UK ENERGISE EU Horizon 2020 project privacy statement
1. The Registrar of the Research
Name: Kingston University
Address: Kingston Hill, Kingston-upon-Thames, Surrey KT2 7LB
Other contact information (email address, phone number):
a.genus@kingston.ac.uk, +44 (0)208 417 5565
2. The parties involved in the research project and the division of responsibilities
The ENERGISE project (funded by the European Commission under grant agreement no. 727642 started in December 2016 and continues until November 2019). This is a research project also funded by the EU Horizon 2020 program
In the period between September 2018 and March 2019, eight of the ten ENERGISE consortium partners will implement sustainable energy initiatives, the ENERGISE Living Labs (ELLs), in eight different countries. The eight partner organisations, who will also be involved in collecting, sharing and processing data of the ELL initiatives, are:
- Aalborg University, Copenhagen – Denmark
- GreenDependent Institute, Gödöllő – Hungary
- Kingston University London – United Kingdom
- Ludwig-Maximilians-University Munich – Germany
- Maastricht University – The Netherlands
- National University of Ireland, Galway – Ireland
- University of Geneva – Switzerland
- University of Helsinki – Finland
Contact details of each organisation’s lead researchers, Supervisory Authority and, where applicable, the Data Protection Officer can be found at the end of this statement. The leader responsible for the oversight of the project in the UK is Audley Genus at Kingston University London.
Personal data will be processed in accordance with the General Data Protection Regulation (GDPR) and also, within the UK, the Data Protection Act 2018. It will be shared with Betawerk, an organisation in Switzerland, a non-EU member state. However, the European Commission has deemed Switzerland to have an adequate level of protection with regard to personal data. Therefore, sharing personal data with organisations in Switzerland is just as safe as sharing with organisations inside the EU.
3. Responsible leader of the UK study or a group responsible for it
Audley Genus
Kingston University, Small Business Research Centre
a.genus@kingston.ac.uk, p. +44 (0)208 417 5354
4. Contact information of the Data Protection Officer
Raji Sharma-Drake
Address: River House, 53-57 High Street, Kingston upon Thames, Surrey KT1 1LQ
Email: DPO@kingston.ac.uk
5. Researchers
Audley Genus, Kingston University, Small Business Research Centre
Marfuga Iskandarova, Kingston University, Small Business Research Centre
Tim Harries, Kingston University, Small Business Research Centre
6. Contact person on the research register
Name: Audley Genus
Address: Small Business Research Centre, Kingston University Kingston Hill, Kingston-upon-Thames, Surrey KT2 7LB
Other contact information:
Telephone number: 0208 417 5665
Email address: a.genus@kingston.ac.uk
7. The name, nature and duration of the study register
Research title: European Network for Research, Good Practice and Innovation for Sustainable Energy (ENERGISE)
One-time Research
Follow-up study
Duration of the study: 1.5.2018-31.12.2019
8. Purpose of processing personal data
Personal data will be processed to carry out the ENERGISE study. The purpose of the personal data processing is to develop knowledge about energy demand, which will be shared with ENERGISE researchers in partner organisations during the investigation. The analysis is not of raw personal data; pseudonyms or anonymity will be used to protect the privacy of individual research subjects.
9. Legal basis for the processing of personal data
The legal basis for the collection and processing of personal data will be the consent of the research participants.
Kingston University is a joint controller of the personal data along with the other research partners. A third party organisation called Betawerk will supply the online data collection tool and will process data on behalf of the joint controllers.
10. What information is included in the research material?
Data that will be collected as part of our ELL initiatives includes:
- Personal data: name, age, gender, address, homeownership status as well as educational and socio-economic background of applicants/participants and other household members;
- Energy-related data: type, age and energy efficiency classification of the household’s building, total household energy consumption, and detailed data on energy consumption related to space heating and washing the laundry;
- Data on social aspects of energy use: information on everyday-life behavioural patterns, and perceptions of and readiness to challenge social norms.
The data, including personal data related to age, gender, homeownership status, educational and socio-economic background, will be shared and jointly processed in pseudonymised form (names will be replaced by ID numbers) by the eight project consortium partners. Another organisation that is not part of the ENERGISE consortium (third party), Betawerk based in Heerlen, the Netherlands, has been subcontracted to develop and host the ELL online data collection tool and will, hence, also have access to participants’ personal data.
However, great care is taken that in the UK only Kingston University London will have access to personally identifiable information of respondents. Only Kingston University will be able to connect personally identifiable information (such as name or address) to a household’s ID. Multi-dimensional identification is possible but because only a small number of households (approximately 40-100) is involved in each of the eight countries highly unlikely. Although sensitive personal data, including health, sexual lifestyle, ethnicity, political opinion, religious or philosophical conviction may become obvious to researchers in their interaction with ELL participants, these data are not relevant for the ENERGISE research project and will not be recorded.
The legal basis for collaborative data collection and processing by organisations situated in EU-member states and non-EU-member Switzerland is provided by respondents’ and participants’ consent (agreement). Consent is stipulated as one possible legal basis by the General Data Protection Regulation (GDPR) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. The GDPR repeals Directive 95/46/EC (General Data Protection Regulation) as of 25 May 2018.
The data collected will be used to gain insight into socio-cultural as well as other factors influencing home energy use and to provide policy advice to local, regional, national and international governing bodies on how to support more sustainable ways of living. The results of the ENERGISE project will be disseminated and made publicly available through reports, (oral) presentations and academic publications. As noted, all data will be processed and hence published in anonymised or pseudonymised form only.
