Skills Academy Wales Privacy Notice - Version 5 - Protection and Use of Learner Data

Data Protection Act 2018 and the UK General Data Protection Regulation

​

1 : The Data Protection Act 2018 (DPA) and the UK General Data Protection Regulation (GDPR) regulate the processing of personal data in any format, including both digital and hard copy personal data and all other formats, by sub-contractors who are contracted to deliver training programmes on behalf of Neath Port Talbot College (known as NPTC Group of Colleges) under the branding name of Skills Academy Wales (‘the Partnership’).  ‘Personal data’ is any information relating to a living individual, and 'processing' is any activity carried out involving personal data, including holding and storing it.  This statement applies under both the DPA and GDPR or any successor legislation to the GDPR or the DPA. 

​

2 : This statement establishes Skills Academy Wales procedures governing the collection and release of learner data and is provided to learners at the application and registration stages.  It includes information about how learner data is used, and where it is supplied by the Partnership to the Welsh Government and other external parties. 

​

3:  Sub-contractors are contracted to deliver training programmes under the Neath Port Talbot College work-based learning contract.  These sub-contractors act as data controllers for all personal data that the individual organisation holds and processes. Neath Port Talbot College is considered as a separate data controller, having sole responsibility for all personal data that it holds and processes, except where it is done in the capacity of a data processor on behalf of another data controller. 

​

4:  For further information about the data which the Partnership holds and its use, or if you wish to exercise your rights under GDPR, please contact: 

Skills Academy Wales Manager 

Skills Academy Wales 

NPTC Group of Colleges 

Dwr y Felin Road 

Neath 

SA10 7RF 

0330 818 8108 

sawadministration@nptcgroup.ac.uk 

NOTIFICATION TO APPLICANTS AND REGISTERED LEARNERS 

​

5 : The Partnership may obtain, hold and process the personal data of learners including personal details, family and social circumstances, education and training records, employment information, financial details, and services provided.  It may obtain, hold and process the sensitive personal data (the term used by the DPA) and special category data (the term used by GDPR) of learners including racial or ethnic origin, religious or philosophical beliefs, biometric data, and physical or mental health.  

​

6 : Personal data and sensitive personal data/special category data held by the Partnership relating to learners is obtained directly from the learner or applicant, or in some cases from a third party organisation involved in the services provided by the Partnership that has obtained the information in the first instance, for example local authority schools involved in learner recruitment, careers service and social services for Looked After Children. 

​

7: The Partnership holds the personal data and sensitive personal data/special category data of its learners in order to implement and manage all services and processes relating to learners, including learner recruitment,  enrolment, teaching and learning, examination, graduation and other services such as travel and accommodation, student support and careers.  Only information required for these purposes is obtained and processed, and without it the Partnership may not be able to provide its services.  Information is passed between various sections of the Partnership for operational reasons as is necessary and proportionate for intended purposes. 

​

8: Learner personal data is collected and processed by the Partnership as it is necessary for the performance of the contract under which the Partnership provides services to learners.  Some processing activities may also be carried out under a legal obligation (for example, disclosing personal data to external parties under statutory powers), where it is necessary to protect the vital interests of the learner or another party (for example, disclosures to external parties to ensure the safety and wellbeing of individuals), where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (for example, collecting or disclosing information in order to meet regulatory or statutory requirements), or where it is necessary for legitimate interests pursued by the Partnership or a third party (the legitimate interests will relate to the efficient, lawful and proportionate delivery of services and will not be to the detriment of the interests or rights of individuals).  Where any of these legal bases do not apply, the consent of an individual to process their personal data will be sought.  

​

9: Where learners’ sensitive personal data/special category data is collected and processed by the Partnership this will be on the legal basis of explicit consent of the learner, employment or social security/protection requirements, protecting the vital interests of the learner or another party, the exercise or defence of a legal claim, reasons of substantial public interest, purposes of medical or health care, or where the information has been made public by the learner.  Any processing will be proportionate and relate to the provision of services by the Partnership.  When this data is used for monitoring and reporting purposes it will be anonymised or pseudonymised if possible. 

​

10: The Partnership may disclose learner’s personal data and sensitive personal data/special category data to external agencies to which it has obligations; for example for the Welsh Government and to other arms of central or local government, to the HEFCW,  Office of the Independent Adjudicator for Higher Education and potentially other such organisations for defined purposes.  It may also disclose information to examining bodies, legal representatives, Police or security agencies, suppliers or service providers, survey and research organisations engaged by the Partnership, and regulatory authorities. 

​

11: The Partnership may also use learner’s personal data as follows: 

a) To contact learners who declare a disability to confidentially discuss available support. 

b)  Provide progress and attendance reports to sponsors i.e. employers (except relatives). 

c) Provide references to education institutions and employers, usually with the consent of the learner. 

d) Disclosing information about learners for the purpose of promoting the Partnership but only with the consent of the learner if they are personally identified. 

e) For the purpose of entering learners for external awards and competitions, usually with the consent of the learner. 

f) Publication of the names of leaners in the award ceremony programme. 

g) Supply personal and financial details to providers of financial services engaged by the Partnership, for example for the payment of learning allowances, travel, refunds and similar services. 

h) Disclosing information to external parties for safeguarding and duty of care purposes, for example social services, medical practitioners and law enforcement agencies. 

i) Registration with the appropriate Sector Skills Council in order to apply for the apprenticeship completion certificate on the learners behalf. 

j) Subject to review on a case-by-case basis, providing contact details to third party companies and organisations formally engaged by the Partnership to provide enhanced levels of service to support core activities. 

k) For those learners attended college sites, contact details may be provided to the Students’ Union to enable it to offer appropriate services to learners.  Please contact your training provider if you do not want your contact details shared with the Students’ Union. 

l) Where necessary, to take a photographic image that will be stored in the Partnerships Management Information System and to be used for identification purposes on provider ID cards or when applying for cards such as CSCS.   

m) To share data, including course progression details to outside organisations working with the College to provide specialist training courses and apprenticeships. 

n) To contact external agencies to monitor and obtain evidence of progression out of the training programme*.   

*For some learner groups (Employability programmes/transfers/redundancies) it is a contractual requirement that the Partnership contacts the appropriate external agencies i.e. employers/training providers to confirm details, and where appropriate, obtain the necessary evidence to confirm the progression route of the learner after terminating the training programme.  In signing this privacy notice you give approval for the Partnership to request and obtain this progression/destination information.   

​

12: The Partnership requires all learners to participate in its attendance monitoring system (register marking).  For some learner groups it is a contractual requirement that the Partnership monitors attendance (for example for learners receiving a learning allowance/travel payments) and there may be a requirement to report non-attendance to sponsors i.e. employers (except relatives).  It also aids the Partnership in its duty of care and support provisions. 

​

13:  In some instances the Partnership may transfer students’ personal data to third parties located in other countries.  Any such transfers will be strictly in relation to the delivery of the Partnership’s core services.  IT services used by the Partnership may involve the transfer or hosting of learner personal data overseas.  All instances of overseas transfers of personal data are subject to appropriate technical safeguards and contractual provisions incorporating appropriate assurances to ensure the security of the data and full compliance with legislative and regulatory requirements.  

​

14: Some sections of the Partnership undertake processes involving applicant or learner personal data that include elements of profiling or automated decision-making.  An example would include the Marketing Communications Office where these processes are employed to determine the nature of communications sent to individuals and to facilitate learner recruitment procedures.  

​

15:  Individual learner records will be kept in line with the Welsh Government retention guidance for Work-Based Learning programmes, as set out in the LLWR Privacy Notice.    

​

16 : If you have any queries about the use of learner personal data outlined above then please contact the Skills Academy Wales Manager by email: sawadministration@nptcgroup.ac.uk or telephone 0330 818 8108. 

​

INDIVIDUAL RIGHTS 

​

17 : Individuals whose personal data and sensitive personal data/special category data is held by the Partnership have the following rights regarding their data: 

a) The right to request access to their personal data held by the Partnership. 

b)  The right to have inaccurate or incomplete personal data rectified. 

c)  The right to erasure of personal data – this will only apply where there is no legitimate reason for the Partnership to continue to process the personal data.  There will usually be a requirement for the Partnership to keep a basic learner record indefinitely.  

d) The right to restrict the processing of personal data – individuals have the right to block the processing of their personal data by the Partnership in specific situations. 

e) The right to data portability – learners have the right to request provision of some elements of their information (for example training progress details) in digital form in order to provide it to other organisations. 

f) The right to object – learners can object to the processing of their personal data by the Partnership in certain circumstances, including the sending and receipt of direct marketing material. 

g) The right to object to automated decision making and profiling – individuals have the right to object to decisions taken by automatic means without human intervention in some circumstances.   

All requests to exercise any of these rights should be made to the Skills Academy Wales Manager. 

​

18:  Where the processing of personal data or sensitive personal data/special category data is based on the consent of the learner, they have the right to withdraw their consent at any time by contacting the sub-contractor who obtained that consent or the Skills Academy Wales Manager.  

​

19: If a learner is unhappy with the Partnership’s handling of their personal data, or believes that the requirements of the DPA or GDPR may not be fully complied with, they should contact the Skills Academy Wales Manager in the first instance.  The Partnership’s formal complaint procedure can be invoked if appropriate, and they also have the right to submit a complaint to the Information Commissioner’s Office; further details can be found at www.ico.org.uk . 

​

LEARNER AND LEAVERS SURVEYS 

​

20 :  You may from time to time be asked to complete surveys either for the Partnership or on behalf of other organisations, for example the Welsh Government. These organisations and their contractors will use your details only for that purpose, and will then delete them. 

​

21: There is no requirement for you to take part in any of these surveys but participation assists the Partnership, as well as government and regulatory bodies, in performing their statutory, official and public duties.  

​

SUBMISSION OF YOUR DATA TO THE WELSH GOVERNMENT 

​

22 : It is a statutory requirement for the Partnership to send some of the information we hold about you to the Welsh Government (WG).  WG collects, and is responsible for, the database in which your learning information is stored.  WG uses your information itself for its own purposes.  WG also shares your information with third parties for specified and lawful purposes.  It may charge other organisations to whom it provides services and data.  WG's use of your LLWR information may include linking information from it to other data, as described in the separate WG statement provided on commencement of your learning programme and linked to below.  All uses of WG information must comply with the Data Protection Act 2018 and the GDPR. 

​

23:  If you give us information about your disability status, ethnicity, sexual orientation, gender reassignment or religion these may be included in your WG information and used to assist with monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act 2010.   

​

24:  TO READ THE FULL WELSH GOVERNMENT LLWR PRIVACY NOTICE PLEASE VISIT:    

https://gov.wales/lifelong-learning-wales-record-privacy-notice 

​

MONITORING OF IT SYSTEMS AND LEARNER ACCOUNTS

​

25: Learners should also be aware that, in certain circumstances, the Partnership may monitor usage of its IT systems and access user information on its systems and networks that is normally private. Any institutional monitoring or access will comply with UK legislation including the Regulation of Investigatory Powers Act 2000, Human Rights Act 1998, and the Data Protection Act 2018 and GDPR.  Where necessary any access or monitoring will be justifiable, fair and proportionate, and will be in line with the Partnership’s internal procedures, copies of which are available upon request.  

LEARNER USE OF PERSONAL DATA 

​

26: Learners within the Partnership are permitted to process personal data only for use in connection with their studies or research whilst on the learning programme.  This applies whether or not those activities are carried out on equipment owned by the Partnership and whether or not they are carried out on Partnership premises.  Learners may do this only with the express prior permission of the Manager of the sub-contractor organisation, and only in accordance with any internal guidance or policies issued by the sub-contractor and in force at that time.  Personal data must be:  fairly and lawfully obtained and processed; used only for specified and legitimate purposes; accurate and up-to-date; held securely; kept to the minimum possible and anonymised or pseudonymised where possible; not published, put online or taken outside of the European Economic Area without the consent of the individual concerned; and be deleted or destroyed when it is no longer relevant to retain it.  The individuals about whom data are held are entitled to inspect the data unless it is held only for research purposes and will not be released in such a way as to identify the individuals concerned. 

​

27: Learners needing to process personal data for academic or research purposes must make themselves aware of the general requirements of the Data Protection Act 2018 and GDPR, and in particular must abide by the data protection principles set out in Schedules I, II and III of the DPA, and Articles 5, 6 and 9 of GDPR.  Learners can do this by obtaining a copy of the Partnership’s current guidance on data protection, and further relevant information from the Manager of the sub-contractor organisation or Data Protection Officer. 

​

28 : Learners who fail to comply with any guidance or policies in force may be held personally liable for any resulting breaches of the Data Protection Act 2018 or GDPR. 

​

Reviewed July 2023