skip to navigation skip to content
Search
 

Executive Education programmes in Cambridge Judge Business School are provided by JBS Executive Education Limited (JBSEEL), a wholly owned subsidiary of the University of Cambridge, registered in England and Wales with registration number 5908393. Its registered address is: The Old Schools, Trinity Lane, Cambridge CB2 1TN. JBSEEL has its own privacy policy and privacy notices.

Legislation

Data protection legislation sets out rules and standards for the use and handling ('processing') of information ('personal data') about living identifiable individuals ('data subjects') by organisations ('data controllers'). It is based around the notions of principles, rights and accountability obligations.

The law applies to organisations in all sectors, both public and private. It applies to all electronic records as well as many paper records. It doesn't apply to anonymous information or to information about the deceased.

Since 25 May 2018, the legislation in the UK has been the EU General Data Protection Regulation (GDPR), coupled with the UK Data Protection Act 2018 (DPA 2018) that supplements the GDPR in specific ways. These two pieces of legislation replaced the Data Protection Act 1998 (DPA 1998) and the numerous Statutory Instruments issued pursuant to it. There is also supplementary data protection legislation covering specific topics, such as direct marketing. The legislation is regulated in the UK by the Information Commissioner's Office (ICO) as well as the courts.

Principles

Data controllers processing personal data must follow - and be able to demonstrate that they are following - the data protection principles.

Under the GDPR, there are six principles. Personal data must be processed following these principles so that the data are:

  1. Processed fairly, lawfully and transparently - and only if there is a valid 'legal basis' for doing so
  2. Processed only for specified, explicit and legitimate purposes
  3. Adequate, relevant and limited
  4. Accurate (and rectified if inaccurate)
  5. Not kept for longer than necessary
  6. Processed securely - to preserve the confidentiality, integrity and availability of the personal data

Under the DPA 1998 there were eight principles but two of these (about the rights of data subjects and transfers of personal data outside the European Economic Area) are covered in different ways in the GDPR. Depending on the context, there are full or partial exemptions from the principles when processing personal data for specific purposes, including academic research.

Rights

Under the GDPR, data subjects are given various rights, which are free to exercise:

  • The right to be informed of how their personal data are being used - this right is usually fulfilled by the provision of 'privacy notices' as described below
  • The right of access to their personal data - accessing personal data in this way is usually known as making a 'subject access request'
  • The right to have their inaccurate personal data rectified
  • The right to have their personal data erased where appropriate - known as the right to be forgotten
  • The right to restrict the processing of their personal data pending its verification or correction
  • The right to receive copies of their personal data in a machine-readable and commonly-used format - known as the right to data portability
  • The right to object: to processing (including profiling) of their personal data that proceeds under particular legal bases; to direct marketing; and to processing of their data for research purposes where that research is not in the public interest
  • The right not to be subject to a decision based solely on automated decision-making using their personal data

A response to a rights request needs to be sent within one month. However, nearly all of these rights are qualified in various ways and there are numerous specific exemptions both in the GDPR and in the DPA 2018 (for example, nearly all the rights do not apply if the personal data are being processed solely in an academic research context). These rights build upon and strengthen rights given to data subjects under the DPA 1998.

Registration

Under the GDPR, JBSEEL (like all data controllers) is required to pay an annual fee to the ICO and to be included in its register of fee payers. JBSEEL's register entry number is Z9914531. The University of Cambridge and Cambridge Colleges of the University are separate legal entities and data controllers for the purposes of data protection legislation.

Responsibilities

Accountability obligations

Data protection legislation imposes certain accountability obligations on all data controllers which include:

  • Implementing policies, procedures, processes and training to promote 'data protection by design and by default'
  • Having appropriate contracts in place when sharing personal data - especially when outsourcing functions that involve the processing of personal data and/or transferring the personal data outside the EEA
  • Maintaining records of the data processing that is carried out across the organisation
  • Documenting and reporting personal data breaches both to the ICO and the affected data subjects

Data breaches

One of JBSEEL's most important accountability obligations under data protection legislation concerns personal data breaches - that is, personal data held by JBSEEL is lost, stolen, inadvertently disclosed to an external party, or accidentally published. If a personal data breach occurs, this should be reported immediately to the Data Protection Officer (execed-dp@jbs.cam.ac.uk), who will then inform Cambridge Judge Business School's Compliance Team (compliance@jbs.cam.ac.uk).

Some types of personal data breach have to reported to the ICO and the affected data subjects within short timeframes, so recognising and reporting them internally is crucial.

Privacy notices

An important aspect of complying with data protection legislation is being open and transparent with individuals about how their personal data will be used. The supply of this information - through documents variously known as 'privacy notices', 'data protection statements', 'data collection notices', 'privacy policies' and numerous other interchangeable terms - takes places in numerous targeted ways depending on the context of the interaction with the individual. JBSEEL's core privacy notices are available below:

Who to contact

For data protection and records management:

execed-dp@jbs.cam.ac.uk

For Freedom of Information requests and enquiries:

jbseelfoi@jbs.cam.ac.uk

To withdraw your consent to receive marketing communications from JBSEEL:

withdrawconsent-ee@jbs.cam.ac.uk

Data protection and Brexit

Like all areas of law derived from the European Union, data protection legislation will be subject to changes following the UK's departure from the EU. Unless cancelled or further postponed, Brexit now looks likely to take place on 31 October 2019. The specific changes will depend on the type of Brexit that occurs (in short, whether or not there is a deal with the EU at the point of withdrawal that covers data protection matters for a transitional period and possibly beyond).

Regardless of whether there is a deal or not, the key message is that all the substantive provisions of the GDPR (as supplemented by the DPA 2018) about principles, rights and accountability obligations will continue to apply in the UK following Brexit.  Most of the changes will be technical ones to allow the GDPR to operate in a UK-only context without reference to EU institutions and bodies.

If the UK leaves the EU without a deal (or if that deal does not adequately cover data protection matters for a transitional period and possibly beyond), the main practical change for JBSEEL in the immediate term concerns transfers of personal data from organisations and businesses based within the European Economic Area (i.e. the EU countries plus Iceland, Liechtenstein and Norway) to JBSEEL. (Transfers of personal data from JBSEEL to organisations/businesses based in the EEA and beyond are not affected except in very limited circumstances.) In order for such transfers lawfully to continue, it will be necessary for the EEA-based organisation/business to assure itself that the personal data it transfers will be 'adequately' protected by JBSEEL (as we will be an organisation based in a country outside the EEA that does not have an 'adequacy' finding). In essence, the current provisions on transfers of personal data outside the EEA will apply but 'in reverse' - that is, with JBSEEL as the recipient rather than the sender. Unless a 'derogation' (exception) applies - which will occur relatively rarely - the simplest and safest way for the EEA-based organisation/business to assure itself of the adequate protection of the personal data will be for it to enter into a contract/contract variation with JBSEEL on the basis of the European Commission's standard contractual clauses for transfers, the use of which is explained on the relevant guidance page of this website.

Both the UK Government and the ICO have published wider guidance on data protection in the event of a no-deal Brexit, as has (from an EU perspective) the European Data Protection Board. Further specific guidance will be circulated if and when necessary.