Ethical clearance of the ENERGISE project has been granted by the Research Ethics Committee at the ENERGISE coordinating partner, the National University of Ireland, Galway. In addition, the ENERGISE consortium has adopted rigorous “Guidelines for ENERGISE good practice, ethics and data collection” (project deliverable 1.1, Rau, 2017) and “Appropriate Data Management Practices” (project deliverable 3.5, Heiskanen et al., 2018). The consortium’s joint controller agreement and data protection agreement is available at request.
Participation in an ENERGISE Living Lab will be entirely voluntary and participants can discontinue their involvement with the project at any stage by contacting Kingston University, without having to provide reasons. Moreover, participants can get insight into all data they provided. A participant’s data will be deleted or processing restricted, upon their withdrawal from the project. Additionally, if participants detect any inaccuracies in the data collected, they have the right to rectify those inaccuracies. However, the consent cannot be revoked retroactively and will therefore only affect future processing of the data. Lastly, participants have the right to move their data, a copy of which will be available to them, to another controller. The UK’s supervisory authority’s website offers more information on these rights.
11. From which sources personal data is collected
Personal information is collected via an internet form, which has a privacy statement on its front page to which potential participants have to agree in order to be able to continue with filling out the survey, and from interviews. During visits to their homes and through the use of online monitoring equipment, researchers will collect data on energy use. This includes data from household energy bills.
12. Transfer or transfer of information outside the research group
Some of the collection of personal data is done via an internet-based form, placed in a secure electronic storage system managed by Betawerk, in which case the processor is a personal data processor. Information will be transferred to the processor when the subject has submitted the online form, or when the researchers are downloading data from the system. Household energy-related data is collected by other means, such as from personal interviews, and then aggregated. The information in the system is only available to the ENERGISE research team. However, the personal information in the system is only available to the UK ENERGISE team at Kingston University.
13. Transfer or transfer of data outside the EU or the European Economic Area
Data will not be disclosed outside the EU, EEA or Switzerland. If for reasons related to the processor, it is necessary to transfer information outside the area, this shall be carried out with Compliance with the GDPR, or with the EU Commission Patent Protection clauses or Privacy Shield certificate, as appropriate.
In the Background Data Survey, ENERGISE uses US Qualtrics software whose data is stored on an EU / EEA server. Data will be removed from Qualtrics after the background information query expires.
14. Automated decision making
Automatic decisions are not taken.
15. Principles of the protection of personal data
The information is kept confidential. It will only be accessed by the ENERGISE research team. Files containing personal data are stored in the universities’ safe and secure systems and devices. Information that is processed in the information systems is subject to user name password access registration access control. Directly identifying information will be removed during the analysis step.
16. Processing of personal data after the end of the study
Participants’ personally identifiable information and participants’ consent forms will be kept securely, in the manner stated in clause 15, for three years following the completion of the study (i.e. until November 2022). All data on energy use and energy-relevant behaviours collected during the ENERGISE project will be securely stored in pseudonymised form for a minimum period of five years.
17. Your rights
Article 7 of the GDPR states:
1. Where processing is based on consent, the controller must demonstrate that the data subject has consented to processing of his or her personal data.
2. If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.
3. The data subject shall have the right to withdraw his or her consent at any time.
Article 15 of the General Data Protection Regulation:
1. The data subject shall have the right to know what your personal information is about in the project. You can also request a copy of the personal data processed
a. the purposes of the processing;
b. the categories of personal data concerned;
c. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
d. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
e. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
f. the right to lodge a complaint with a supervisory authority;
g. where the personal data are not collected from the data subject, any available information as to their source;
h. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
2. If personal data is being transferred to a third country or to an international organisation, the data subject must be notified and told of the appropriate safeguards.
Article 16 Right to rectification:
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Article 17 Right to erasure (‘right to be forgotten’):
1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
a. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b. the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
c. the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
d. the personal data have been unlawfully processed;
e. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
f. the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
Article 18 Right to restriction of processing:
1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
a. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
b. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c. the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
d, the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
2. Where processing has been restricted under paragraph 1, personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing:
The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
Article 20 Right to data portability:
1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
a. the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
b. the processing is carried out by automated means.
2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
Article 21 Right to object:
1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
5. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Right of appeal
You have the right to file a complaint with the Data Protection Officer if you are considering that
the processing of your personal data is in violation of existing data protection legislation. The contact person for the rights to be investigated is the Data Protection Officer, contact information
notice in section 4.
Local ELL implementing partners can be approached for complaints at any stage. Participants also have the right to lodge a complaint with a supervisory authority such as the UK Information Commissioner’s Office.
Respondents’ personally identifiable information and participants’ consent forms will be retained for three years following the completion of the study (D9.1). All data on energy use and energy-relevant behaviours collected during the ENERGISE project will be securely stored in anonymised form for a minimum period of five years (D1.1). After the successful conclusion of the ENERGISE project, anonymous research data will be made available to colleagues who wish to replicate the research or elaborate on its results.
Relevant contact details
|
Organisation |
Primary contact |
Data Protection Officer |
Supervisory Authority |
|
KUL |
Audley Genus 0208 417 5665
|
DPO@kingston.ac.uk |
Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Telephone: 0303 123 1113 or 01625 545745
Fax: 01625 524510
Email: casework@ico.org.uk
|