Appropriate Policy Document
Special category and criminal offence data
Document details
- Organisation
- Falmouth Exeter Plus (FX Plus)
- Owner
- Jonathan Hocking, Data Protection Officer
- Version
- 1.0
- Last reviewed
- Next review
- Annually, or sooner if our processing or the law changes
About this document
Falmouth Exeter Plus (FX Plus) provides shared services to Falmouth University and the University of Exeter across the Penryn, Falmouth and Truro campuses. To do this, we need to use some special category and criminal offence data.
Data protection law gives this information extra protection. When we rely on certain conditions in Schedule 1 of the Data Protection Act 2018 to use it, the law requires us to have an Appropriate Policy Document. This document meets that requirement. It explains:
- which conditions we rely on;
- how we comply with the data protection principles when we use this information; and
- how long we keep it and how we dispose of it.
This document should be read alongside our privacy notices and our Data Protection Policy.
When this document applies
This document covers processing where FX Plus is the controller, meaning we decide why and how the information is used.
We also handle sensitive information on behalf of Falmouth University and the University of Exeter, for example when supporting students with their wellbeing, mental health or disability. In those cases the university is the controller and its own appropriate policy document applies. We process that information only on the university’s instructions.
What this data is
Special category data is personal data about a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify them, health, sex life or sexual orientation (Article 9 of the UK General Data Protection Regulation, or UK GDPR).
Criminal offence data is personal data about criminal convictions and offences, including allegations, proceedings and sentencing (Article 10 of the UK GDPR and section 11(2) of the Data Protection Act 2018).
Our processing and the conditions we rely on
The table below sets out the main ways we use this information and the legal conditions we rely on. The final column shows whether the condition requires this document. Our full record of processing activities is kept by our Data Protection Officer.
| Processing | Examples | Condition relied on | Appropriate Policy Document needed? |
|---|---|---|---|
| Employment obligations | Sickness absence and occupational health records; reasonable adjustments; health and safety records; trade union membership for subscription deductions | Article 9(2)(b) Schedule 1, Part 1, paragraph 1 (employment, social security and social protection) |
Yes |
| Criminal records checks | Disclosure and Barring Service (DBS) checks and declarations of convictions for roles that work with children or adults at risk, such as nursery, sports and wellbeing staff | Article 10 Schedule 1, Part 1, paragraph 1 (employment) and Part 2, paragraph 18 (safeguarding of children and individuals at risk) |
Yes |
| Equality monitoring | Ethnicity, disability, religion or belief, sexual orientation and gender identity information provided by staff and applicants, used to monitor equality of opportunity | Article 9(2)(g) Schedule 1, Part 2, paragraph 8 (equality of opportunity or treatment) |
Yes |
| Nursery care and safeguarding | Health conditions, allergies, medication and additional needs of children in our nursery; safeguarding concerns and records | Article 9(2)(g) Schedule 1, Part 2, paragraph 18 (safeguarding of children and individuals at risk) |
Yes |
| Campus security and crime prevention | Images from CCTV, body-worn video and drones; security incident reports; information shared with the police about crime and disorder | Article 10 and, where special category data is involved, Article 9(2)(g) Schedule 1, Part 2, paragraph 10 (preventing or detecting unlawful acts) |
Yes |
| Reasonable adjustments for customers | Health or disability information a customer gives us so we can adapt a service for them | Article 9(2)(a) explicit consent | No |
| Emergencies | Sharing health information with emergency services when someone is seriously ill or injured | Article 9(2)(c) vital interests Schedule 1, Part 3, paragraph 30 for criminal offence data |
No |
| Legal claims | Information used in employment tribunals, insurance claims or other legal proceedings | Article 9(2)(f) Schedule 1, Part 3, paragraph 33 for criminal offence data |
No |
How we comply with the data protection principles
Accountability
We have put in place measures to show that we comply with the law. These include:
- appointing a Data Protection Officer who reports directly to our Senior Leadership Team;
- keeping a record of our processing activities;
- building data protection into new systems, projects and supplier arrangements from the start;
- carrying out data protection impact assessments for high-risk processing, including new surveillance technology;
- having written contracts with suppliers who process personal data for us;
- training all staff, with additional training for those who handle sensitive information; and
- regularly reviewing these measures and updating them when needed.
Lawfulness, fairness and transparency
We only use special category and criminal offence data where we have a lawful basis and meet a condition in the table above. We explain what we do with this information in our privacy notices and in this document. We tell staff, applicants and parents about the checks and records we keep before or when we collect the information.
Purpose limitation
We collect this information for the specific purposes set out above. We do not use it for any other purpose that is incompatible with the original one. Where we share it with another organisation, such as the police, we check that the sharing is necessary and lawful and we keep a record.
Data minimisation
We only collect the information we need for each purpose. For example, we only request criminal records checks at the level required for the role, and we only record the health information a nursery needs to care for a child safely. Where we receive information we do not need, we securely delete it.
Accuracy
We take reasonable steps to keep this information accurate and up to date. If we find it is wrong, we correct or delete it without delay. If we decide not to, for example because we must keep an accurate record of what was said at the time, we record the reason.
Storage limitation
We keep this information only for as long as we need it, in line with our Retention Policy and Retention Schedule. Recorded images are kept for the short periods set out in our CCTV, Body-Worn Video and Drone policies, unless they are needed for an investigation or legal proceedings.
Security
We protect this information with appropriate technical and organisational measures, in line with our Information Security Policy. Access is limited to staff who need it for their role. Electronic records are held on secure systems with access controls, and paper records are kept in locked storage. We have a procedure for managing and reporting personal data breaches.
Retention and erasure
Our Retention Schedule sets out how long we keep each type of record. At the end of the retention period, we securely delete or destroy the information, or anonymise it so that it no longer identifies anyone. The schedule is kept under regular review.
Review of this document
Our Data Protection Officer reviews this document at least once a year and whenever our processing or the law changes. We will keep it for as long as we carry out the processing it describes and for at least six months afterwards. We will make it available to the Information Commission on request.
Contact us
If you have any questions about this document or how we use your personal data, please contact our Data Protection Officer at dataprotection@fxplus.ac.uk.
If you are unhappy with how we have handled your personal data, you can complain to us using the details above. If you are not satisfied with our response, you can complain to the Information Commission, the UK regulator for data protection.