Notice

Parker Review Survey 2021: privacy notice

Published 6 October 2021

This privacy notice supersedes the Parker Review Survey 2020: privacy notice

This notice sets out how we will process and use the personal data collected from this, and the rights of the individuals whose data is collected. It is provided in accordance with Article 13 of the UK General Data Protection Regulation (UK GDPR).

This survey is being conducted by the Department for Business Energy and Industrial Strategy (BEIS). The data controller for the personal data processed from this survey is BEIS.

Data may be shared with individuals on the Parker Review team, some of whom are external to BEIS. Details of the members in the Parker Review team can be found here.

Your data

What personal data will we hold, and where will we get this information?

Personal data is defined under the UK GDPR as ‘any information relating to an identifiable person who can be directly or indirectly identified by reference to an identifier.’ The names of the updated list of FTSE 350 companies were sourced from BoardEx to enable us to conduct a survey with FTSE 350 companies.

As part of the survey, we wish to collect voluntarily from FTSE 350 companies the following “special category” information to assess whether the Parker Review targets have been met:

a) Data on ethnicity using the high level Office for National Statistics categories used in the UK census. These are:

• Asian
• Black
• mixed
• other non-White
• White

The Review will categorise Directors in the Asian, Black, mixed or other non-White categories as “Directors of Colour.” For further information on what specific ethnic groups fall under these high-level classifications, please see Annex 1.

b) For those Directors identifying as White, we are only collecting data on the number of White Directors on the Board.

c) For those Directors identifying as a member of the Asian, Black, mixed or other non-White ethnic group, we are collecting the following information (for the reasons set out):

• full name – to avoid double counting.
• function on Board – to understand the level of seniority of their role.
• gender – to avoid double counting.
• nationality – to assess the success of UK nationals “of colour” in securing board membership.
• whether the Director sits on any other FTSE 350 Board – to understand whether directors have any other board positions

We will also request contact details in the survey of an individual who can answer follow up questions related to the Parker Review 2021 Survey. This information will be kept confidential and stored securely, where only the data controller will have access to the information.

Purpose

The purpose(s) for which we are processing your personal data is:

This government seeks to ensure that all - regardless of socio-economic background, gender, race, or sexual orientation - have an equal opportunity to make the most of their potential and are able to progress to the highest levels in their business careers. This will allow us to tap into the talents and skills of the whole UK workforce as we recover from the current crisis as quickly as possible and to be at the forefront of pulling our economy back to sustainable growth.

This is why the government is supporting the business-led Sir John Parker Review and supports its work towards meeting and maintaining the recommendations, namely that:

• each FTSE 100 Board should have at least one director who identifies as a Director of Colour by 2021
• each FTSE 250 Board should have at least one director who identifies as a Director of Colour by 2024

Each year, for the duration of the Parker Review, we will be carrying out a new Parker survey to assess the progress in diversity in the boardroom and will be commissioning FTSE companies for new data each time. This survey will feed into the business-led Sir John Parker Review to establish if the targets have been met. As mentioned earlier in this notice, BEIS is responsible for collecting and processing the data provided in this survey on all FTSE 350 companies, to better understand the degree of ethnic diversity on the boards of the top UK listed companies.

The results will be published early next year in aggregate form. This means that the data will be anonymised to ensure no individuals are directly identified. Individual companies will be explicitly identified as either “meeting the target”, “failing to meet the target”, “unknown” or “did not respond”. There is a possibility that individuals may be identifiable by linking whether a company has met or failed to meet the target from the information gathered in this survey with company public information which may be accessible online.

Legal basis for processing

Why our use of your data is lawful, and what is the legal basis for processing the data?

The Parker review is an independent, business-led review that is supported by government, with the aim of improving ethnic diversity in senior leadership. We need to contact companies directly to collect information about ethnic diversity in senior leadership teams.

The legal basis for processing your personal data is ‘public task.’

Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, such as the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either House of Parliament; or the administration of justice to carry out the specific task of understanding the degree of ethnic diversity on the boards of FTSE 350 companies.

What are the special categories of personal data being collected?

Special categories of personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

The only special category of personal data that will be processed as part of the Parker Review is personal data revealing racial or ethnic origin.

The legal basis for processing your special category personal data is ‘equality of opportunity.’

Processing this specific category of personal data (data that you or someone you authorised has provided on your behalf) that is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified (in paragraph 8(2) of Part 2 of Schedule 1 to the Data Protection Act 2018) in relation to that category with a view to enabling such equality to be promoted or maintained; and it is not carried out for the purposes of measures or decisions with respect to a particular data subject; and you have not given notice that you do not wish your data to be processed for these purposes; and the processing is not likely to cause substantial damage or substantial distress to an individual; and an appropriate policy document is in place.

Recipients

Who will be the recipients of the personal data collected?

