● The courts, the police and other organisations with a crime prevention or lawenforcement function (subject to the proper entitlements).
- ● Communications Platforms to facilitate marketing and communications of ACMservices (governed by GDPR compliant data sharing agreements):
- ○ Facebook for re-marketing of ACM services to you via its channels;
- ○ Clickatell for SMS (text message) services; and
- ○ Mailchimp and Mandrill for campaign and transactional email services
- ● The emergency services, where there is necessity.
- ● ACM’s insurers and legal advisers for the purpose of providing insurance cover or in the event of a claim;
- ● Employers who request a reference from ACM (for relevant staff and students).
- ● If you leave ACM owing money to ACM, we may at our discretion pass thisinformation to a debt collection agency.
- ● We may disclose information for the purpose of verifying data about you held byACM.
- ● We may disclose data about you for the purpose of a third party administeringCPD services for you.
- ● We may disclose information if there are concerns regarding vulnerability andsusceptibility to radicalisation as part of our responsibilities under the Counter Terrorism and Security Act 2015.
Personal data may also be disclosed when legally required or where there is a legitimate interest, either for ACM or the data subject, taking into account any prejudice or harm that may be caused to the data subject.
ACM may also use third party companies as data processors to carry out certain administrative functions on behalf of ACM. If so, a written contract will be put in place to ensure that any personal data disclosed will be held in accordance with GDPR legislation.
How long do you keep data for?
HR hold individual files for all members of staff. Data we hold that is only relevant to current employees (such as bank information and emergency contact information) will be deleted within 2 months of you leaving our employment. Some other relevant correspondence in relation to member of staff’s employment will be held on file and retained for six years after an employee has left ACM, after which time it will be securely disposed of. Basic information about a member of staff (appointment, dates of service etc) will be retained indefinitely, along with any other data we are required to hold indefinitely for legal/statutory reason.
A full schedule concerning data retention and disposal is available via the policies section of our website.
What are my rights regarding the personal data you hold relating to me?
An individual has the right to be informed about data collection via a Fair Processing Notice. This is that notice.
An individual has the right to ask ACM what personal data we hold about them , and to ask for a copy of that information. ACM reserves the right to ask you to provide proof of identification and for you to clarify your request if it is unclear in the first instance. You will receive a reply no longer than 30 calendar days from the date you make the request in writing. If you are unhappy with the initial response you can ask ACM to undertake a further search if there is specific information you have good reason to believe exists but that hasn’t been delivered to you.
You have the right to rectify data that is incorrect. If you believe ACM holds information about you that is factually incorrect please email our HR department to provide the correct information, and ACM should update it within one month.
You have the right to be forgotten. Where there is not a legal / statutory obligation for ACM to hold data about you, you have the right to be forgotten.
You have the right to data portability where the personal data is processed with the consent of the data subject, not where the personal data has been collected using any of the other legal basis for processing.
You have the right to restrict processing.
You have rights in relation to automated decision making and profiling.
You also have the right to object / withdraw consent from the processing of your personal data by ACM at any time , if your consent was sought initially to use your personal data.
You also have the right to complain to the UK Regulator the Information Commissioner’s Office (the ICO) if you believe you request has not been dealt with properly or you have a complaint to raise against ACM for any other data protection related issue. A complaint can be raised via the ICO’s website at www.ico.org.uk or by writing to the following address:
The Office of the Information Commissioner Wycliffe House
Cheshire SK9 5AF
How do I exercise my rights under GDPR?
For the purpose of your data protection, ACM is the recognised ‘controller’ of your data. A number of legal entities trade as ACM. These include ACM Commercial Ltd, ACM Education Ltd, The Academy of Contemporary Music Ltd, ACM Guildford Ltd, ACM London Ltd, ACM Birmingham Ltd and Industrication Ltd. Regardless of which legal entity you liaise with, we make the same Data Protection Officer available to you, who can be contacted if you would like to exercise any of your rights under GDPR:
Data Protection Officer
The Academy of Contemporary Music Rodboro Buildings
GU1 4SB United Kingdom
Telephone: +44 (0) 1483 500 800 Email: email@example.com
What are my responsibilities?
ACM will make every reasonable effort to keep your details up to date. However, it is your responsibility to provide us with accurate information about yourself when you provide it. It is also your responsibility to let us know of any subsequent changes to your details. You must also abide by ACM’s Data Protection Policy when handling any personal data you come into contact with for which ACM is responsible.