What information do we collect?
What is the legal basis for processing personal data?
Our legal basis for collecting and processing personal data includes:
- Carrying out a public task in the public interest. This includes historical, statistical and research purposes.
- Carrying out duties to comply with the Equality Act 2010.
- Legitimate interests. This includes facilitating communications between MSC members and organisations involved in medical education, the higher education sector and higher education funding
Sharing your information
The Medical Schools Council may share your information for several reasons. These include:
- Our obligations to comply with current legislation
- To comply with a court order
- The Medical Schools Council have received explicit consent from you for disclosure
Your personal data will not be transferred outside of the European Union, to third countries or international organisations.
Use of cookies
When you visit our website, we may store some information on your computer. This information will be in the form of a 'cookie' or similar file and can help us in many ways. With most browsers you can erase cookies from your computer hard drive, block all cookies or receive a warning before a cookie is stored.
Retaining information
The Medical Schools Council will retain the data for as long as it is necessary. Some data may be retained permanently for historical, statistical and research purposes, and will subject to regular review. This is in line with the General Data Protection Regulation (2018) as the information will not be used to make decisions about individuals.
Contact us
You can contact us:
- By email on the contact page
- By post: Medical Schools Council, Woburn House, 20 Tavistock Square, London, WC1H 9HQ
Data Protection details
The Medical Schools Council is a ‘data controller’ under the General Data Protection Regulation (2018). The Information Commissioner has been notified that we process personal data and the details can be found on the Information Commission’s Office website.
Your rights
Under the General Data Protection Regulation (2018), you have a right
- of access to the data that the Medical Schools Council holds about you
- a right to object to processing that is likely to cause or is causing damage or distress
- a right to prevent processing for direct marketing
- a right to object to decisions being taken by automated means
- a right in certain circumstances to have inaccurate personal data rectified, blocked, erased or destroyed
- a right to claim compensation for damages caused by a breach of the Regulation
You may have to pay a small fee to access the data held about you, and provide additional information so that your unique data can be identified by us.
Changes to our privacy policy
The Medical Schools Council privacy policy is regularly reviewed. Any updates to the privacy policy will be made available on this webpage.
Clinical Academic Staff Survey
Data collection Privacy Notice
Every year, medical schools send some of the information held by them about clinical academic staff employed with a substantive university contract and an honorary NHS contract (you, your), to the Medical Schools Council (MSC, we, us, our).
The MSC is the data controller responsible for the database in which the personal data collected from medical schools is stored and the use of the personal data for the purposes set out in this Privacy Notice (e.g. to carry out analysis, produce aggregated statistics and publish the results of the survey containing those aggregated statistics). The data is collected and used for legitimate and lawful purposes, including meeting the aims of the MSC.
You have the right to object to your personal data being provided to the MSC and can exercise that right by contacting your medical school.
We have taken steps to ensure that we comply with our obligations under applicable data protection laws (including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018) when collecting and further processing your personal data, as outlined in this Privacy Notice.
In this Privacy Notice, where we use the words personal data we use these words to describe information that is about you and which identifies you (see below for a description of the personal data that we will hold about you).
In relation to the personal data we use, we are also registered as a data controller with the Information Commissioner's Office (ICO) (registration number: ZA043047).
When does this Privacy Notice apply?
This Privacy Notice sets out how your personal data will be provided to us in connection with the Clinical Academic Staff Survey (the Survey), how it will be used by us and what your legal rights are.
Please note however that while we always aim to provide complete and transparent information about how we process your personal data, we reserve the right to update this notice from time to time in order to accurately reflect changed circumstances or new legal requirements. In the event that we make any changes to this Privacy Notice, where appropriate, we will give you reasonable notice of those changes.
What personal data is collected about you as part of the Survey?
The types of personal data we collect for purposes of the Survey include:
- Identity data: identification numbers, date of birth, nationality and gender; and
- Employment data: employment and contract information including details of Clinical Excellence Awards, salary, clinical specialty and academic grade held.
As part of the Survey, we may also collect limited amounts of “special category personal data” relating to your race or ethnic origin if this information is held by our Member (as defined below) and they are willing to provide such information to us. It is for each medical school to determine if they are permitted to share your personal data with us.
Please note that your personal data will be aggregated into statistical results and it is only this aggregated information which will be published online as part of the Survey results on our website. Whilst the aggregated information has been subject to anonymisation techniques, there is a low risk that this information may be used to identify you. For more information on how and why your personal data is collected and how it will be processed by us for use in the Survey, please see below.
How do we collect your personal data?
The personal data we collect is from information that you provide to your medical school(s) (our Member) or information that they otherwise hold about you and which our Members in turn provide to us. The Member may not identify you by name when providing us with this personal data. However, this will still constitute personal data as we may be able to identify you from that information as it is provided on an individual level. We do not collect personal data from you directly and will not obtain your personal data from any other third party sources (including publicly accessible sources). A full list of our current Members can be found on our website.
Why do we collect your personal data?
We only collect your personal data in order to operate and administer the Survey. The main purpose for which your personal data is processed in connection with the Survey is set out below:
- Enabling national research on the clinical academic workforce;
- Monitoring trends in clinical academic staffing as a basis for partnership between the NHS and universities;
- Monitoring equality information relating to race, ethnicity and gender; and
- Promoting, maintaining and improving high quality education, research and clinical practice in the United Kingdom.
