17.12.24
1. Introduction
1.1 The purpose of this policy is to ensure compliance with data protection law in the UK (the UK General Data Protection Regulation (UK GDPR), tailored by the Data Protection Act 2018). Data protection law applies to the processing (collection, storage, use and transfer) of personal information (data and other personal identifiers) about data subjects (living identifiable individuals).
1.2 Under data protection law, the College is identified as a data controller and as such is subject to a range of legal obligations. For clarity, the University of Cambridge and the other Colleges in Cambridge are separate data controllers, with their own policies and procedures. Sharing of personal information between the University and the Colleges is covered by a formal data sharing protocol.
1.3 This policy applies to all staff and members of the College, except when they are acting in a private or external capacity. For clarity, the term staff means anyone working in any context for the College at any level or grade (whether permanent, fixed term or temporary) and including employees, retired but active members and staff, visiting Fellows, workers, trainees, interns, seconded staff, agency staff, agents, volunteers, and external members of College committees.
1.4 Equally, the term member includes senior members (Fellows) and junior members (students and alumni) of the College when they are handling or processing personal information on behalf of the College.
1.5 This policy should be read in conjunction with:
• College Statutes, Ordinances and Regulations:
• staff employment contracts and comparable documents which outline confidentiality obligations when processing information on behalf of the College; < • policies, procedures and terms and conditions of the College and, where relevant, similar documents of the University of Cambridge with regard to:
o information security;
o acceptable use of IT facilities (including personal devices);
o records management and retention;
o any other contractual obligations on the College or the individual which impose confidentiality or information management obligations (which may at times exceed those of College policies with respect to storage or security requirements - e.g. for funded research).
1.6 This policy is reviewed by the Information Technology & Management (IT&M) Committee and is approved by Governing Body. It is reviewed at least once every 3 years. The Governing Body remains responsible for ensuring appropriate resources are in place to achieve compliance with data protection law in line with an appropriate overall risk profile.
2. Aims
2.1 The College upholds data protection law as part of everyday working practices through:
a) ensuring all personal information (see annex) is managed appropriately through this policy;
b) understanding, and applying as necessary, the data protection principles (see annex) when processing personal information;
c) understanding, and fulfilling as necessary, the rights given to data subjects (see annex) under data protection law;
d) understanding, and implementing as necessary, the College's accountability obligations (see annex) under data protection law; and
e) the publication of data protection statements outlining the details of its personal data processing in a clear and transparent manner.
2.2. The College shall appoint a Statutory Data Protection Officer, who will be responsible for:
a) monitoring and auditing the College's compliance with its obligations under data protection law, especially its overall risk profile, and reporting on such annually to the College;
b) advising the College on all aspects of its compliance with data protection law;
c) acting as the College's standard point of contact with the Information Commissioner's Office regarding data protection law, including in the case of personal data breaches; and
d) acting as an available point of contact for complaints from data subjects.
e) The Statutory Data Protection Officer for the College is the Office of Intercollegiate Services Ltd (OIS Ltd) [12B King's Parade, Cambridge; 01223 768745; college.dpo@ois.cam.ac.uk]
2.3 The College shall appoint a College Data Protection Officer who is responsible for:
a) day to day management of data protection compliance;
b) provision of advice on data protection matters to St Catharine’s staff, Fellows and students;
c) the College’s response to any potential data protection breach;
d) acting as the main point of contact with the Statutory Data Protection Officer;
e) the Data Protection Lead at St. Catharine's College is the Bursar, St Catharine’s College, Trumpington Street, Cambridge, CB2 1RL 01223 338300; bursar@caths.cam.ac.uk
2.4 The College shall otherwise ensure all members and staff are aware of this policy and any associated procedures and notes of guidance relating to data protection compliance, provide training as appropriate, and review regularly its procedures and processes to ensure they are fit for purpose. It shall also maintain records of information assets.
2.5 Individual members and staff are responsible for:
a) completing relevant data protection training, as advised by the College;
b) following relevant College policies, procedures and notes of guidance;
c) only accessing and using personal information as required, within the remit of the individuals’ job role/responsibilities.
d) ensuring personal information they have access to is not disclosed unnecessarily or inappropriately;
e) where identified, reporting personal data breaches to the College Data Protection Lead on data.protection@caths.cam.ac.uk, and co-operating with College authorities to address them
Non-observance of the responsibilities in paragraph 2.5 may result in disciplinary action against individual members of staff.
The obligations outlined above do not waive any personal liability for individual criminal offences for the wilful misuse of personal data under data protection legislation.
Last updated: February 2024
Annex
Legal definition of personal information
Personal information is defined as data or other information about a living person who may be identified from it or combined with other data or information held. Some "special category data" (formerly sensitive personal data) are defined as information regarding an individual's racial or ethnic origin; political opinion; religion or other beliefs; trade union membership; physical or mental health or condition; sexual life; or criminal proceedings or convictions, as well as their biometric information.
Data Protection Principles
The data protection principles state that personal data shall be:
• processed (e.g. collected, handled, stored, disclosed and destroyed) fairly, lawfully and transparently.
• processed only for specified, explicit and legitimate purposes;
• adequate, relevant and limited;
• accurate (and rectified if inaccurate);
• not kept for longer than necessary;
• processed securely.
As part of this, the College must have a 'legal basis' for processing an individual's personal data (most commonly, the processing is necessary for the College to operate a contract with them, the processing is necessary to fulfil a legal obligation, the processing is in the legitimate interests of the College and does not override the individual’s privacy considerations, or they have consented to the processing).
Data Subject Rights
An individual's rights (all of which are qualified in different ways) are as follows:
• the right to be informed of how their personal data is being used. This right is usually fulfilled by the provision of 'privacy notices' (also known as 'data protection statements' or, especially in the context of websites, 'privacy policies') which set out how an organisation plans to use an individual's personal data, who it will be shared with, ways to complain, and so on;
• the right of access to their personal data;
• the right to have their inaccurate personal data rectified;
• the right to have their personal data erased (right to be forgotten);
• the right to restrict the processing of their personal data pending its verification or correction;
• the right to receive copies of their personal data in a machine-readable and commonly used format (right to data portability);
• the right to object: to processing (including profiling) of their data that proceeds under particular legal bases; to direct marketing; and to processing of their data for research purposes where that research is not in the public interest;
• the right not to be subject to a decision based solely on automated decision-making using their personal data.
Accountability
The College is required under law to:
• comply with data protection law and hold records demonstrating this;
• implement policies, procedures and processes and training to promote "data protection by design and by default";
• have appropriate contracts in place when outsourcing functions that involve the processing of personal data;
• maintain records of the data processing that is carried out across the College;
• record and report personal data breaches; • carry out, where relevant, data protection impact assessments on high risk processing activities;
• co-operate with the Information Commissioner's Office (ICO) as the UK regulator of data protection law;
• respond to regulatory/court action and pay administrative levies and fines issued by the ICO.
