ESS Diversity Screen: Data Protection Notice (DPN)

At University College Cork, we treat your privacy seriously. Any personal data which you provide to the University will be treated with the highest standards of security and confidentiality, in accordance with Irish and European Data Protection legislation.

Introduction 

This notice sets out the details of the information we collect, how we process it, and with whom we share it. It also explains your rights under data protection law in relation to our processing of your data.

Who we are

Throughout this Notice, “we”, “us” and “our” refer to The Equality, Diversity and Inclusion Unit, and People and Culture (P&C) Department, University College Cork. For more information about us, please refer to our websites: www.ucc.ie/edi, https://www.ucc.ie/en/hr/. The “University”, or “UCC”, refers to the University College Cork.

How we collect and store you personal data

We collect your data when you fill in the ESS Diversity Tool. This data will be used by us only in accordance with the purposes outlined in this notice. 

Personal data will be stored confidentially and securely as required by the UCC Data Protection Policy. The University is committed to ensuring that the processing of your data is safeguarded by appropriate technical and organisational security measures relevant to the processing in accordance with Article 32 GDPR requirements.

Which personal data we collect

• Sex
• Gender
• Sexual Orientation
• Date of Birth
• Ethnic or Cultural Background
• Nationality
• Religion
• Civil Status/Family Status (including caring and/or dependency for/of others)
• Disability

For more details about data categories collected, visit: Diversity Data Categories

The purpose and legal basis for collecting your data

The personal data we collect from you will only be processed for specific and lawful purposes as outlined in this Privacy Statement. The University will ensure that your data is processed fairly and lawfully, in accordance with the principles of data protection as set out in Article 5 of the GDPR. 

Details of third parties with whom we share personal data

We will only share your data with third parties where necessary for the processing purposes outlined in this Privacy Statement. In accordance with Article 28 GDPR, when we share your data with third parties, we will ensure that the data is processed in accordance with specific instructions and that the same standards of confidentiality and security are maintained.

Data access

Internal:

Access to your personal data, provided via the ESS Diversity Tool, is limited to the following designated persons who will have responsibility for compiling statistical reports:

• The manager of the UCC HRIS (Human Resources Information System) and their team of three staff members for technical and operational support.

Access to anonymised statistical reports will be provided to:

• UCC EDI Data Analyst to enable analysis and reporting.
• UCC Director of EDI on an ‘as-needed’ basis for oversight.

External:

Anonymised statistical reports, obtained from the data you submit, will be further processed to ensure confidentiality. The high-level reports, such as, for example, a headcount and percentage of staff by gender and disability, or a headcount and percentage of staff across various ethnic backgrounds, will be shared with the following groups and for the following reasons:

• The UCC EDI Unit, which holds the responsibility for developing and implementing actions to address gaps and areas for improvement, will use data for reporting purposes.
• University bodies such as the University Leadership Team, the Governing Authority, and the Academic Council, for review and action planning.
• Athena Swan Self-Assessment Teams for self-assessment and action planning (note: only in cases where the data collected will not cause a risk of identifying individuals or groups).
• National Disability Authority (NDA): Section 48 (2) of the Disability Act 2005 requires public bodies to collect data on employees with disabilities on an annual basis. In accordance with subsection (7) of the Act, UCC is required to report to the NDA, as the relevant monitoring committee, on the number of people with a disability employed during each preceding year.
• Higher Education Authority: We are required to provide gender disaggregated data to the HEA. This data provides key indicators for assessing gender equality in Irish HEIs. Subject to Section 49 of the Higher Education Authority Act 2022, a HEI may furnish personal data to the HEA.  Subject to 52 of the Higher Education Authority Act 2022, a HEI may provide personal data to the HEA or another designated body for Research purposes.  

Other than the above, the personal data will not be shared with any other organisations or groups. 

Cross-border data transfers

Data will not be transferred or flow outside of the European Economic Area. The ESS Diversity Tool data is securely stored on the UCC servers and on the Data Lake Cloud.

How long will we keep your data

In keeping with the data protection principles, we will only store your data for as long as is necessary. For the purposes described here, we will store your data in accordance with the University’s Records Management Policy.

See Staff Data Protection Notice for more information on how the University collects and processes your personal data.

Your rights

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your data, including the right:

• To find out if we use your data, access your data and receive copies of your
• To have inaccurate/incomplete information corrected and
• In certain circumstances, to have your details deleted from systems that we use to process your personal data or have the use of your personal data restricted in specific ways.
• To object to the specific processing of your data by
• To exercise your right to data portability where applicable (i.e. obtain a copy of your personal data in a commonly used electronic form).
• Where we have relied upon consent as a lawful basis for processing, you can withdraw your consent to the processing at any time. Please note that consent may only be withdrawn up to the point at which the data has been collated with that of other participants for the purpose of producing statistics/a report.
• Not to be subject to solely automated
• To request that we stop sending you direct marketing

If you wish to avail of these rights, please write to: The Information Compliance Manager, University College Cork at gdpr@ucc.ie.

Questions and complaints

If you have any queries concerning the ESS Diversity Tool, please contact a member of the ESS Diversity Tool Project Team: Dr Avril Hutch at AHutch@ucc.ie and/or Katarzyna Pyrz at kpyrz@ucc.ie.

If you have any queries or complaints in connection with our processing of your personal data, you can contact UCC’s Information Compliance Manager by email at: gdpr@ucc.ie

You also have the right to complain to the Data Protection Commission if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the Data Protection Commission’s website (www.dataprotection.ie) or by telephoning 1890 252 231.

Definitions

Personal data:

Any information relating to an identified or identifiable natural person (‘data subject’).

Special Categories of Personal Data (Sensitive personal data):

• Data concerning health.
• Personal data revealing racial origin, ethnic origin, political opinions, religious beliefs, philosophical beliefs, trade-union membership.
• The processing of genetic data for identifying a natural person.
• The processing of biometric data for uniquely identifying a natural person.
• Data concerning a natural person's sex life or sexual orientation.

Processing:

Any operation or set of operations performed on personal data. Processing includes storing, collecting, retrieving, using, combining, erasing and destroying personal data, and can involve automated or manual operations.

Data subject:

Someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data controller:

An organisation, such as University College Cork, which determines the purposes and means of processing personal data.

Data processor:

A natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller, typically under contract. This does not include Service staff who are processing personal data on behalf of the University as part of their employment duties.