REF 2021 Data Collection

King's lawful basis under GDPR for collecting and using personal data

The processing of personal data for the development of REF2021 Impact Case Studies is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) of the GDPR).

As a leading public research institution, it is imperative that we fully engage with REF and provide submissions that demonstrate the impact of our work beyond academia.

As well as informing the allocation of funding for research, this helps to provide accountability for public investment in research and produce evidence of the benefits of this investment.

I have confidential information that I do not want published

The Main Panels recognise that some evidence used in Impact Case Studies may be of a confidential or sensitive nature. Providing evidence is an important and necessary component of Impact Case Studies for REF 2021.

However, there are arrangements in place to enable institutions to submit Impact Case Studies that include confidential information, with the agreement of the relevant organisations.

If you think that your data is sensitive or should be kept confidential, and you have not yet discussed this with your academic contact, please contact the REF Team.

REF 2021 Redaction Options Guide

A guidance document has been provided for you to fully inform yourself about all the ways in which we can protect any confidential or sensitive information that you may want to provide.

Six Principles of Data Use- How we comply with General Data Regulations

1. Lawful, fair and transparent processing

Who will King's share your information with?

In 2020, King’s will submit the Impact Case Studies for assessment in REF2021, including any data provided as corroborating evidence. The REF is managed by a team based at Research England (RE), on behalf of the four UK higher education funding bodies. RE is part of UK Research and Innovation (UKRI).

Once with UKRI, any case study, or parts of it, may be passed to the Department for the Economy, Northern Ireland (DfE), Higher Education Funding Council for Wales (HEFCW) or Scottish Funding Council (SFC) who may need data to inform the selective distribution of public funds for research and to carry out their statutory functions connected with funding higher education and analyse and monitor REF2021.

This may result in case studies (but not corroborating evidence) being released to other users including academic researchers or consultants (commissioned by the funding bodies), to carry out research or analysis, in accordance with the Data Protection Act 2018 and the General Data Protection Regulation (Regulation (EU) 2016/679). Where information not previously published is released to third parties, this will be anonymised where practicable.

UKRI will require that anyone who has access to your data, held in UKRI’s records, paper or electronic, to respect its confidentiality and will only process it in accordance with instructions issued for the purposes specified by UKRI.

2. Specified, explicit and legitimate purposes

Any information you choose to provide to King’s will be used as corroborating evidence in an impact case study. This data will initially be stored on a King’s secure server which will only be accessible by necessary members of staff. Only one copy of the data will be stored and all versions in email form deleted once information is filed.

All case studies, unless marked with a redaction option, will be published by December 2021 and made available on the REF website. If you do not wish the information you provide to be made available in this way, please choose a redaction option (see below) and discuss your requirements with your King’s partner.

King’s may also use the case studies and corroborating evidence to showcase the impact of research through a range of mediums including online and in print, again respecting redaction options.

3. Adequate, relevant, not excessive

When you provide corroborating evidence, your data will be used in the body of an impact case and appended in case of audit. Impact case studies will not normally be submitted with personal information, except for your job title and/or organisation which may be included.

In all King’s processes to develop the final case study, appropriate levels of data redaction will be respected. If you choose to provide personal and contact information for corroboration purposes this will be stored securely and will only be used in audit circumstances. More information on REF audit processes can be found here.

If any part of your corroborating evidence is sensitive, REF2021 allows for 6 types of case study submission, each allowing for differing levels of confidentiality. These range from processes which cater for the inclusion of security sensitive information, to redaction of business sensitive material. Full details of these options can be found below. Each option may be specifically adapted for your requirements.

If you feel that your case contains sensitive information, needs any kind of redaction or you would like to discuss further options please contact your King’s partner and/or the REF Team.

4. Accurate

Sharing third party personal data with King's

Please ensure that if you are sharing any third-party personal data (that is any identifiable information that is not your own) with King’s, you have the necessary consent to do so. If you do not have consent, you must be able to demonstrate your other GDPR lawful basis for sharing and have informed the individuals concerned. If you cannot meet these requirements, please anonymise the information before sharing it with King’s.

Accessing your personal data through REF

To find out more about how the university deals with your personal information, including your rights and who to contact if you have a concern.

For any further questions please contact REFsupport@kcl.ac.uk.

Freedom of Information and Environmental Information Regulations

As a public authority, King’s is subject to the Freedom of Information Act 2000 and the Environmental Information Regulations 2004. This means that anybody is entitled to make a request to King’s for any information that we hold in a recorded form, and we must disclose it unless a relevant exemption applies. In the unlikely event that we receive a request for impact evidence that we hold, we will take into account the redaction options selected at submission and apply relevant exemptions where available.

5. Retention

Both King’s and UKRI will securely store data relating to impact case studies until six months after the REF2021 results are published (June 2022) then securely dispose of all material.

6. Security

Further information on King’s strict confidentiality and privacy principles can be found here

Impact Case Study Redaction Options

This table below will help you to understand what level of security should be applied to ensure that sensitive information remains confidential.

Level	Description	Internal Process	Evidence	REF2021 Review By	Published?	Notes
Security Sensitive	Case study based on or containing security sensitive information	To be reviewed only by those with appropriate security clearance	Only appropriate evidence to be supplied and stored by those with security clearance only	Only by those with appropriate security clearance	Not for publication	Needs to be highlighted to the REF team through formal reporting process before July 2019
Redaction (1)	Case study contains commercially sensitive information that cannot be published or reviewed by the whole REF2021 sub-panel	To be reviewed by UOA Impact leads only and marked as sensitive	Evidence to be directly transferred to Panel SharePoint by author and any sensitive documents highlighted to UOA impact leads	May identify specific panel members who should not have access to, or should have access only to the redacted versions	Not for publication	Author must give clear indication of who should not see the case study as soon as possible to ensure appropriate processes are put into place
Redaction (2)	Case study contains commercially sensitive information that cannot be published, but can be reviewed by REF2021 sub-panel members	To be reviewed by UOA Impact leads only and marked as sensitive	Evidence to be directly transferred to Panel SharePoint by author and any sensitive documents highlighted to UOA impact leads	All sub-panel members can review case study	Not for publication	Author must give clear indication of who should not see the case study as soon as possible to ensure appropriate processes are put into place
Redaction (3)	Case study contains small amounts of sensitive data which cannot be viewed by REF2021 sub-panel members, but the whole case study can be published with redaction	Normal review processes take place with all staff members aware of sensitive sections	Evidence may be transferred onto Panel SharePoint by RA. Any sensitive documents should be clearly identified	May identify specific panel members who should not have access to, or should have access only to the redacted versions	Redacted version published	Redacted versions suitable for publication to be submitted by 29 January 2021
Partially Redacted	Case study contains small amounts of sensitive data which can be viewed by REF2021 sub-panel members, but the whole case study can be published with redaction	Normal review processes take place with all staff members aware of sensitive sections	Evidence may be transferred onto Panel SharePoint by RA. Any sensitive documents should be clearly identified	All sub-panel members can review unredacted case study	Redacted version published	Redacted versions suitable for publication to be submitted by 29 January 2021
Standard Case Study	Case study contains no commercially sensitive or potentially inappropriate intellectual property	Normal review processes take place	All case study information stored securely on Panel SharePoint	All sub-panel members can review unredacted case study	Full version published	All case studies must be reviewed by governance team for pseudonymisation and GDPR compliance

If you would like to discuss your redaction options in more depth, please send us an email.