Guidance

Domestic and non-domestic Renewable Heat Incentive privacy notice

Published 8 March 2022

This notice sets out how we will use your personal data for monitoring, evaluation and research to support ‘public tasks’ related to the Renewable Heat Incentive (RHI). It also sets out your rights.

The data

We will process the following personal data:

Domestic RHI

• contact details including your name, email address and telephone number
• residential, Installation, and Correspondence Addresses (including postcodes). For applications from private or social landlords, there is also address and postcode for their organisation
• identification numbers, such as the RHI number, the MCS and EPC certificate numbers, and the Renewable Heat Premium Payment Scheme Number (if applicable). Some data is also retrieved by Ofgem from the MCS and EPC certificates
• payment, grant and (if applicable) metering data (this does not include details of the account into which you receive RHI tariff payments)
• administrative details regarding your application, including dates of submission, accreditation, and commission, as well as application statuses and types
• details about the current and past heating system including information on the RHI supported system such as the manufacturer, cost and model, capacity, system type and fuel
• property data, such as whether new or self-built, property type, floor space, and deemed heat demand for space and water heating taken from the EPC (required to calculate payments)
• occupancy details, such as ownership type (whether owner occupier, private landlord or social landlord), the number of days the property is occupied, and the number of occupants

Non-domestic RHI

• contact details including your name, email address and telephone number
• name and address of the location of the heating installation, and of the associated company
• payment details, including tariffs and the amount of heat generated (this does not include details of the account into which you receive RHI tariff payments)
• administrative details regarding your application, including RHI number, dates of submission, accreditation, and commission, application statuses and company SIC
• details about the heating system including technology type, capacity, installation costs, expected feedstock and expected heat / biomethane generation

Purpose

The purposes for which we are processing your personal data are:

1. The evaluation of the domestic and non-domestic RHI. Your data will be processed for activities including but not limited to:

• sampling – the activity of using your personal data to contact you, to invite you to consent to participate in research activities, including but not limited to surveys and interviews
• data analysis – the activity of carrying out statistical activities on your personal data, either in isolation or combined with other datasets
• tailoring - the activity of including your personal data on research apparatus to make it more specific to you, such as the inclusion of your name on the introductory message of a survey

2. For monitoring of the RHI, your data will be processed for activities including but not limited to:

• the publication of Official Statistics
• the preparation of financial forecasts and monitoring of payments made to applicants
• auditing

3. For analysis, research and future policy development, your data will be processed for activities including but not limited to:

• research for the development of policies on clean heat and any related activities, e.g., the RHI, the Boiler Upgrade Scheme, the National Energy Efficiency Data-Framework (NEED) etc
• data analysis – the activity of carrying out statistical activities on your personal data, either in isolation or combined with other datasets, and analysis of your metering data
• to conduct research and analysis to support related policies
• linking: your data may be linked to other datasets in which your data is stored for evaluation, monitoring and analytical purposes

Legal basis of processing

The legal basis for processing your personal data is public task (Article 6(1)(e) UK GDPR). Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, such as the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either House of Parliament; or the administration of justice.

In this instance, one of the tasks which the Department for Energy Security and Net Zero (DESNZ) needs to complete is an evaluation of the domestic and non-domestic RHI. A proper evaluation of the RHI is required to assess the value-for-money of public spending, the extent to which it has met its aims and whether it has resulted in the expected impacts. The Public Value Framework published by HM Treasury makes clear the necessity of evaluation to public policy (this is particularly clear on page 47).

In addition, DESNZ needs to monitor the scheme and how it is functioning, from an operational, financial and a policy development perspective. This is done by producing Official Statistics, financial forecasts and other analysis. The statistics provide transparent information on the scheme, for example the number of applicants. The financial forecasts enable control of spend of the scheme as well as payments to applicants. Financial auditing is also done by the National Audit Office. DESNZ also carries out research to inform the development of RHI and other policies, for example new policies to support renewable heat after the closure of the RHI.

Recipients

For evaluation purposes, your personal data will be shared by us with any contractor or sub-contractor deemed necessary by DESNZ for undertaking evaluation activities as part of the RHI evaluation.

