Data Protection Policy

1. Purpose

The purpose of the Data Protection Policy is to set out the British Business Bank’s (the “Bank”) requirements to enable compliance with data protection legislation.

1.1 Personal Data

Personal Data is defined in the Data Protection Act 2018 (DPA) as “any information relating to an identified or identifiable living individual”. An identifiable living individual is “a living individual who can be identified, directly or indirectly, in particular by reference to:

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.”

Personal Data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour. Personal Data includes Special Category Data and Pseudonymised Personal Data but excludes anonymous data or data where information which could identify an individual has been permanently removed.

1.2 Special Category Data and Criminal Offence Data

Under the DPA, there are additional safeguards to be applied when dealing with Special Category Data and Criminal Offence data.

The full list of definitions used in this Policy is available at Section 8.

1.3 Legal & Regulatory Obligations

The applicable laws include the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, and related legislation

In addition to meeting its legal obligations, the Bank as an Arm’s Length Body is required to meet the Government Functional Standards where applicable. Obligations relating to Government Functional Standard (GFS005) – Digital, Data and Technology and GFS007 – Security activity elements are contained and prescribed through this policy and associated standards.

1.4 Alignment to Risk Appetite

This Policy sits under the Level One Risk category, Operational and Resilience Risk. It aligns to the Level Two Risk Category, Information Management, which is defined as ‘The risk of failing to treat information as a strategic asset, appropriately manage and maintain the organisation’s information across its lifecycle to support its necessary use, resilience, integrity and availability.’

The Bank has a Medium appetite for Information Management Risk, acknowledging the Bank continues to mature its system infrastructure to support delivery of its strategic objectives. The Bank does however have a low tolerance for failure to meet our legal and regulatory obligations or failure to adequately protect the information rights of individuals.

The correct handling of Personal Data is crucial for achieving the Bank’s strategic objectives while complying with its legal and regulatory obligations. This Policy is supported by standards (see Section 6) that describe the Bank’s minimum expectations when handling Personal Data.

2. Scope

This Policy applies to all Bank entities, operations and subsidiaries, and Colleagues. It does not form part of any Colleague’s contract of employment and we may amend it at any time.

This Policy applies to all Personal Data the Bank processes regardless of where the data is stored, its age, format, or whether it relates to past or present Colleagues, workers, customers, or contacts at suppliers or delivery partners, shareholders, website users or any other Data Subject.

3. Requirements

3.1 Data Protection Principles

The data protection principles are key to data protection law and determine that Personal Data shall be:

1. Processed fairly, transparently and lawfully
2. Processed only for specified and not incompatible purposes
3. Adequate, relevant and necessary for the purpose
4. Accurate and, where necessary, kept up-to-date
5. Not kept longer than necessary for the purpose
6. Kept secure by technical/organisational means

The law also requires that the Controller shall be  responsible for, and be able to demonstrate compliance with, the above principles.

3.2 Accountability

Data protection accountability relies on good record keeping, so that the Bank can evidence or reflect on its actions and decisions and demonstrate compliance with the law.

The Bank is obligated to take responsibility for its handling of Personal Data and demonstrate the steps it has taken to protect people’s rights results in better legal compliance.

It provides an opportunity for the Bank to show how it respects people’s privacy and helps us sustain the Bank’s reputation and evidence it has actively considered the risks and put in place measures and safeguards. This will support the Bank to provide mitigation against any potential enforcement action.

The Bank must:

• Register the British Business Bank plc (and any relevant subsidiaries) as a Controller with the Information Commissioner’s Office for inclusion on the Register of fee payers.
• Appoint a Data Protection Officer and register their name, contact details and address with the Information Commissioner’s Office.
• Have in place appropriate technical and organisational measures as required as a Controller. These measures include standards setting out in detail how the Bank will meet its accountability obligations. See section 6.

3.3 Special Category and Criminal Offence Data

In line with the first data protection principle for processing data lawfully, where Personal Data is Special Category Data or Criminal Offence Data there is a requirement for additional conditions under UK GDPR Article 9 to be met.

The Bank will disclose special category and criminal offence data in appropriate circumstances and in connection with Schedule 1 condition for processing as set out in Annex 1.

The Data Protection Act also requires an Appropriate Policy Document to be in place. Where we rely on the substantial public interest condition in Article 9(2)(g) of the UK GDPR, we also need to meet one of the 23 substantial public interest conditions set out in Part 2 of Schedule 1 of the Data Protection Act, many of which require an Appropriate Policy Document. This section of this policy is the Bank’s Appropriate Policy Document.

