As a Non-Departmental Public Body, SERC has a responsibility to promote Information Rights and respond to requests from Individuals who wish to exercise any of these Rights. The Information Commissioners Office regulates our compliance and we have policies and procedures in place to support our efforts to comply with our obligations towards information requests.

All data processed for the above purposes will be proportionate and necessary. Staff will demonstrate an ethical and responsible approach when processing such information and respect the privacy of individuals.

This Notice will give you further information about how your personal data will be used.

The Data Protection Officer for the College is Sian Harvey.

Lawful Basis

Our lawful basis to use your personal data for the above purposes:

GDPR Article 6.1 (c) – Processing is necessary for compliance with a legal obligation to which the controller is subject.

Our lawful basis for processing Special Category information in relation to these requests is:

GDPR Article 9(2)(g) – Substantial Public Interest
Data Protection Act (2018) Section 10, Schedule 1, Part 2(6) - Statutory etc and government purposes

How Will Your Information be Processed?

Information will be used to respond to Information Rights requests.

GDPR Rights include:

Right to be Informed
Right of Access
Right to Rectification
Right to Erasure
Right to Restrict Processing
Right to Data Portability
Right to Object
Right to Complain to the ICO

Freedom of Information Rights are:

Right to be informed in writing if information held by a Public Authority
Right to have that information communicated to them

Information provided may be used to validate the individuals identity and locate the information if the request relations to personal data. Freedom of Information requests are viewed as ‘applicant blind’ as the College cannot take identity into account. In both cases, contact information will be used to communicate with individuals making the request i.e. acknowledge, seek clarity where necessary and provide a final response.

For data protection requests, personal information within the scope of the request will be collected and assessed within the provisions of legislation. It may also be redacted, collated and withheld if legislation does not permit its release however the College will communicate this with you.

Categories of Personal Data

To assist the College to comply with Information Requests, the College may need to process the following information about you:

Name
Address
Date of birth
Contact details (e.g. email address, telephone number)
Personal records (e.g. HR or student)
General records (e.g. feedback, communications)
Special Category data
CCTV image

Please note, this is list is not exhaustive as each request will have a different scope.

Who will have access to my information, or who will you share it with?

To enable the College to comply with requests, your information will be shared with the Data Protection Officer and relevant College Departments where the appropriate knowledge and skills exist to promote a full response to you.

It may also be shared with third parties such as the ICO. The College has a duty to co-operate with the ICO where necessary and may share personal information with them in response to a complaint they may receive and require further information to investigate. We may also share details with them when seeking guidance.

Your information may also be share with College legal representatives for the purposes of seeking advice and to enable us to comply fully with legislation.

For full details on our Privacy Notice and your Rights, please visit our website Customer Privacy Notice