Director of Legal and Governance

You have already applied for this vacancy, please go to your account to see your progress.

Metropolitan Thames Valley Housing​ Privacy Statement

The following explains how we Metropolitan Thames Valley Housing (Controllers) intend to use the information you provide in your application, along with your rights, our reasons for requesting it and who will have access to it.

As defined by the General Data Protection Regulation (GDPR) Metropolitan Thames Valley Housing is the Data Controller and ultimately responsible for ensuring the data you provide is kept secure, processed correctly and that you understand your legal rights in relation to the data you provide.

The recruitment software we use via this website is supplied by IRIS Software Group Limited and they are defined as a Data Processor under the GDPR. They will only process your data in accordance with our instructions.

IRIS can be contacted at: 4th Floor Heathrow Approach, 470 London Road, Slough, England, SL3 8QY

For Data Protection enquiries, please contact the Help Desk at support@networxrecruitment.com

1.1 This Policy sets out our commitment to protecting personal data and how we
implement that commitment with regards to the collection and use of personal data in
line with the legal requirements contained in the General Data Protection Regulation
(‘GDPR’)

1.2 We are committed to ensuring that we comply with the data protection principles and
the other requirements of GDPR.

1.3 The data protection principles that we comply with as set out in GDPR are as
follows:

• Fairly and lawfully processed;
• Processed for limited purposes;
• Adequate, relevant and not excessive;
• Accurate;
• Not kept for longer than necessary;
• Processed in line with your rights;
• Secure;
• and Not transferred to countries without adequate protection​

[¹] References to GDPR in this policy mean the GDPR as supplemented and varied by
the Data Protection Act 2018.

2 Policy Statement and definitions

2.1 MTVH’s policy is to ensure that everyone who has dealings with MTVH has a right
to privacy and to expect that all personal information about them will be handled
sensitively and with due regard to its confidentiality.

2.2 This policy covers, but is not limited to, personal data and special categories of
personal data as defined by GDPR.

2.3 Personal data is defined as any information relating to an identified or identifiable
living person (‘data subject’); an identifiable living person is one who can be identified,
directly or indirectly, in particular by reference to an identifier such as a name, an
identification number, location data, an online identifier to one or more factors specific to
the physical, physiological, genetic, mental, economic, cultural or social identify of that
living person.

2.4 Special categories of personal data is separately defined within the GDPR and
covers racial or ethnic origin, political opinions, religious or philosophical beliefs or trade
union membership, processing of genetic data, biometric data for the purpose of
uniquely identifying a natural person, data concerning health or data concerning a
person’s sex life or sexual orientation.

2.5 MTVH will:

2.5.1 comply with the law regarding the protection and disclosure of information, treat all
personal and sensitive organisational information as confidential.

2.5.2 not disclose personal information without the prior express consent of the
individual concerned, except in the circumstances outlined below in the section on
disclosure.

2.5.3 Not gain or attempt to gain access to unauthorised information.

2.6 All staff have a duty to respect confidentiality of personal information held by MTVH.
In meeting this duty staff are expected to exercise judgment and common sense.

2.7 MTVH has nominated a member of staff to act as MTVH Data Protection Officer
(DPO). All enquiries regarding data protection must be passed to the Data Protection
team at dataprotection@mtvh.co.uk.

2.8 The GDPR is enforced by the Information Commissioners Office which has
extensive powers under the GDPR to take action against organisations which breach
data protection law. This includes substantial fines as well as other regulatory action
such as enforcement notices.

2.9 MTVH is also regulated by the Homes and Communities Agency (HCA) which as
part of the Governance and Financial Viability Standard of the Regulatory Framework,
requires all registered providers of social housing to adhere to all relevant law. This
includes the GDPR.

3 Data Protection – Policy

3.1 Employees and residents have a right to view personal information about
themselves and their family. They are entitled to know:-

• what data is held or otherwise processed about them
• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data
  subject or to object to such processing;
• the right to lodge a complaint with the ICO;
• where the personal data is not collected from the data subject, any available information as to their source;
• the existence of automated decision-making, including profiling and in those cases at least, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

Note that “processing” is widely defined under the GDPR and includes obtaining,
recording and keeping information as well as using it. MTVH will collect, maintain,
process and retain such personal data as is necessary for the proper administration of
its business activities. It is difficult to imagine anything which MTVH might do with
personal data which would not amount to processing.

