Privacy notice: Research Excellence Framework 2021

This privacy notice tells you what to expect the University of Central Lancashire (UCLan) to do with your personal information when we use it for the purposes of the REF2021. Personal information (or personal data) is any information which relates to and identifies you. Data protection legislation (the General Data Protection Regulation (GDPR) and the Data Protection Act 2018) set out how we should handle your personal information.

This privacy notice applies to the following groups of individuals:

• Current UCLan employees who were employed during the REF Assessment Period who are considered to be eligible for submission to REF (category A eligible).
• Former UCLan employees employed during the REF assessment period who were eligible for submission to the REF at the time of ceasing employment and who have generated research outputs that were generated while they were employed at the University during the REF Assessment Period.
• Individuals who are not employed by UCLan but who have provided information e.g. testimonials concerning the development of impact case studies in relation to the University’s preparations for the REF2021 exercise.

The University of Central Lancashire Higher Education Corporation is the data controller for the personal information we process, unless otherwise stated. We are registered with the Information Commissioner’s Office and our registration number is Z5512420.

There are many ways you can contact us, including by phone, email, social media and post. 

You can also contact the Research Excellence Unit.

UCLan’s Information Governance Manager & Data Protection Officer can be contacted on via email. Further information and contact details can be found on our Data Protection web page.

The University will use information contained in impact case studies, environment statements and research outputs.

You may have provided information for one or more impact case studies or environment statements as part of our submission to the REF2021. These narrative statements may include identifying information such as your name, job title and organisational affiliation.

We will use other information such as your date of birth, research groups, and contract dates along with details of your research. We may also use information you voluntarily disclose to us about your personal circumstances, which could permit us to submit your information to the REF without the ‘minimum of one’ requirement (without penalty), or to submit a reduced number of outputs without penalty.

You can find further information about the types of data being collected on the REF website. The majority of information can be found in the document 2019/01 'Guidance on submissions'. Annex G of that document sets out the data that we will be required to include in our REF submission. This document also includes further details about reductions in outputs and what information needs to be submitted in those circumstances.

Your information will be used to support the development and submission of UCLan’s return to REF2021. This may include the provision of information to external parties for peer review ahead of submission, including statements and data which may identify you. Once submitted, your information will be used by the REF team based at Research England (RE), which manages the REF nationally on behalf of the four UK higher education funding bodies. RE is part of UK Research and Innovation (UKRI). Once we have submitted your personal data to the REF team at RE, UKRI becomes a data controller for that information for GDPR purposes.

The purpose of the REF2021 is to assess the quality of UK research and to inform the selective distribution of public funds for research by the four UK higher education funding bodies. The REF2021 outcomes are used to calculate about £2 billion per year of public funding for universities’ research and affect their international reputations. The results also inform strategic decisions about national research priorities. The next REF will be undertaken in 2021.

The REF was first carried out in 2014, replacing the previous Research Assessment Exercise. It included for the first time an assessment of the broader impact of universities’ research beyond academia: on the economy, society, culture, public policy and services, health, the environment and quality of life, within the UK and internationally.

Impact is assessed through the submission of case studies which describe the changes or benefits brought about by research undertaken by researchers at UCLan. Impressive impacts were found across all disciplines, with 44 per cent of submissions judged to be outstanding. You can view a database of case studies submitted in 2014.

The University can only process personal data about you if there is a lawful basis from the GDPR which allows us to do so. The lawful bases on which we rely for processing this type of information are as follows:

Article 6(1)(e), which allows us to process personal data where it is necessary to perform a task in the public interest. The REF is carried out on behalf of UKRI to fulfil one or more of its statutory functions. The processing UCLan undertakes is necessary to enable the performance of these statutory functions in the public interest.

Where we process information which is special category data for the purposes set out in this notice (special category data is information about your race, ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used for ID purposes, health, sex life or sexual orientation), we rely on the following legal bases from the GDPR and DPA:

Article 9(2)(g) GDPR, which allows us to process special category data if the processing is necessary in the substantial public interest and there is a basis to do so in law. The law which allows us to rely on this basis is section 10 DPA by virtue of Schedule 1(6) DPA, which relates to processing that is necessary for a statutory function (namely UKRI’s statutory functions). Further information about the safeguards we have in place when processing personal data for these purposes can be found in the policy Data Protection: Processing special category data and criminal convictions data.

Article 9(2)(j) GDPR, which allows us to process special category data for archiving, scientific or historical research purposes or statistical purposes, where there is a basis to do so in law. The law which allows us to rely on this basis is section 10 DPA by virtue of Schedule 1(4) DPA.

