Supplementary Privacy Notice - More and Better Social Homes
This supplementary privacy notice explains how the Regulator of Social Housing (the regulator) will process personal data for the purposes of the “More and Better Social Homes” discussion exercise.
Applies to England
This notice should be read alongside the regulator’s main privacy notice.
About this project
The regulator is running a discussion exercise on “More and Better Social Homes” to gather views on the issues and questions set out in the discussion paper. Responses may be provided online using Snap Surveys, or by email or post.
The exercise is intended to gather feedback from individuals and organisations, including social housing tenants, shared owners, private registered providers, local authority registered providers, stakeholder organisations, and other interested respondents.
Who is the data controller?
For the purposes of this discussion exercise, the regulator is the data controller for the personal data processed in connection with the project. This means we decide why and how your personal data is used.
Who is processing the data on our behalf?
The regulator is using Snap Surveys as the online platform to collect responses submitted through the online survey. Snap has confirmed that, for our contract, survey data is stored and processed in the UK and hosted with ANS Group in Manchester, UK.
Where responses are submitted by email or post, they will be handled by the regulator’s staff and systems.
The regulator may also use approved internal Microsoft 365 tools, including Copilot within its tenancy, to support the identification of broad themes in responses. Any such use will be subject to meaningful human review and assurance. You can refer to our generative AI privacy notice here: Regulator of Social Housing privacy notice - GOV.UK
Purpose of the processing
We will process personal data for the following purposes:
- to collect and consider responses to the discussion paper;
- to understand who has responded and the context of their feedback;
- to contact respondents where necessary to clarify a response;
- to send a copy of a submitted response where a respondent has asked for this;
- to analyse responses, identify themes and support RSH’s policy and regulatory work.
What personal data we will process
The personal data we process for this exercise is expected to be limited to:
- name;
- contact details, such as an email address where provided;
- whether a response is submitted as an individual or on behalf of an organisation;
- respondent category, for example tenant, shared owner, private registered provider, local authority registered provider, stakeholder organisation, or other;
- organisation name, where applicable;
- the content of the response itself, including any views, comments, and opinions provided.
We do not intend to collect special category data or criminal offence data as part of this exercise. Respondents should not include sensitive personal data, such as health information, or information that identifies other individuals.
Where the personal data comes from
Personal data will be collected directly from individuals or organisations that choose to participate in the discussion exercise. This may be through the online survey, by email, or by post.
Our lawful basis for processing
Although participation is voluntary, the regulator’s lawful basis for processing personal data for this project is Article 6(1)(e) UK GDPR – public task. This is because the discussion exercise supports RSH’s public functions by informing its policy and regulatory work relating to social housing.
How your personal data will be used
The regulator will use the personal data provided to administer the discussion exercise, review responses, and understand the range of views received.
Where contact details are provided, the regulator may use them to clarify aspects of a response or, where requested, to issue a copy of the submitted response. Contact details will not be used for marketing purposes or for any unrelated activities.
Responses may be reviewed by the regulator’s staff and may also be analysed using approved Microsoft 365 tools, including Copilot, to identify broad themes. Human review and assurance will be applied to that analysis.
Responses are not treated as anonymous at the point of collection if direct identifiers, such as names or contact details are provided. Where approved Copilot tool is used to support thematic analysis, these direct identifiers such as names and email addresses will, where possible, be removed first. Responses will then be reviewed for any additional information that could identify an individual, and further redactions will be applied as necessary before responses are treated as anonymised.
The regulator may prepare internal or external summaries of the feedback received. Where feedback is quoted or summarised publicly, this will generally be presented in a non-attributable form.
Special category data
We do not intend to collect special category data for this exercise, and respondents should avoid sharing sensitive personal information unless it is genuinely necessary to their contribution. Special category data includes information such as health information, racial or ethnic origin, religious beliefs, trade union membership, and information about sexual orientation.
If special category data is nevertheless provided and its processing is necessary for the purposes of this exercise, the regulator relies on Article 9(2)(g) UK GDPR (processing necessary for reasons of substantial public interest), together with Schedule 1, paragraph 6 of the Data Protection Act 2018 (statutory etc and government purposes).
Where possible, unnecessary sensitive information will not be recorded, will be removed, or will otherwise be minimised.
Publication and disclosure
The regulator may publish anonymised summaries of the feedback received and may include quotations from responses in a manner that does not identify individuals.
If you consider any information you provide to be confidential, please explain your reasons. We will take this into account if we receive a request for information under the Freedom of Information Act 2000 or the Environmental Information Regulations 2004. However, we cannot guarantee that information will not be disclosed where the law requires otherwise.
Responses may also be disclosed on request in accordance with the Freedom of Information Act 2000 or the Environmental Information Regulations 2004, subject to the requirements of the Data Protection Act 2018 and the UK GDPR.
International transfers
Snap has confirmed that, for our contract, survey data is stored and processed in the UK. We do not intend for personal data, processed for this exercise, to be transferred outside the UK unless this is specifically assessed, approved, and protected by appropriate safeguards.
How long we keep personal data
Responses collected through Snap Surveys will be held on that platform for no longer than 12 months from the closing date of the survey.
After the survey closes, responses may be downloaded from Snap to the regulator’s systems for review and analysis.
If Survey Data is deleted from Snap during the contract term, it remains on Snap’s servers for up to 12 weeks and then in Snap’s back-up systems for up to a further 2 weeks before it is permanently deleted. If a Snap Online account is closed before data is deleted, undeleted Survey Data will remain in the account for 28 days unless earlier deletion is requested, after which the same deletion process applies.
The regulator will remove direct identifiers such as names and contact details as soon as practicable where they are no longer required. The regulator will also review responses for any other information that could identify individuals and apply further redaction where necessary before responses are treated as anonymised.
Identifiable responses will be retained by the regulator only for as long as necessary for this exercise. Once responses have been reviewed and anonymised so that individuals are no longer identifiable, the regulator may retain anonymised summaries, themes or extracts for a longer period for policy, learning and record-keeping purposes.
Security
The regulator will apply appropriate technical and organisational measures to protect personal data used for this exercise. This includes secure storage, restricted access, confidentiality obligations, and secure deletion, de-identification or anonymisation where appropriate.
Participation
Participation in this discussion is voluntary. You do not have to respond, and choosing not to respond will not affect your relationship with the regulator.
Please do not include sensitive personal data or information identifying other individuals unless it is genuinely necessary for your response.
Your rights
Under data protection law, you may have rights in relation to your personal data, including:
-
the right to be informed;
-
the right of access;
-
the right to rectification;
-
the right to erasure in certain circumstances;
-
the right to restrict processing in certain circumstances;
-
the right to object in certain circumstances.
These rights are not absolute and may be subject to legal exemptions, including exemptions that can apply in a research context.
If you would like to exercise any of your rights, or have any questions about this notice or how your data is being used, please contact:
By email: enquiries@rsh.gov.uk
Complaints
By phone: 0300 124 5225
If you are unhappy with how your personal data has been handled, please contact the regulator in the first instance using the details above. If you remain dissatisfied by the proposed resolution of your complaint by the regulator, you have the right to lodge a complaint with the Information Commissioner’s Office.
You also have the right to complain to the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Email: casework@ico.org.uk
Website: ico.org.uk