This section describes what data are processed, explains the procedures that are in place to comply with the data protection principles, and confirms what retention and erasure policies are in place. Annex 1 confirms what Schedule 1 conditions are used.

3.3.1 Description of the data processed

The Bank processes Personal Data about businesses and companies, which includes sole traders, representatives and associates and directors, as well as Personal Data about our past, present and prospective delivery partners, suppliers, contractors, interns, Colleagues and non-executive directors, complainants and requesters (for information). 

The Personal Data processed depends on the business activity and our relationship with the Data Subject, but may include name, address, contact details, bank accounts, payment details, background checks. There can also be Criminal Offence Data and Special Category Data including racial and ethnicity data, sexual orientation, religious and philosophical beliefs, and health data.

3.3.2 Procedures for ensuring compliance with the principles

This Policy sets out our approach to handling Personal Data, which also applies to our processing of Special Category Data and Criminal Offence Data, and how we intend to comply with the data protection principles

3.3.2 Retention and erasure

The Records Management Standard and accompanying Record Retention Schedule sets out our approach to the retention and disposal of Information and Data, which also covers Special Category and Criminal Offence Data.

4. Roles and Responsibilities 

4.1 All colleagues 

Data Protection is everyone’s responsibility. All colleagues are required to adhere to this policy and related Standards to help comply with data protection law and to enable the Bank to meet its data protection obligations. The Data Protection Officer has special additional responsibilities with regard to Personal Data. There are other roles that exist in the organisation to support the proper use of personal data these include:

• Senior Information Risk Owner
• Information Asset Owners
• Information Asset Administrators
• Data Owners
• Data Stewards

Please refer to the Information and Data Governance policy for a full list of responsibilities for these roles.

4.2 Data Protection Officer

The Bank is required to appoint a Data Protection Officer (DPO) to help the Bank fulfil its data protection obligations by:

• Informing and advising on data protection obligations
• Monitoring compliance with data protection laws
• Raising awareness and providing data protection training
• Advising on Data Protection Impact Assessments, which is the process of ensuring that appropriate and proportionate safeguards are in place in all uses of personal data.
• Liaising with the Information Commissioner’s Office in relation to data-related complaints
• Reporting any reportable breaches of data protection law and regulations to the Information Commissioner’s Office
• Ensuring data protection risks are managed appropriately.

The Data Protection Officer is not liable for the Bank’s compliance with its data protection obligations; the Bank remains accountable for complying with data protection obligations regardless of whether the Data Protection Officer is an employee or a contracted third party.

5. Non-Compliance

This Policy sets out what we expect from all Colleagues and parties identified in 2. Scope of this policy to ensure the Bank complies with applicable laws and regulations.

All identified breaches of this policy must be reported via the Risk Incident Portal on the Bank’s Intranet. Breaches will be assessed by the Policy Owner to determine the further action required and may include disciplinary action in accordance with the Bank’s Disciplinary Policy.

The Bank’s failure to comply with data protection law, either deliberately or accidentally, can have significant consequences for the Data Subjects whose data has been processed and to the organisations that processed the Personal Data. Data Subjects have the right to receive compensation (GDPR Article 82), and the UK’s Supervisory Authority (Information Commissioner’s Office) has enforcement powers that include issuing monetary fines up to £17.5 million or 4% of an organisation’s annual turnover (GDPR Article 83) for infringements of certain provisions in the law.

The Bank will take any necessary actions via our internal procedures. The Bank will cooperate with the relevant external regulators and law enforcement agencies as required. 

The Data Protection Officer will monitor compliance with this policy.

6. Aligned Standards and Procedures

Personal Data is processed in a large number of business activities and therefore features in the majority of business processes, policies, standards and procedures. The following standards are under this Policy:

• Data Protection by Design Standard
• Data Protection Rights Standard
• Personal Data Sharing Standard
• Direct Marketing and PECR Standard

Related documents:

• [Information and Data Governance Policy] (and accompanying standards)
• Data Management Policy (and accompanying standards)
• Supplier Management Policy, Procurement and Contracting Standards
• Business Resilience Policy
• Risk Incident Review Reporting Procedure
• Information Security Policy
• IT Acceptable Use Policy

7. Policy Controls

A key control or a combination of controls which manages the inherent exposure of a risk to an accepted residual level and within the defined risk appetite. The key controls relevant to this policy are contained in the table below.