3.2 MTVH will only collect and process personal data if one or more of the conditions
set out in Article 6 of the GDPR have been satisfied. The relevant conditions for TVH’s
activities are:

• processing is necessary for the purposes of the legitimate interests pursued by MTVH or by a third party, except where such interests are overridden by the
  interests or fundamental rights and freedoms of the resident or employee which require protection of personal data, in particular where the data subject is a child.
• the express consent of the resident or employee is obtained prior to the processing of personal data. Consent must be freely given; it must also be specific and informed. It must be given by an unambiguous statement or by clear affirmative action signifying the data subject’s agreement to the processing. In practice this means that wherever possible consent should be obtained in writing and signed by the subject with clear wording in plain English explaining precisely what they are agreeing to. Where written consent is not possible, verbal consent can be given but the terms of the consent must be clearly given to the subject and a written record of the consent kept;
• processing is necessary for the performance of a contract to which the resident or employee is party or in order to take steps at the request of the resident or employee prior to entering the contract;
  processing is necessary for compliance with a legal obligation to which MTVH is subject;
• processing is necessary in order to protect the vital interests of the resident or employee or of another natural person;

3.3 Personal information – especially special categories personal information – about
employees and residents is shared only with staff who need to know the information in
order to carry out their legitimate duties. This may involve sharing information between
individuals in different departments. Where appropriate, MTVH sets up protocols to
clarify how this operates in practice to ensure that only those people who have a need
to know are able to access personal data of employees or residents.

3.4 MTVH will only collect and process special categories personal data if one of the
conditions set out in Article 9 of the GDPR or Schedule 1 of the Data Protection Act
2018 have been satisfied. The relevant conditions for MTVH’s activities are:

• the data subject has given explicit consent to the processing of the personal data for one or more specified purposes. Consent must be freely given as set out in clause 3.2 (Article 9 GDPR);
• processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment law and the controller has an appropriate policy document in place (Article 9 and Schedule 1 DPA 2018);
• processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving consent (Article 9);
• processing relates to personal data which have been made public by the data subject (Article 9);
• processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity (Article 9);
• processing is necessary for reasons of substantial public interest. (The only categories in this subsection potentially relevant to MTVH are the administration of justice (i.e. providing information to the Court or those pursuing proceedings) ; and preventing or detecting unlawful acts) (Article 9 and Sch 1 DPA 2018);
• processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services (Article 9 and Schedule 1 DPA 2018);

These conditions are little changed from those which applied under Schedule 3 Data
Protection Act 1998 and the Data Protection (Processing of Sensitive Personal Data)
Order 2000.

4 Right of Access to Personal Information

4.1 In addition to their rights under this policy all of MTVH’s employees and residents
and anyone else in respect of whom personal data is processed have a right to ask
MTVH, under the GDPR, for personal information held about them and this section
details the information they are entitled to see under the GDPR.

4.2 The rights of our employees and residents under the GDPR are set out here for
completeness (see also MTVH’s Subject Access Request Procedure):
within one month of a written request a data subject is entitled to:-
(a) be told whether personal data, of which he or she is the subject, is held in TVH’s
records, or otherwise processed by MTVH; and
(b) be given a description of the personal data, the purpose for which the data is being
or may be processed and the persons or classes of persons to whom the data has been
or may be disclosed; and
(c) have communicated to them in an intelligible form the information constituting the
personal data held about them and any available detail as to the source of that
information; and
(d) be told the envisaged period for which the data will be stored or, if not possible, how
it will be decided when it will be destroyed; and
(e) be informed of their right to erasure of personal data; the right to object to
processing; the right to rectification of data; to restriction on processing; and the right to
object to processing; and
(f) be informed of their right to complain to the ICO.
(g) know of the existence of any automated decision-making, including profiling, and in
those cases, meaningful information about the logic involved, as well as the significance
and the envisaged consequences of such processing for the data subject.