Your personal data may be shared by us with members of the Parker review team, which involves individuals outside of BEIS. The individual-level data may be shared with these individuals. Any transferal of data between the data controller BEIS, and other members of the Parker Review will be done so securely.

The data we collect may be shared with other government departments, agencies, and public bodies, outside of the Parker review team, which could include the aggregated ethnicity data collected by the survey. (This may include the number of directors for each ethnic grouping across the whole FTSE 100 and 250. We will not be sharing personal or identifiable information. Where groupings contain fewer than ten people, we will group them as “other” to ensure individuals are not identifiable.) These groups may include other colleagues within BEIS working on diversity policy for example, the Labour Market Directorate, other government departments with an interest in diversity policy including the Race Disparity Unit in the Cabinet Office and the Government Equalities Office.

This data will only be shared upon request and will be shared with limited individuals to ensure confidentiality. As the data controller, we will set the relevant restrictions and limitations on the use and storage of the data. This will include:

• safe and confidential storage of any data transferred
• limited individuals with access to the any data transferred
• parties in receipt of data will need to ensure any data presented is done so in an anonymised format
• there will be a prohibition on parties in receipt of data contacting respondents from the survey

Where the special category data is shared with parties outside of the Parker review team, we will ensure that this is only for the purpose listed above regarding equality of opportunity between groups.

When we present data in any published material, we may present analysis of numbers of Directors split by Asian, Black, mixed, other non-White and White categories, however this will not be done by company. At the company level, we will only report companies as either having met the target, not met the target, unknown or did not respond. We will not report the number of Directors of Colour for each company to reduce the chances of directors becoming personally identifiable.

At the end of this reporting period, the Parker Review intends to publish a report and press release on the progress towards the targets. In this report we will state which companies have and which companies have not met the review targets of at least one director who qualifies as a Director of Colour.

Storage

How secure is personal data, and where will it be stored?

As your personal data will be stored on our IT infrastructure, by default it will also be shared with our data processors Microsoft and Amazon Web Services. However, the data will only be accessible by a limited number of BEIS researchers and policy colleagues working on this project. We will be using this data for research purposes only. When conducting the survey, we will be using a survey software programme called “Qualtrics Experience Management Platform”. Qualtrics Experience Management Platform is ISO27001 certified and fully compliant with the internationally recognised standard for the information security management system (ISMS). Certification to ISO27001 ensures that all our information is kept secure.

Retention

How long will this personal data be retained by the data controllers?

Your personal data will be kept by us for as long we need it for the purpose(s) of the Review. The Parker Review ends on 31 December 2024. If further work is to be carried out following the Review’s conclusion and we need to contact you about this, we will update this privacy notice further.

Your rights

What are my rights?

Under GDPR, in relation to personal information you provide as part of this project, you have the right:

• to request information on how your data has been processed
• to request a copy of that personal data
• for us to rectify any inaccuracies in that data without delay
• for incomplete personal data to be completed, including by means of a supplementary statement
• for your data to be erased if there is no longer justification for processing
• to object to or restrict processing (in certain circumstances)
• to object to personal data being processed for direct marketing purposes

You have the right to object to the processing of your personal data where your data is being processed for public task (as described above). If you would like to object, please contact parker@beis.gov.uk.

International transfers

As your personal data is stored on our IT infrastructure and shared with our data processors Microsoft and Amazon Web Services, it may be transferred and stored securely in the UK and European Economic Area. Where it is the case that your personal data is stored outside the UK and EEA it will be subject to equivalent legal protection through the use of Model Contract Clauses.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.

Information Commissioner's Office

Email icocasework@ico.org.uk

Contact form https://ico.org.uk/glo...

Telephone 0303 123 1113

Textphone 01625 545 860

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

The team responsible for processing your data can be contacted at parker@beis.gov.uk if you have any questions relating to the survey, data collection and data process.

The data controller for your personal data is the Department for Business, Energy & Industrial Strategy (BEIS).

You can contact the BEIS Data Protection Officer at:

Contact the DPO:

BEIS Data Protection Officer
Department for Business, Energy and Industrial Strategy
1 Victoria Street
London
SW1H 0ET

Email dataprotection@beis.gov.uk

Your participation is voluntary and if you do not wish to take part, we would appreciate if you could please email parker@beis.gov.uk.

Annex 1

Asian	- Indian - Pakistani - Bangladeshi - Chinese - Any other Asian background, please describe
Black	- African - Caribbean - Any other Black / African / Caribbean background, please describe
Mixed / multiple ethnic groups	- White and Black Caribbean - White and Black African - White and Asian - Any other Mixed / Multiple ethnic background, please describe
Other Ethnic group	- Arab - Any other ethnic group, please describe
White	- English / Welsh / Scottish / Northern Irish / British - Irish - Gypsy or Irish Traveller - Any other White background, please describe