Accident reporting privacy notice

The purposes of processing this personal information are to:

• help keep persons on UWE Bristol premises (and staff on UWE Bristol business) safe,
• identify and mitigate risks to personal safety and health,
• meet legal obligations.

As a data controller we are committed to protecting the privacy and security of your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (or any successor legislation) and any other legislation directly relating to privacy laws that apply (together “the Data Protection Legislation”). General information on Data Protection law is available from the Information Commissioner’s Office.

We will only process your personal data when the law allows us to. In addition, we will always comply with UWE Bristol’s policies and procedures in processing your personal data. Our lawful basis for using your personal data for legal obligation, employment, and public interest.

You can find out more information about the lawful basis for processing on the ICO website.

We will always tell you about the information we wish to collect from you and how we will use it. We will not use your personal data for automated decision making about you or for profiling purposes.

Personal information associated with accidents will be supplied by and will relate to:

• UWE Bristol staff members
• UWE Bristol students
• contractors
• visitors to UWE campuses.

The data will include:

• contact details of the involved individual(s)
• details of physical/mental injuries, including photographs. (Special Category data relating to health).

If you are a victim of or witness to an accident or incident either on UWE Bristol premises or on UWE Bristol business elsewhere, you are obliged to engage with this accident reporting process. Failure to do so could delay our investigation and action to reduce or remove health and safety risks to people.

Your personal data will be conditionally shared with:

• Insurers (for claims purposes)
• Health and Safety Executive (reportable incidents)
• Local Authority
• Solicitors (3rd party acting for an injured party)
• Police/Emergency Services
• Trade Unions (3rd party acting for an injured party).

Personal data will not be shared outside of the UK and European Economic Area.

We take a robust approach to protecting your information with secure electronic and physical storage areas for data with controlled access. Access to your personal data is strictly controlled on a need-to-know basis and data is stored and transmitted securely using methods such as encryption and access controls for physical records where appropriate.

Alongside these technical measures there are comprehensive and effective policies and processes in place to ensure that those who process your personal information are aware of their obligations and responsibilities for the data they have access to.

By default, people are only granted access to the information they require to perform their duties. Mandatory data protection and information security training is provided to staff and expert advice available if needed.

We will only retain your personal data for as long as we need it to carry out the purposes in this notice.

Accident personal data will be kept for the following periods:

• 3 years for all report submissions (for insurance claims purposes)
• 40 years where exposure to a specific hazard is suspected (eg asbestos, chronic illness).

Please see our University Records Management Policy and Records Retention Schedules for more detailed information. These are available by contacting our Data Protection Office at dataprotection@uwe.ac.uk.

Under the Data Protection legislation, you have the following qualified rights:

1. The right to access your personal data held by or on behalf of the University.
2. The right to rectification if the information is inaccurate or incomplete.
3. The right to restrict processing and/or erasure of your personal data.
4. The right to data portability.
5. The right to object to processing.
6. The right to object to automated decision making and profiling.
7. The right to complain to the Information Commissioner’s Office (ICO).

To protect your privacy and the privacy of others, we will verify your identity before giving effect to your rights. To exercise any of your rights please contact the Data Protection Officer.