5 Access to Personal Information Refused

5.1 MTVH reserves the right to refuse the employee or resident access to information if:

• it would identify another individual who has not consented to the disclosure Note: organisations are not covered by GDPR so information about them may be disclosed. However, to avoid any claims of breach of confidentiality, their consent should be sought and disclosure should only be made without their consent if it cannot reasonably be obtained and it is reasonable in all the circumstances to make disclosure
• it is legally privileged correspondence e.g. between MTVH and its solicitors
• the data is held for management forecasting or management planning if the disclosure is likely to prejudice that activity e.g. information about plans to promote, transfer or make a worker redundant
• information containing details of MTVH’s intentions concerning negotiations with an employee may be withheld to the extent to which access would be likely to prejudice those negotiations the information consists of a reference given or to be given in confidence by the employer for:

the education, training or employment of the worker
the appointment of the worker to any office
the provision by the worker of any service
the information is held for:
the prevention of the detection of crime; and/or
the apprehension or prosecution of offenders; and/or
the assessment or collection of any tax or duty or any other imposition of a similar
nature where access would be likely to prejudice any of the above matters
the information was provided in confidence by a third party e.g. social workers,
doctors, solicitors, local councils or the DSS
in the opinion of MTVH or a health professional it would be likely to cause serious
harm to the physical and/or mental health of a resident or another person;

the information requested relates to non-personal details such as property records or
maintenance details. The association is only obliged to provide access to personal
information about the resident and sometimes about their family.

6 Disclosure

6.1 Disclosure of personal information outside MTVH will only be made with the
informed express consent of the individual concerned except:

6.1.1 to comply with the law (e.g. the police, Inland Revenue, Council Tax Registration
Officer, Social Security Fraud Act) or a court order

6.1.2 where there is a clear health or safety risk to an individual or members of the
public, evidence of fraud against MTVH, other irregular behaviour or a matter MTVH is
investigating

6.1.3 in connection with court proceedings or statutory action to enforce compliance with
tenancy conditions (e.g. applications for possession or for payment of Housing Benefit
direct)

6.1.4 where MTVH has entered into a formal protocol with the police or a local authority

6.1.5 providing the name, address and contact number of a resident to contractors or
other agents providing services on MTVH’s behalf

6.1.6 providing the name of a resident and the date of occupancy to gas, electricity and
water companies

6.1.7 providing information anonymously for bona fide statistical or research purposes,
provided it is not possible to identify the individuals to whom the information relates

6.1.8 giving the name, address and stated local connection of applicants for housing to
parish councils who are partners in exceptions planning agreements for housing which
gives priority to people with a local connection

6.1.9 information required by the Regulator of Social Housing when monitoring MTVH’s
activities in its capacity as the regulator of housing associations.

6.1.10 the names of contractors invited to tender for works and the amounts tendered
will be made available to residents paying service charges to which the cost of the
works will be charged (Section 20 Landlord and Resident Act 1985, as amended).

7 Accuracy of Personal Information: right of rectification

7.1 An employee, resident, former resident or applicant for housing may challenge the
information held by MTVH on their particular file if they feel it to be incorrect and can
provide evidence to support this.

7.2 The right of rectification under the GDPR (Article 16) entitles the data subject to
obtain from the controller without undue delay the rectification of inaccurate personal
data concerning him or her. Taking into account the purposes of the processing, the
data subject shall have the right to have incomplete personal data completed, including
by means of providing a supplementary statement.

8 Rights of erasure, restriction on/objection to processing and withdrawal of consent

Erasure
8.1 Under the GDPR the rights of data subjects are extended to give individuals more
protection and greater control over their personal information.

8.2 The right to erasure is also known as ‘the right to be forgotten’. This enables an
employee or resident to request the deletion or removal of personal data where there is
no compelling reason for its continued processing by MTVH.

8.3 The right to erasure does not provide an absolute ‘right to be forgotten’. Individuals
only have a right to erasure where:
the personal data is no longer necessary in relation to the purpose for which it was
originally collected/processed.
where the individual withdraws consent.
where the individual objects to the processing and there is no overriding legitimate
interest for continuing the processing.
the personal data was unlawfully processed (i.e. otherwise in breach of the GDPR).
the personal data has to be erased in order to comply with a legal obligation.
the personal data is processed in relation to the offer of information society services
to a child.