Article 9(2)(a) GDPR, which allows us to process special category data where you provide us with your explicit consent to do so.

We only share your personal data with another person or organisation where the law allows us to and we consider it to be appropriate under the circumstances.

For the purposes of the REF, we will share your personal data with the following parties:

• Research England (RE) which manages the REF nationally on behalf of the four UK higher education funding bodies. RE is part of UK Research and Innovation (UKRI). Once we have submitted your personal data to the REF team at RE, UKRI becomes a data controller for that information for GDPR purposes.

UKRI may pass your data, or parts of it, to any of the following organisations that need it to inform the selective distribution of public funds for research and to carry out their statutory functions connected with funding higher education:

• Department for the Economy, Northern Ireland (DfE).
• Higher Education Funding Council for Wales (HEFCW).
• Scottish Funding Council (SFC).

Some of your data (Unit of Assessment, HESA staff identifier code and date of birth) will also be passed to the Higher Education Statistics Agency (HESA) to enable it to verify coded data returned to it as part of our HESA staff return. Data returned to the REF will be linked to that held on the HESA staff record to allow UKRI and the organisations listed above to conduct additional analysis into the REF and fulfil their statutory duties under the Equality Act 2010 (England, Wales and Scotland) or the Northern Ireland Act 1998 (Northern Ireland).

UKRI and the organisations listed above will use the information to analyse and monitor the REF2021. This may result in information being released to other users including academic researchers or consultants (commissioned by the funding bodies), to carry out research or analysis, in accordance with the Data Protection Act 2018 and the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). Where information not previously published is released to third parties, this will be anonymised where practicable.

UKRI will require that anyone who has access to your data, held in UKRI’s records, paper or electronic, will respect its confidentiality and will only process it in accordance with instructions issued for the purposes specified by UKRI.

Parts of your data will be passed to the REF expert panels and the Equality and Diversity Advisory Panel (whose members are independent of UKRI) for the purpose of conducting a systematic evaluation of submissions, in accordance with predetermined criteria and methods. Panels will make judgments about the material contained in submissions and will not form quality judgments about individuals. All panel members are bound by confidentiality arrangements.

To see how UKRI will process your personal data once we make our REF submission, view its privacy notice.

• Data processors: We may also disclose your information to other organisations so that they can provide services on our behalf e.g. hosted IT services and systems. These organisations are called data processors. We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will hold it securely and retain it for the period we instruct. One such data processor is Vertigo Ventures, which provides our REF impact tracker system and hosts the data stored within the system. For further information about this system, please contact the Research Excellence Unit.
• Peer reviewers who are external parties who will review our proposed entries prior to submitting to RE.

Publishing information about your part in our submission

The results of the assessment exercise will be published by UKRI on behalf of the four UK higher education funding bodies in December 2021. The published results will not be based on individual performance nor identify individuals.

Those parts of submissions that contain factual data and textual information about research activity will also be published by UKRI on behalf of the four UK higher education funding bodies and will be made available online. Published information is likely to include textual information including impact case studies in which you may be referenced. Your name and job title may be included in this textual information. Other personal and contractual details, including your date of birth and all information about individual staff circumstances will be removed. We will check impact case studies and environment templates prior to submission to ensure that personal information (other than names and job titles) are removed. UKRI will also publish a list of the outputs submitted by us in each UOA. This list will not be listed by author name.

Occasionally we may need to send your personal information outside the European Union/European Economic Area (EU/EEA) e.g. to obtain a service from a data processor. We only transfer personal data outside the EEA if there is a lawful basis to do so and appropriate safeguards are put in place to protect your information and ensure it remains secure. UKRI does not store any of the data we submit for the REF outside the EEA.

UCLan will retain information relevant to the REF2021 exercise for up to 20 years following submission to RE. After 20 years, information with potential historical value will be presented to the University Archives for permanent preservation.

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. Further information about each of these rights can be found on the Information Commissioner’s Office website.

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. For further information or to make a request, please see our Data Protection web page.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances.

Your right to object to processing

You have the right to object to any processing we carry out, if we carry it out on the basis that it forms part of our public task or is in our legitimate interests. You also have the right to object to your personal information being used for direct marketing purposes.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information because we have your consent or because you have a contract with us and it is necessary for the performance of that contract, and the processing is automated.

We work to high standards when it comes to processing your personal information. If you have queries or concerns, please contact the Information Governance Manager & Data Protection Officer, and we will respond.

If you remain dissatisfied, you can make a complaint about the way we process your personal information to the Information Commissioner’s Office, which is the UK supervisory authority for data protection. Further information can be found on our Data Protection webpage.