Closed call for evidence

Privacy notice

Updated 10 May 2022

Applies to England

0.1 Summary of initiative or policy

This 6 week call for evidence invites any person or organisation to provide their views and evidence on improving the vitamin D status of the population in line with current government guidelines. The call for evidence is designed to inform our national campaign on improving vitamin D status, which will run up to autumn, as well as eliciting valuable views and perceptions from industry and the public.

0.2 Data controller

The Department of Health and Social Care (DHSC) is the data controller.

0.3 What personal data we collect

We collect and process the following personal data:

• whether you are responding as an individual or on behalf of an organisation and information about your area of work or your organisation where appropriate

• (if responding online) your internet protocol (IP) address (this is for security purposes and will not be attached to your survey response)

If volunteered:

• your personal characteristics (including your age, where you live in the UK and England, your sex, your gender identity, your ethnicity and your health status)

• your email address or your organisational email address (if confirming DHSC can contact you about your response)

• any other personal data you volunteer by way of evidence or example in your response to open-ended questions in the survey

0.4 How we use your data (purposes)

Your data will be treated in the strictest of confidence.

We collect your personal data as part of the call for evidence process:

• for statistical purposes, for example, to understand how representative the results are and whether views and experiences vary across demographics

• so that DHSC can contact you for further information about your response (if you have given your consent)

0.5 Legal basis for processing personal data

Under Article 6 of the United Kingdom General Data Protection Regulation (UK GDPR), the lawful basis we rely on for processing this information is Article 6(1)(e): “Necessary task in the public interest or controller’s official authority”.  

Special Category data (such as health data and data pertaining to an individual’s ethnicity) is processed under Article 9(2)(h) of the GDPR and Part 1(2) of the Data Protection Act which permits the processing of such data for health and social care purposes (with a basis in law)

0.6 Data processors and other recipients of personal data

All responses to the call for evidence will be seen by:

• professional analysts and policy leads working on the vitamin D call for evidence (or overlapping areas) in DHSC

• DHSC’s third-party supplier (SocialOptic), who is responsible for running and hosting the online survey

DHSC may also share your responses with:

• individuals supporting this project within DHSC’s executive agencies and/or executive non-departmental public bodies

• external researchers if additional support is required to analyse the responses received – the researchers would be bound by a government data management governance agreement

0.7 Disclosure of responses

Please note that, as a public body, DHSC may be required by law to publish or disclose information provided in response to this consultation in accordance with access to information regimes:

• The Freedom of Information Act 2000

By providing commercial or intellectual property information for the purpose of the public consultation exercise, it is understood that you consent to its disclosure and publication where this is required by law. Commercial information is disclosed at the respondent’s risk; we would encourage any commercial information to be marked as such in your response so that this information can be taken into account when responding to a request.

0.8 International data transfers and storage location(s)

Storage of data by DHSC is provided via secure computing infrastructure on servers located in the European Economic Area (EEA). Our platforms are subject to extensive security protections and encryption measures.

0.9 Retention and disposal policy

DHSC will only retain your personal data for as long as either:

• it is needed for the purposes of the call for evidence

• the law requires us to

This means that personal data will be held by DHSC for a minimum of 1 year and a maximum of 8 years.

Data retention will be reviewed on an annual basis. Anonymised data will be kept indefinitely.

0.10 How we keep your data secure

DHSC use appropriate technical, organisational and administrative security measures to protect any information we hold in our records from loss, misuse, unauthorised access, disclosure, alteration and destruction. We have written procedures and policies which are regularly audited and reviewed at a senior level.

SocialOptic is Cyber Essentials certified.

0.11 Your rights as a data subject

By law, data subjects have a number of rights and this processing does not take away or reduce these rights under the EU General Data Protection Regulation (2016/679) and the UK Data Protection Act 2018 applies.

These rights are:

1.       The right to get copies of information – individuals have the right to ask for a copy of any information about them that is used.

2.       The right to get information corrected – individuals have the right to ask for any information held about them that they think is inaccurate, to be corrected.

3.       The right to limit how the information is used – individuals have the right to ask for any of the information held about them to be restricted, for example, if they think inaccurate information is being used.

4.       The right to object to the information being used – individuals can ask for any information held about them to not be used. However, this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.

5.       The right to get information deleted – this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.

Comments or complaints

Anyone unhappy or wishing to complain about how personal data is used as part of this programme, should contact data_protection@dhsc.gov.uk in the first instance or write to:

Data Protection Officer
1st Floor North
39 Victoria Street
London
SW1H 0EU

Anyone who is still not satisfied can complain to the Information Commissioners Office. Their website address is www.ico.org.uk and their postal address is:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Automated decision making or profiling

No decision will be made about individuals solely based on automated decision making (where a decision is taken about them using an electronic system without human involvement) which has a significant impact on them.

Changes to this policy

This privacy notice is kept under regular review, and new versions will be available on our privacy notice page on our website. This privacy notice was last updated on 31 March 2022.