Public Interest Disclosure (PID) privacy notice
HEFCE funds and regulates universities and colleges in England. We invest on behalf of students and the public to promote excellence and innovation in research, teaching and knowledge exchange. We also undertake projects on behalf of other funding bodies which will affect the UK as a whole.
HEFCE is registered as a data controller with the Information Commissioner’s Office (ICO). Our registration number is Z6366704 and you can check our entry details on the ICO’s website.
The HEFCE Public Interest Disclosure (PID) process is the mechanism by which individuals can raise issues of concern to HEFCE that relate to:
- financial irregularity, impropriety, waste and fraud in the institutions we fund; or
- non-compliance with charity laws by exempt charity HEIs for which HEFCE is the principal regulator; or
- implementation of the Prevent Duty by relevant higher education bodies in England.
We will collect the following personal information:
- email address
- telephone number
- previous disclosure history.
Sensitive personal information provided to us
We will not routinely collect sensitive personal information about you; however, you might send us supplementary documents that contain sensitive personal information about yourself if you consider that it is evidence to support your disclosure.
Sensitive personal data means personal data consisting of information about an individual’s:
- racial or ethnic origin
- political opinions
- religious beliefs or other beliefs of a similar nature
- trade union membership
- physical or mental health or condition
- sex life
- criminal record.
How we will use your personal information
We will use the personal information provided to communicate with you and to form judgements about whether a disclosure meets the criteria to be considered under the Public Interest Disclosure process and, if it does meet the criteria, to use that information as necessary to undertake the PID process.
Sensitive personal information that is not relevant to the disclosure will be destroyed immediately. Sensitive personal information that is considered by the PID case manager to be relevant to the disclosure will be securely stored within the case file and used to assess and process the disclosure.
How we will look after your personal information
Personal information will be stored on HEFCE’s secure systems which are accessible, through secure log-in, only to members of the PID team.
Sharing your personal information
If we consider that the issue is within the scope of our regulatory powers and that it meets the criteria for acceptance we will normally make contact with the provider. We will use discretion in dealing with the disclosure. However, we are not able to guarantee confidentiality. In most cases, the disclosure will already be known to the provider, and any conversation that we have with an institution about a disclosure will, in all likelihood, lead to your identity being deduced.
Should a disclosure lead to an investigation under the PID process, information collected may be shared with the applicable regulatory partner:
- The Charity Commission – in cases relating to charity laws by exempt charity HEIs
- The Department for Education – in cases relating to the Prevent duty.
We will not pass on your name or contact details without permission but the case file may contain contextual information, including sensitive personal information, where it forms a relevant part of the evidence base.
We will not disclose your information to any other organisation except where required to do so as part of our functions or by law.
When we will destroy your personal information
We will destroy personal information in accordance with our retention schedule, this will normally be five years after the final decision has been communicated to you and, if relevant, the provider.
Sensitive personal information that is not relevant to the disclosure will be destroyed immediately. Sensitive personal information that is considered by the PID case manager to be relevant to the disclosure will be destroyed in accordance with our retention schedule. This will be five years after the final decision has been communicated to you and, if relevant, the provider.
Access to your personal information and correcting any inaccuracies
You have the right to request a copy of the information that we hold about you. If you would like a copy of some or all of your personal information, please use the request form on our website.
Alternatively you can email firstname.lastname@example.org or write to us at the following address:
Private and Confidential
Data Protection and Information Manager
HEFCE, Nicholson House
Lime Kiln Close
Bristol, BS34 8SR
We may make a small charge for this service and we may also need to verify your identity before providing your personal information.
We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.
How to contact us to discuss this privacy notice
Please contact us if you have any questions about this privacy notice or the information we hold about you using the contact details provided above.
Cookies are test files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to complete statistical reports on website activity.
Changes to this privacy notice
We keep our privacy notices under regular review and we will place updates on the HEFCE website.
PID privacy notice v1 - August 2017