For monitoring and research purposes, data will be shared by us with:

• Welsh Government
• Scottish Government
• Office for National Statistics
• other government departments and agencies as required for monitoring and research purposes, for example of air quality by Defra
• the National Audit Office
• the Energy Savings Trust (working as a contractor to Scottish government)
• the Gas and Electricity Markets Authority (GEMA)
• any contractor or sub-contractor we deem necessary for undertaking research activities

In accordance with Principle (C): Data Minimisation, DESNZ will limit the sharing of your personal data to what is necessary and relevant. We will limit the data sharing to those who require it to undertake their contractual obligations in completing work as part of the evaluation or monitoring of the RHI. We only share personal data when that is essential for the research activity. Where personal data is not essential for the monitoring, evaluation or research we may instead share extracts of data.

As your personal data will be stored on our IT infrastructure it will also be shared with our processors Microsoft and Amazon Web Services.

Retention

Your personal data will be kept by us for no longer than it is needed to fulfil our functions in evaluating and monitoring the domestic and non-domestic RHI scheme. Extracts of property-level data (for example that a dwelling has received RHI funding to install an air source heat pump) may be retained for wider analysis purposes.

The domestic RHI evaluation is set to conclude in January 2023, at which point a final analysis of the non-domestic RHI will also conclude. Following publication of the domestic RHI synthesis report and non-domestic RHI analysis and upon conclusion of the evaluation, the evaluation team will destroy any of your data that they hold. DESNZ will also seek confirmation from its contractors and subcontractors that your data held in connection with the evaluation has been destroyed.

Your data will be retained separately by DESNZ for monitoring, statistical and/or research purposes. Data will be retained to monitor payments and make financial forecasts until all payments on the schemes have been made (for at least 7 years after the closure of the domestic RHI to new applications and 20 years after the closure of the non-domestic RHI to new applications). While the full raw data will then be destroyed, extracts of property-level data records may be kept as part of models such as the National Energy Efficiency Data-Framework (NEED).

Where personal data has not been obtained from the data subject

Your personal data are obtained by us from the Office of Gas and Electricity Markets (Ofgem). Ofgem are legally compelled to supply data to DESNZ under RHI regulations when DESNZ requests it. If you signed up for a Metering and Monitoring Service Package, your metering data was either obtained by us from data storage platforms or installers or provided by yourself directly to us.

Ofgem’s privacy notices:

• Non-domestic Renewable Heat Incentive privacy notice
• Domestic Renewable Heat Incentive privacy notice

Your rights

You have the right to:

• request information about how your personal data are processed, and to request a copy of that personal data
• request that any inaccuracies in your personal data are rectified without delay
• request that any incomplete personal data are completed, including by means of a supplementary statement
• request that your personal data are erased if there is no longer a justification for them to be processed
• in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted
• object to the processing of your personal data where it is processed for direct marketing purposes
• object to the processing of your personal data

International transfers

Your personal data will be processed in the UK.

Your personal data may also be processed in the European Economic Area (EEA). Third parties (such as contractors and sub-contractors) may employ staff who work inside the EEA and internationally, who may process your data. Your personal data as stored on third-parties IT infrastructure may be transferred and stored securely outside the European Economic Area.

Your data will also be processed in the United States of America. This processing occurs when your personal data is used to issue you a survey via the SurveyMonkey platform. DESNZ has completed a Transfer Adequacy Assessment and was satisfied that processing could occur given SurveyMonkey has applied EU GDPR Standard Contractual Clauses. For further information contact RHI@energysecurity.gov.uk.

Where your personal data is processed outside UK, the following safeguards will be in place:

• an adequacy decision in respect of a third country by the European Commission
• reliance on Model Contract Clauses
• reliance on binding corporate rules

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office

Email icocasework@ico.org.uk

Contact form https://ico.org.uk/glo...

Telephone 0303 123 1113

Textphone 01625 545 860

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

The controller for your personal data is the Department for Energy Security and Net Zero (DESNZ).

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Email dataprotection@energysecurity.gov.uk