Guidance

Privacy notice for Policy Lab user-centred research, including video interviews

Updated 9 March 2023

1. Your data

1.1 Purpose

The Policy Lab supports government departments to develop human-centred policy. This means deeply understanding how people experience policies. Policy Lab uses a range of research techniques, from qualitative studies to video interviews. The Policy Lab is a part of Civil Service Group in the Cabinet Office.

This notice sets out how the Policy Lab will use your personal data, and states your rights with respect to that data. It is made under Articles 13 and/or 14 of the General Data Protection Regulation (GDPR).

The data controller for Policy Lab is the Cabinet Office. A data controller determines how and why personal data is processed. For more information, read the Cabinet Office’s entry in the Data Protection Public Register.

1.2 Why we collect data

The Policy Lab, part of the Cabinet Office (the data controller), processes your personal information for the purpose of conducting research for the development and improvement of government policy.

Policy Lab brings new policy techniques to support departments across the civil service. Policy Lab helps design services around people’s experience, using data analytics, early-stage testing and new digital tools. We often conduct research with members of the public and public servants in order to better understand the lived experience of policies or services.

Research may be held in the form of photos or videos, or in providing visual representation of findings in order to better inform, communicate and provide evidence for projects.

We also use some of the data collected for the purposes of archiving in the public interest. This involves selecting some research material for permanent preservation at the National Archives in line with our legal duties under the Public Records Act 1958.

1.3 The data

If you give us consent, we process the following personal data:

• your name or your child’s name
• your child’s year of birth (so we know their age)
• your email address
• your personal or work address
• your telephone number
• your Civil Service Department or employer
• your image (photo or video)
• your opinion - on matters asked within research

1.4 Legal basis of processing

We ask for your consent before taking photos or filming.

The legal basis for processing videos and images of you is because you consent.

The legal basis for processing all other personal data is that it is a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case that is Policy Lab in Cabinet Office in our role as a researcher. Research is recorded and held in order to provide evidence for projects and inform the development of policy, and for historic records purposes.

1.5 Recipients

Where research has been conducted on behalf of another Government Department or where in the future this information is of relevance it may be shared with other relevant Government departments.

In some cases,we will share personal information with stakeholders for the purposes of policy co-design. This will be in workshop settings where participants are asked not to record/take away any personal information.

We regularly work with contractors, service design and research agencies. On a project-by-project basis, certain information might be collected by, or shared with these external parties. We ask all our suppliers to confirm they are compliant with the General Data Protection Regulation.

1.6 Retention

Your personal data will be kept by Cabinet Office for two years. We consider two years to be the right length of time to retain data so citizens’ personal experiences can inform the development of policy - and so we can advocate the use of visual methods across government policy. This retention period is in line with our Data Retention and Disposal Policy. Policy Lab reviews its data annually, and in April (the start of the financial year).

If your personal data is retained beyond two years it will be because a judgment has been made that it needs to be retained under the Public Records Act 1958. This might be because it has been used in the development of national policy, and is of historic interest. Under the terms of the Public Records Act, Public Records cannot be released to the National Archives for 20 years, and even when they are personal data will continue to be protected (for example by keeping personal data in ‘closed’ records).

2. Your rights

In relation to your photos or videos:

You have the right:

• to withdraw consent to the processing of your personal data at any time.
• to request a copy of any personal data you have provided and for this to be provided in a structured, commonly used and machine-readable format.

In relation to all other information:

You have the right:

• to request information about how your personal data are processed, and to request a copy of that personal data
• to request that any inaccuracies in your personal data are rectified without delay
• to request that any incomplete personal data are completed, including by means of a supplementary statement
• to request that your personal data are erased if there is no longer a justification for them to be processed
• in certain circumstances (for example, where accuracy is contested), to request that the processing of your personal data is restricted
• to object to the processing of your personal data where it is processed for direct marketing purposes
• to object to the processing of your personal data
• to request details of the organisations that we have shared data with for the purpose of the specific research project

3. International transfers

As your personal data will be stored on our IT infrastructure it will be shared with our data processors who provide us with email, and document management and storage services.

We use a cloud-based video storage provider to hold our video footage.

As your personal data is stored on our IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside the European Union. Where that is the case it will be subject to equivalent legal protection through Model Contract Clauses or US Privacy Shield arrangements.

4. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

5. Contact details

The Data Protection Officer provides independent advice and monitoring of Department of Education’s use of personal information.

The role of the Data Protection Officer is to make sure we’re compliant with data protection laws.

You can contact the Data Protection team and the Data Protection Officer at:

Data Protection Officer
Department for Education (B2.28)
7 & 8 Wellington Place
Wellington Street
Leeds
LS1 4AW

Email: dataprotection.office@education.gov.uk

If you need to contact us for anything else, use the DfE contact form.