Who is collecting my data?
The Department for Digital, Culture, Media & Sport (“DCMS”, “we”, “us”) are the data controllers of certain personal data such as First name, last name, Address, postcode, gender and occupation for the purposes of the Events Research Programme (explained above). DCMS themselves do not access any of your personal data as we ask others to process your data.
Why are we collecting your data?
We are collecting your data to allow a full assessment of the risks associated with coronavirus transmission for participants attending mass events, and to understand the extent to which mitigation measures can effectively address these risks.
What is the legal basis for processing my data?
DCMS do not directly collect or see any personal data, however we are defined as the controller under UK. GDPR Art. 4, 'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
To process this personal data, our legal reason for collecting or processing this data is: Article 6(1) e; processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Admission to the venues implies that you have had a negative Lateral Flow Test result which is classed as health data. The venue relies on the UK.GDPR Art. 9 (2) h. processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of domestic law or pursuant to contract with a health professional and subject to the conditions and safeguards.
The venue will also rely on UK. GDPR Art. 6 (1) b processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
The lawful basis that we rely on to process your personal data will determine which of the following rights are available to you. Much of the processing we do in DCMS will be necessary to meet our legal obligations or to perform a public task. If we hold personal data about you in different parts of DCMS for different purposes, then the legal basis we rely on in each case may not be the same.
What personal data do we collect?
DCMS does not directly collect any of your data, the personal data is collected by the ticketing agent. This data [will always] include: First name, last name, address, postcode, date of birth and email addresses. It may also include collection of the following data Gender and occupation this is to help the researchers make comparisons between data sets. The ticketing agent then shares that data with the Department for Health and Social Care/Test and Trace/Public Health England. When you take the Covid tests that data will remain within the NHS it will not be shared with any other party.
How secure is your information with third party service providers?
All our third-party service providers are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes unless they are data controllers in their own right in relation to your personal data. The event holder or a third-party ticketing agent is the data controller for the data gathered to issue the tickets. Some of that data is then shared with DHSC, where they operate as our “data processors” (ie they process your personal data on our behalf and acting only on our instructions), we only permit them to process your personal data for specified purposes and in accordance with our instructions
What will happen if I do not provide this data?
If you do not provide you consent to enter the programme and provide your data, you will not be invited to the events.
I confirm that I have read and have understood the information sheet contained here explaining the information that will be collected and have had the opportunity to consider the information.
I understand that all personal information I provide will be safeguarded and protected according to data protection legislation. It will be held in an anonymised format and only accessed by those with a research need.
The research programme is being run by the following government departments, university partner organisations and businesses. We will share your data with these bodies who are acting as processors of your personal data.
- Department for Digital Culture Media and Sport
- Department of Health and Social Care
- Department for Business, Energy and Industrial strategy
- Researchers in accordance with the Information Sheet on Research Studies (below)
I understand that all data including signed consent forms, demographic information, test results and audio/video recordings and interview transcripts will be retained for up to 6 years although anonymised data may be kept for longer periods.
I understand that, under the Data Protection Act 2018, I can ask at any time for access to/destruction of the information I provide, which will be possible if I provide contact details at the end of the survey.
I understand that taking part in a study may involve an individual interview which will be audio recorded. Separate consent will be sought in relation to participation in any interview.
I understand that my participation in any interview is voluntary and that I am free to stop taking part at any time without giving any reason and without my rights being affected. In addition, I understand that I am free to decline to answer any particular question or questions.
I understand that the confidentiality of the information I provide will be safeguarded. However, if I disclose information which raises serious concerns over the immediate safety of myself or others, with prior discussion, I understand that the researcher may be required to disclose some of my confidential information to an appropriate health professional.
I understand that the information I provide will be held securely. It will be anonymised and in line with data protection requirements and will only be accessed by researchers working on this or related studies.
I understand that I will not be identified or identifiable and give permission for quotes to be used in the report or reports that result from the research.
We will not use your data for any automated decision making. We will not be sending your personal data outside the U.K.
What are your data protection rights?
You have rights over your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). The Information Commissioner's Office (ICO) is the supervisory authority for data protection legislation and maintains a full explanation of these rights on their website. https://ico.org.uk/
Information Commissioner's Office
The contact details for the data controller's Data Protection Officer (DPO) are:
Data Protection Officer
The Department for Digital, Culture, Media & Sport
100 Parliament Street
If you’re unhappy with the way we have handled your personal data and want to make a complaint, please write to the department’s Data Protection Officer or the Data Protection Manager at the relevant agency. You can contact the department’s Data Protection Officer using the details above.
If you have any concerns, issues or queries regarding the study or how it will be undertaken please contact email@example.com
I consent to participate in the Events Research Programme and for my data to be used by the programme.