In the event that we intend to process your personal data for any purpose other than those listed above, we will notify you of that intended purpose in advance. Where this involves the provision of further privacy information as required under applicable data protection laws , then we will also provide you with that information prior to processing your data.
Do we conduct automated decision making?
No decisions will be made about you, your role or status as a clinical academic as a result of information gathered as part of the Survey, whether by automated or manual means.
What is the legal basis for processing your personal data?
Under the UK GDPR, we are required to have a legal basis whenever we collect or use your personal data. Examples of where we have a legal basis to process your personal information, includes when:
- we have your consent;
- it is necessary to enter into or perform a contract we have with you (or to take steps at your request prior to entering into that contract);
- it is necessary to comply with a legal obligation;
- it is necessary in order to protect your vital interests; or
- it is in our legitimate interests to process your personal information.
Legitimate interests
For the purposes described above our legal basis for collecting and processing your personal data is that it is necessary for the purpose of pursuing legitimate interests. Those interests include the benefit to us in being able to conduct and share the results of meaningful research, but also to the wider public as taxpayers and users of national healthcare systems in terms of ensuring that there are sufficient Clinical Academics in post to carry out biomedical research. This is important research from a public health perspective, without which it would be difficult to identify trends in Clinical Academics which could in turn lead to insufficient individuals within those roles. Such a failure would result in reduced advancement within the field of medical research, ultimately resulting in less favourable patient outcomes. In addition, the performance of statistical analysis enables equalities monitoring, assists central and local government with strategic planning, and provides Clinical Academics with greater transparency on the trends and opportunities within the sector.
We will only rely on this basis where we are confident that the interests pursued are not outweighed by the potential risks to you, taking into account the lack of available alternatives for achieving the same results. We have conducted a detailed assessment of those interests for this purpose which will be reviewed on an ongoing basis, as appropriate.
What is the legal basis for processing special category data?
'Ethnicity' or 'race' data are the only special category data collected in the Survey for the purposes of the UK GDPR. Where we process special category data relating to ethnicity or race, then we will do this relying on legitimate interests and the legal basis listed below.
'Ethnicity' or 'race' data is collected in the substantial public interest from an equal opportunities perspective so that MSC can identify or keep under review the existence or absence of equality of opportunity or treatment with a view to enabling or promoting equality and diversity. MSC relies on Article 9(2)(g) of the UK GDPR, the processing is in the substantial public interest, in conjunction with Paragraph 8 of Schedule 1, Part 2 of the Data Protection Act 2018.
How long do we store your personal data?
We will only retain your personal data for as long as is necessary in order to achieve the purposes of processing. Some data may be retained for longer periods for scientific or historical research purposes or statistical purposes in which event technical and organisational measures will be put in place to protect that data and those measures along with the retention periods for that data will be subject to regular review.
How do we keep your personal data secure?
We have implemented appropriate technical and organisational measures to protect your personal data from being accidentally lost, used, altered, disclosed or accessed in an unauthorised way. In addition, we limit access to your personal data to those employees, agents, contractors and service providers who have a business need to know.
In the event that we experience any intrusion of our information systems or otherwise suffer a breach of our data security, then we have in place specific procedures designed to deal with such a breach, including protecting the personal data within our control and, where we are legally obliged to do so, notifying you and the relevant authorities.
Who do we share your personal data with?
We may share the contents of Survey responses with third parties only to the extent this is necessary for those parties engaged to act on our behalf in providing or facilitating technical solutions or services (e.g. IT service providers) in connection with the purposes (for more information see 'Why do we collect your personal data?' above).
Otherwise, we may share your personal data with:
- The General Medical Council (GMC). We share your personal data, including any personal data we have collected about you to date in respect of the Survey, so that the GMC may link the contents of the Survey responses with other data that the GMC holds for inclusion in the UK Medical Education Database (UKMED). Your personal data will be pseudonymised before being made available in the UKMED (meaning that your identifying data (e.g. your name) will be removed before being included in the UKMED so that those who access the UKMED cannot readily identify you). The UKMED is not accessible to the general public. Those who wish to access the UKMED must pass an application process and access is limited to those who require access for research purposes. Controls are in place to restrict use of the data so that it should not be used by any individuals to: (i) identify you, (ii) reproduce the data in any form which would allow a third party to identify you, or (iii) enable you to be contacted. Once your personal data is shared with the GMC, the GMC will be controller of your personal data and will process it in accordance with its privacy notice which can be located here: Privacy and cookies - GMC (gmc-uk.org);
- Regulators and governmental authorities, pursuant to our obligations to comply with applicable legislation; and
- Courts and legal advisors, where necessary to comply with a court order or to bring or defend legal claims.
Do we transfer your personal data overseas?
Your personal data will not be transferred outside of the UK, to the European Economic Area, third countries or international organisations.
What are your data protection rights?
Under data protection law you have rights in relation to your personal data, including the rights summarised below. However, please note that not all of these rights apply in each case and may be subject to applicable exceptions.
Your right of access - You have the right to ask us for copies of your personal information that is within our control and information about how we use it.
Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, then we will endeavour to respond to you within 1 month of receipt.
Questions or complaints?
If you have any questions or concerns about our use of your personal data, then please contact us at:
Email: admin@medschools.ac.uk
Address:
Medical Schools Council
Woburn House
20 Tavistock Square
London
WC1H 9HD
While we would always welcome the opportunity to resolve any complaints you might have in the first instance, you also have the right to complain to the Information Commissioners Office (ICO). The ICO can be contacted by telephone or in writing, using the contact information provided below.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk