The Data Protection Principles

The Data Protection Act 1998 (DPA) concerns personal data which are held about living individuals, and provides that such data must:

1. be obtained and processed fairly and lawfully and only if certain conditions are met;
2. be obtained for specified and lawful purposes;
3. be adequate, relevant and not excessive for those purposes;
4. be accurate and up-to-date;
5. not be kept for longer than is necessary;
6. be processed in accordance with the rights of data subjects;
7. be kept safe from unauthorised access, loss or destruction;
8. not be transferred to countries outside the European Economic Area, unless to countries with equivalent levels of data protection.

 Personal Data 

In order to carry out its duties as an employer, UEA must hold and process data relating to staff. The data held by UEA in relation to staff include but are not restricted to the following:

• personal details such as name, contact details, and National Insurance number;
• bank or building society account details;
• superannuation details;
• records concerning Appraisal, and the HERA role-analysis programme;
• proceedings of the Promotions Committee (these are kept for five years);
• proceedings of the Study Leave Committee (these are kept for five years).

In addition to the computerised data held on the payroll and personnel databases, a paper-based personnel file is held for each member of staff. Access to these files is carefully controlled and they may only be seen by the members of the Personnel Office, the Vice-Chancellor and his PA, the Registrar and Secretary and his PA, the Director of Finance, the Head of Internal Audit, and other persons, if authorised by the Director of Personnel. Such files may include the following:

• application forms;
• contracts, or terms and conditions, of employment;records of salaries and conditions of employment, and of how these relate to superannuation;
• correspondence between the member of staff and UEA;
• correspondence, such as references, between UEA and third parties on behalf of a member of staff;
• documentation relating to absence, sickness, maternity leave, or paternity leave;
• documentation concerning Annual Review, the Appraisal scheme, and the HERA role analysis programme;
• records of disciplinary proceedings.       

Sensitive Personal Data

The DPA defines certain types of data as sensitive. Such data cannot be collected or processed without your explicit consent. At UEA, we ask you to declare your ethnic origin and any disabilities at the time of your application for a post. These fall within the definition of sensitive data. By providing such data, you give your consent for UEA to use them, in aggregated form, for statistical purposes. If you do not wish to provide these data, you may leave those sections of the application form blank.

Your personnel file may also contain sensitive personal data in relation to health or sickness, maternity leave or paternity leave. These records will be kept in strict confidence and will not be released to third parties without your explicit consent.

Higher Education Statistics Agency

Some information held by UEA will be sent to the Higher Education Statistics Agency (HESA). You may wish to note that your contact details will not be made available to HESA, your name will not be used in any statistical analysis, and precautions are taken to ensure that it will not be possible to identify you from the data. Neither HESA, nor the users of the data, will be able to use it to contact you.

Subject to these constraints your record will be added to a database which will be passed to central government departments, agencies, and the devolved administrations. These organisations require the data in order that they may carry out their statutory functions under the Education Acts. It will also be used in anonymised form for statistical analysis by HESA, some of which will be published.

 Access to Data

Members of Staff may request a copy of the personal data held about them by UEA in computer systems or in paper form. Staff who wish to make such a request should contact the Information Policy and Compliance Manager (Telephone 3523, e-mail dataprotection@uea.ac.uk) for a copy of the Application Form. In accordance with the DPA itself, a fee of £10 will be charged.

Similarly you may apply to the Higher Education Statistics Agency (HESA) to request a copy of the data held there. HESA may be contacted at 18 Royal Crescent, Cheltenham, GL50 3DA, Tel 01242 211133, Fax 01242 211122, information.provision@hesa.ac.uk.