Notice

Boiler Upgrade Scheme (BUS): privacy notice

Updated 10 July 2024

Applies to England and Wales

This notice sets out how we will use your personal data for monitoring, evaluation, and research to support ‘public tasks’ related to the Boiler Upgrade Scheme (BUS). It also sets out your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

Within this Privacy Notice, ‘personal data’ refers to information that relates to an identified or identifiable individual and only includes information relating to natural persons who:

• can be identified or who are identifiable, directly from the information in question
• who can be indirectly identified from that information in combination with other information

The data

We will process the following data and supporting information:

• contact details including your name, email address and telephone number (for both installers and property owners)
• installer name (for example sole trader name or company name), company location and registered office
• addresses of property owners receiving installations, including the Unique Property Reference Number (UPRN) and correspondence addresses (including postcodes). For applications from private landlords, we collect address and postcode for their organisation
• details of which installer undertook the installation at a given address
• identification numbers, such as the BUS voucher number, BUS account number, the Microgeneration Certification Scheme (MCS) and Energy Performance Certificate (EPC) numbers
• lodgement certificate number, lodgement date, installations details from Trustmark and the MCS
• financial data on the total installation cost, date of quote and value of grant (this does not include details of the account into which the grant is paid)
• administrative details regarding your application, including:
  • dates of submission and approval
  • property owner consent requested and received
  • commissioning date
  • application statuses and types
  • details on the installer account creation process
  • details on the redemption application
• details about the current and past heating system including information on the BUS-supported system such as the manufacturer, model, capacity, system type and fuel
• details about the installation installed including but not limited to type, size, date, manufacture number
• property data, such as whether new or self-build, whether in a rural or urban area, property type, tenure including information of the property from Energy Performance Certificate such as the property rating, banding, features, floor area from any EPC Certificate recorded. Additional fields may be processed such as assessor details, assessment date, heating, lighting and other related information

Where personal data has not been obtained from the data subject

Your personal data is obtained by us from the Office of Gas and Electricity Markets (Ofgem). Ofgem are legally compelled to supply data to DESNZ under The Boiler Upgrade Scheme (England and Wales) Regulations 2022 when DESNZ requests it. A data sharing agreement is in place to support this.

For further information about how Ofgem process your data for the delivery of the BUS and associated purposes, please see Ofgem’s privacy notices:

• Boiler Upgrade Scheme Privacy Notice - Installers
• Boiler Upgrade Scheme Privacy Notice – Property owners

Purpose

The purposes for which we are processing your personal data are:

1. Evaluation of the BUS for activities including but not limited to:

• sampling – the activity of using your personal data to contact you, to invite you to participate in research activities, including but not limited to surveys and interviews
• data analysis – the activity of carrying out statistical activities on your personal data, either in isolation or combined with other datasets
• tailoring - the activity of including your personal data on research apparatus to make it more specific to you, such as the inclusion of your name on the introductory message of a survey

2. For monitoring of the BUS, your data will be processed for activities including but not limited to:

• monitoring of applications, voucher redemptions and payments made to participants
• the publication of Official Statistics

3. For analysis, research and future policy development, your data will be processed for activities including but not limited to:

• research for the development of policies on clean heat and any related activities
• data analysis – the activity of carrying out statistical activities on your personal data, either in isolation or combined with other datasets
• research and analysis to support related policies
• linking – your data may be linked to other datasets in which your data is stored for evaluation, monitoring, and analytical purposes

4. For the prevention and detection of fraud, error and non-compliance, the data listed above will be processed for activities including but not limited to:

• preventing, detecting and investigating fraud, error and non-compliance
• taking administrative actions in connection with fraud
• debt recovery, prosecution and any other related activities

See the Using home retrofit scheme data to manage fraud and error: privacy notice for further details.

Legal basis of processing

The legal basis for processing your personal data is public task (Article 6(1)(e) UK GDPR). Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, such as:

• the exercise of a function of the Crown, a Minister of the Crown, or a government department
• the exercise of a function conferred on a person by an enactment
• the exercise of a function of either House of Parliament
• the administration of justice

In this instance, one of the tasks which the Department for Energy Security and Net Zero (DESNZ) needs to complete is an evaluation of the BUS. A proper evaluation of the BUS is required to assess the value-for-money of public spending, the extent to which the BUS has met its aims and whether it has resulted in the expected impacts. The Public Value Framework published by HM Treasury makes clear the necessity of evaluation to public policy (this is particularly clear on page 47).

In addition, DESNZ needs to monitor the scheme and how it is functioning, from an operational, financial and policy development perspective. This is done by producing Official Statistics, financial forecasts, and other analysis. The statistics provide transparent information on the scheme, for example the number of applicants. The financial forecasts enable control of spend of the scheme as well as payments to applicants. Financial auditing is also done by the National Audit Office. DESNZ also carries out research to inform the development of the BUS and other policies.

Recipients

For evaluation purposes, your personal data will be shared by us with any contractor or sub-contractor with whom DESNZ deem necessary for undertaking evaluation activities as part of the BUS evaluation. These contractors and sub-contractors will not have the right to share your data more widely without DESNZ’s permission. They will not use your data for purposes other than carrying out the evaluation of the BUS.

HMRC will analyse your personal data alongside other personal, financial and commercial data they hold, which they will return to DESNZ in an anonymised and aggregated format. DESNZ may share this data with evaluation contractors and sub-contractors. This is to help DESNZ understand the number of jobs in the low carbon heating sector supported by BUS, as part of the evaluation of the scheme. For the avoidance of doubt, the analysis undertaken by HMRC shall not extend to any other purpose beyond that described here and DESNZ will have no access to de-anonymised or disaggregated analysis produced by them.

For monitoring and research purposes, personal data will be shared by us with:

• Welsh Government
• Office for National Statistics (ONS)
• other government departments and agencies as required for monitoring and research purposes, for example Department for Environment Food and Rural Affairs (Defra), Department for Levelling Up, Housing and Communities (DLUHC), Department of Health and Social Care (DHSC), His Majesty’s Revenue and Customs (HMRC), Cabinet Office, Prime Minister’s Office
• HM Treasury (HMT)
• the National Audit Office
• any contractor or sub-contractor we deem necessary for undertaking research activities

In accordance with UK GDPR Principle (C): Data Minimisation, DESNZ will limit the sharing of your personal data to what is necessary and relevant. We will limit the data sharing to those who require it to undertake their contractual obligations in completing work as part of the evaluation or monitoring of the BUS. We only share personal data when that is essential for the research activity. Where personal data is not essential for the monitoring, evaluation, or research we may instead share extracts of data.

For prevention and detection of fraud, error and non-compliance, your personal data will be shared by DESNZ and with its partners who include but are not limited to:

• other government departments and agencies, who may also share the data across their schemes
• Delivery Agents and Delivery Partners
• scheme administrators including but not limited to local authorities, energy suppliers, Ofgem
• TrustMark and other accreditation bodies

International transfers

Third parties (such as contractors and sub-contractors) may employ staff who work inside the EEA and internationally, who may process your data. Your personal data as stored on third-parties IT infrastructure may be transferred and stored securely outside the EEA.

Where your personal data is processed outside UK and EEA, the following safeguards will be in place:

• an adequacy decision in respect of a third country under UK Adequacy Regulations
• reliance on Model Contract Clauses
• reliance on binding corporate rules

Retention

Your personal data will be kept by us for no longer than 5 years to fulfil our functions in evaluating and monitoring the BUS. Extracts of property-level data (for example a dwelling that has received a BUS grant to install an air source heat pump) may be retained for wider analysis purposes.

Your data will be retained separately by DESNZ for monitoring, statistical and / or research purposes. Data will be retained to monitor payments and make financial forecasts until all payments on the scheme have been made.

Your personal data for the purposes of prevention and detection of fraud, error and non-compliance will be retained proportionate to risk relevance and the retention period for data will therefore be based on an individual measure’s useful life expectancy:

• short (5-10 years)
• medium (11-19 years)
• long (20-25 years)

An individual record may be kept longer if it relates to ongoing actions such as prosecution, appeals or debt recovery.

Your rights

You have the right to:

• request information about how your personal data is processed
• request a copy of your personal data
• request that any inaccuracies in your personal data are rectified without delay
• request that any incomplete personal data are completed, including by means of a supplementary statement
• request that your personal data are erased if there is no longer a justification for them to be processed
• in certain circumstances (for example, where accuracy is contested) request that the processing of your personal data is restricted
• object to the processing of your personal data where it is processed for direct marketing purposes
• object to the processing of your personal data

To exercise your rights please contact the Data Protection Officer using the contact details below.

Contact details

The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ).

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Email dataprotection@energysecurity.gov.uk

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using these contact details.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office

Email icocasework@ico.org.uk

Contact form https://ico.org.uk/glo...

Telephone 0303 123 1113

Textphone 01625 545 860

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Updates to this notice

If this privacy notice changes, we will update this section explaining what has changed. The ‘last updated’ date at the bottom of this page will also change.

Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated: 10 July 2024

Update 10 July 2024

• Added provisions for DESNZ to share personal data with other government departments and agencies to support with evaluation activities
• Added provisions in respect of processing personal data for fraud, error, non-compliance and audit purposes
• Removed information in the international transfers section which no longer applies

Update 12 January 2024

The Boiler Upgrade Scheme is now the responsibility of the Department for Energy Security and Net Zero (DESNZ), so we have changed all departmental references and the office address and contact details.

In 2023 the Department for Business, Energy and Industrial Strategy (BEIS) was split to form the Department for Business and Trade (DBT), the Department for Energy Security and Net Zero (DESNZ) and the Department for Science, Innovation and Technology (DSIT).