What Data Protection means to arc⁴

• Arc⁴ recognise that their research, including surveys and focus groups, involves processing personal information under the Data Protection Act (DPA) 2018. Arc⁴ are registered as a Data Controller with the Information Commissioner’s Office (reg no. Z992934X).

• When carrying out research arc⁴ typically operate as a Joint Data Controller with the Local Authority or Housing Association who rely on the lawful basis of Public Task for the processing.

• Arc⁴ and the Local Authority or Housing Association will sign a data sharing agreement before the research begins.

• Research also involves collecting information about how health and disabilities affect current and future housing needs, and we collect ethnicity information for equality monitoring. This is known as Special Category Data which requires an additional lawful basis. For this processing the lawful basis is the DPA 2018 Schedule 1, Part 1 (1) (social protection) and (2) (health & social care) and Schedule 2, Part 2 (8) (equality of opportunity).

• Arc⁴ have a Legitimate Interest as an Independent Data Controller to indefinitely retain, and further process, pseudonymised research data for statistical purposes. Data is pseudonymised when the person cannot be identified directly from the information. In developing this strategy arc⁴ have consulted the Market Research Society (MRS) guidance. Arc⁴ also voluntarily comply with the conditions required for Research and Statistical Purposes in The Data Protection Act 2018 Schedule 2, Part 6 (27)(3) which requires arc⁴ never to publish information in a form where the data subject can be identified. Arc⁴ have completed a Legitimate Interest Assessment to ensure the data subject’s rights are not unduly outweighed by arc⁴’s interests.

• Arc⁴ and the Local Authority or Housing Association will issue a Joint Privacy Notice as part of the introduction to the invitation to take part in the research. This notice will contain a link to the arc⁴ privacy notice.

May 2022