Guidance

Privacy Notice for Government Property Agency Workplace Experience Survey

Updated 18 November 2022

1. GPA Workplace Experience Survey Data Privacy Notice

Published November 2022

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

2. Your data

2.1 The Controller

The Cabinet Office is the controller of personal data being collected by the Government Property Agency (GPA) which is an Executive Agency of the Cabinet Office.

2.2 Purpose

GPA is committed to delivering Great Places to Work across the Civil Service. A key way to achieve this is to gain an in-depth understanding of the way people work and the experience individuals and teams have both in the workplace or in a remote location.

GPA is working in partnership with Leesman (our data processor) to issue a customer experience survey to customers to understand their workplace experience within an office and/or whilst working remotely.  The survey will:

• provide in-depth insight to the activities that are important to people to deliver their roles, how well the workplace or remote environment supports these and how well the workplace supports productivity, pride, wellness, connection etc.
• provide data on the physical features and services within their workplace, helping us to understand which are the most important and which features or services are not meeting needs in their current workplace.
• provide a benchmark for future comparison or for comparison against all Leesman survey responses.
• be undertaken by Leesman - who have tried and tested their Leesman Index methodology for 10+ years.

2.3 The data

The survey doesn’t ask for names or staff numbers, and our processing does not identify individual responders. But as some staff may potentially be identifiable from a combination of the data provided at the point of collection, we are taking additional precautions to treat the survey data as confidential personal data.

Personal data may include:

• Answers to the questions in the survey and demographic information which people volunteer
• Metadata about how people complete the survey, for example, the time taken to complete the survey and web browser used

Demographic data includes: ethnic group, disability, gender identity, sexual orientation, age group, caregiver responsibilities, grade, function and location.

All questions are optional, apart from the first question which asks people to disclose the organisation they currently work for. This is to enable results to be analysed and reported at an organisation level.

The data we collect from these questions is vital for us to understand whether select groups of people are having a better or worse workplace and remote working experience. The data collected from demographic questions may be used to identify trends across departments and/or the civil service but will remain completely anonymous and aggregated.

2.4 Legal basis of processing

The legal basis for processing your personal data is it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.  In this case that is to understand civil servants’ workplace and/or remote working to inform decisions taken to improve these experiences, and support future Civil Service transformation plans. It is important to know if groups of staff with specific demographic characteristics have a better or worse experience, so that appropriate action can be taken to level this experience.

2.5 Special Category data

Special category data is defined in the UK GDPR as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

The legal bases for processing your special category personal data about ethnic group, disability and sexual orientation are:

• It is necessary for the purposes of performing or exercising our obligations or rights as the controller, or the data subject’s obligations or rights, under employment law, social security law or the law relating to social protection (paragraph 1, schedule 1, Data Protection Act 2018).

• Processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department. In this case that is considering the impact of the use of government workplaces or remote working locations on all staff including those from diverse backgrounds (paragraph 6, schedule 1, Data Protection Act 2018).

• Processing is of data concerning ethnicity, religious or philosophical belief, health including disability or sexual orientation, and it is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people with a view to enabling such equality to be promoted or maintained (paragraph 8, schedule 1, Data Protection Act 2018)..

2.6 Recipients

Your personal data will be shared by GPA with Leesman, who have provided the survey and platform who will provide the analytical function that will inform provision of workplace environments and will help inform future strategy and provision

GPA will share the results of the survey with the requesting government department in aggregate form only. No personal data will be shared. Data that relates to 5 or fewer individuals will not be disclosed to prevent identification being possible.

Upon signing a data access agreement, the Cabinet Office may share the individual-level (non-aggregated) data for an organisation with a professional analyst within that organisation for further analysis.

2.7 Retention

Your personal data will be kept by GPA for five years.

3. Your rights

Under the UK Data Protection Act (2018), incorporating UK GDPR, you have the right:

• to request information about how your personal data is processed, and to request a copy of that personal data
• to request that any inaccuracies in your personal data are rectified without delay
• to request that any incomplete instances of personal data are completed, including by means of a supplementary statement
• to request that your personal data is erased if there is no longer a justification for it to be processed
• in certain circumstances (for example, where accuracy is contested), to request that the processing of your personal data is restricted
• to object to the processing of your personal data where it is processed for direct marketing purposes, or any other reason and that we will then consider
• to request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format

4. International transfers

Leesman stores and processes all data in the UK.

5. Contact details

Please use the contact details for the GPA (dataprotection@gpa.gov.uk) for any other queries relating to data protection or how we process your personal data.

If you require further information regarding the GPA’s data processing activities, the contact details for the GPA’s Data Protection Officer (DPO) are:

Data Protection Officer, Cabinet Office, 70 Whitehall, London, SW1A 2AS

Email: dpo@cabinetoffice.gov.uk

The Data Protection Officer provides independent advice and is charged with monitoring the GPA’s use of personal information.

6. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is the UK’s independent regulator and Supervisory Authority.

The information Commissioner can be contacted at:

Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113 Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.