8.4 MTVH can refuse to deal with a request to erase where the personal data is
processed for the following reasons:
to exercise the right of freedom of expression and information;
to enable functions designed to protect the public to be achieved e.g. government or
regulatory functions
to comply with a legal obligation or for the performance of a public interest task or
exercise of official authority;
for public health purposes in the public interest;
archiving purposes in the public interest, scientific research historical research or
statistical purposes;
the exercise or defence of legal claims; or
where the organisation has an overriding legitimate interest for continuing with the
processing

Restriction on processing

8.5 A data subject has the right to require a controller to stop processing his/her
personal data. When processing is restricted, MTVH are allowed to store the personal
data, but not further process it.

8.6 MTVH will be required to restrict the processing of personal data in the following
circumstances:
Where an individual (usually but not solely, employees or residents) challenges the
accuracy of the personal data, we must restrict processing until we have verified its
accuracy
Where an individual has objected to the processing (where it was necessary for the
purpose of legitimate interests), and we are considering whether our legitimate
grounds override those of the individual.
When processing is unlawful and the individual requests restriction instead of
erasure.
If we no longer need the personal data but the individual requires the data to
establish, exercise or defend a legal claim.
If we have disclosed the personal data in question to third parties, we must inform
them about the restriction on the processing of the personal data, unless it is
impossible or involves disproportionate effort to do so.

8.7 We must inform individuals when we decide to remove the restriction giving the
reasons why.

Objection to processing

8.8 Individuals have the right to object to processing based on legitimate interests or the
performance of a task in the public tasks/exercise of official authority; direct marketing
(including profiling); and processing for purposes of scientific/historical research and
statistics.

8.9 The only category relevant to MTVH is where we process personal data for the
purposes of our legitimate interests. In that case, where an individual (resident or
employee) objects, we must stop processing the personal data unless:
we can demonstrate compelling legitimate grounds for the processing, which
override the interests, rights and freedoms of the individual; or
the processing is for the establishment, exercise or defence of legal claims.

Withdrawal of consent

8.10 An individual has the right to withdraw consent at any time.

8.11 If the basis on which personal information is being processed is the consent of the
individual, then that processing must stop.

8.12 It may be that another reason for processing can be relied on such as legitimate
interests.

8.13 In practice a withdrawal of consent is likely to be accompanied by a request to
erase in which case MTVH will need to rely on one of the other exceptions to erasure
e.g. overriding legitimate interest.

9 Review

9.1 This policy will be reviewed from time to time to ensure that it continues to meet the
needs of MTVH and is in line with current legislation.

We use some automated screening tools as part of this application process. The answers you provide to one or more of the questions (excluding any special categories/equal opportunity questions) may result in your application being automatically declined. This technology is used to help us manage the high volume of applications we receive and can assure applicants the same outcome would occur if we manually reviewed your application. The reason for the decline will be made available to you in your candidate account.

How can I access the information you hold about me? Your rights

We are dedicated to providing reasonable access to visitors who wish to review the personal information retained when they apply via our website site and correct any inaccuracies it may contain. If you choose to register, you may access your profile, correct and update your details, or withdraw your details at any time. To do this, you can access your personal profile by using the secure login. In all cases we will treat requests to access information or change information in accordance with applicable legal requirements.

You have the following rights in relation to the way in which we deal with your personal data:

• the right of erasure or to be forgotten
• the right to rectification if information is inaccurate or out of date
• the right of data portability (to obtain and reuse your personal data)
• the right to object to networx and the controller and processors handling of your personal data
• the right to withdraw your consent with regards to the handling of your personal data
• you have the right to ask for a copy of the information we hold about you (Subject Access Request - S.A.R)
• You have the right to lodge a complaint with a supervisory authority - the ICO

Within your candidate account, you can also use the Download Data feature to generate an XML file of the current data we hold on you that you have provided and/or have access to within the account.

Where you exercise your right to object or withdraw your consent we may process your personal data without your knowledge or consent where we are permitted or required by law or regulatory requirements to do so. In such a case, we will not process more personal data than is required under the circumstances.

If you are not satisfied by our actions, you can seek recourse through our internal complaints procedure. If you remain dissatisfied, you have the right to refer the matter to the Information Commissioner (www.ico.org.uk) or seek recourse through the courts.

Metropolitan Thames Valley Housing can exercise the right to update this policy as and when required.