Bus Reform further consultation: privacy notice

Introduction

Transport for Greater Manchester (TfGM) is committed to making sure that we tell you about the ways in which we use your personal information and that we have the right controls in place to make sure it is used responsibly and kept safe from inappropriate access, theft, or misuse.

TfGM is acting on behalf of the Greater Manchester Combined Authority to undertake a further consultation on the introduction of a Proposed Franchising Scheme for buses in Greater Manchester in light of the potential impacts of Covid-19 on the bus market in Greater Manchester.

Ipsos MORI have been commissioned to assist TfGM in collecting feedback from the consultation. As independent consultants Ipsos MORI will collate, thematically code, analyse and report on the responses received.

In light of Covid-19 and the restrictions around face-to-face engagement, a virtual engagement platform will also be used to display information and answer questions via a chat function. This engagement platform will be hosted by AECOM.

This notice explains how we will use your information and tells you about your privacy rights and how the law protects you.

For further information about our core data protection obligations and commitments please see TfGM’s primary privacy notice on the Privacy Policy page.

---

What information do we collect and why?

The consultation will ask you questions in relation to the impacts of Covid-19 on the Proposed Franchising Scheme to understand your views. The personal information we process and collect will be provided to us directly by yourself. Whilst it is not compulsory, some personal data may be collected in the process of this consultation. Personal data that may be collected includes:

• Age Groups i.e. under 13, 13-19, 20-30 etc.
• Name
• Email address
• Address/postcode
• Local Authority area
• Gender
• Job role/Organisation details

We may use your personal details to keep you informed on the development of the Proposed Franchising Scheme, as well as providing you with information about support if you are affected by the proposals. We may also use your details to contact you if you are willing to take part in further research/consultation activity.

If you wish to leave the survey and return later, you can enter your email address, and we will send you a link so you can return to the survey where you left. We may also send you a reminder email. This will only be sent if you chose to provide your email address.

If a child under the age of 13 wishes to receive further information about the proposals or wishes to save their questionnaire responses part-way through, they will be asked to give their parent / guardian contact details rather than their own.

The Virtual Engagement Platform Chat for the consultation will ask for name and contact information in order to best process any questions and allow the option of a later response to any information requested”. The personal information we process and collect will be provided to us directly by yourself. Whilst it is not compulsory some personal data may be collected in the process of this consultation. If using our virtual engagement platform chat, we may use your email address to contact you with any further relevant information.

In addition, qualitative research will be undertaken by Ipsos MORI with groups most impacted by the proposals. These will take place virtually through online discussions over MS Teams or alternative platforms, to explore in greater depth whether the effects of COVID-19 change opinion about the Proposed Franchising Scheme. Names and email addresses will be collected for the purpose of holding the online meeting. This data will be deleted within three months after the qualitative research has concluded.

We may also collect some special category personal data within the consultation. Special category data is data that is deemed more sensitive. For the purpose of this consultation we may collect the following special category data:

• Physical or mental health information
• Racial or ethnic group information
• Religious believes or similar
• Sexual life/orientation

We ask for this data so that we can check the impact of the proposals on different demographic groups and to show we reach a proportionate amount of the community.

You do not have to answer the questions on personal data if you do not want to.

Data collected from this consultation will be aggregated, so you will not be identified. Anonymised data will be shared with the Greater Manchester Combined Authority, academic institutions or contractors working on behalf of TfGM for the development of the Proposed Franchising Scheme and research purposes.

As well as information directly collected directly from you, we also collect or receive information from Bus operating companies.

---

How do we keep your information safe?

TfGM is committed to the security of the information we collect, and we use reasonable measures to prevent unauthorised access to that information. We are required to demonstrate that our solutions meet the required levels of personal, procedural, policy, data and technical security. We will only process personal information for the purposes it has been collected or subsequently authorised.

The survey is hosted by Ipsos MORI using Dimensions. Dimensions is a survey platform which has the highest standards of data security achieving ISO27001 accreditation.

All electronic consultation information will be encrypted with a secure password. Ipsos MORI and TfGM will restrict access to your personal information.

In relation to consultations sent to us in the post, information will be stored in a secure office with limited access.

---

How long is the information kept for?

Your information will only be kept for as long as necessary. After the consultation process has closed Ipsos MORI will transfer all the responses to TfGM and securely delete their own copies.

TfGM will retain your data for two years, or as long as required if there are any legal challenges to the consultation.

---

Lawful basis for processing your information

As TfGM has been asked to co-ordinate this consultation on behalf of the Greater Manchester Combined Authority, our lawful basis for processing under GDPR is:

• GDPR Article 6(1)(e): the processing is necessary for the performance of its official tasks carried out in the public interest.

And for the more sensitive data:

• GDPR Article 9(2)(g): the processing is necessary for reasons of substantial public interest

---

Who we will share your information with?

The information collected as part of this consultation will only be used by TfGM. Your personal data will not be shared with any other third parties. An anonymised report will be shared with the Greater Manchester Combined Authority. This will not contain any personal data.

If you are responding on behalf of an organisation. The organisation’s name may be used but you will not be personally identified.

---

Freedom of Information

Information provided in response to this consultation, including personal information, may be subject to publication or disclosure in accordance with the access to information regimes. These are primarily the Freedom of Information Act 2000 (FOIA), and the Environmental Information Regulations (EIR) 2004.
Under FOIA TfGM are obliged to publish certain information about their activities, and members of the public are entitled to request information from us. The Act does not give people access to their own personal information. If you would like to see information that TfGM hold about you, you should make a subject access request. Details of how to do this are mentioned below.

---

Your rights as a data subject (any individual person who can be identified)

The GDPR gives you the following rights over your information:

• Your right to get copies of your information
  You have the right to ask for a copy of any information about you that is used.

• Your right to get your information corrected
  You have the right to ask for any information held about you that you think is inaccurate to be changed.

• Your right to limit how your information is used
  You have the right to ask for the use of any information held about you to be restricted. For example, you can ask this where you think the information TfGM is using is inaccurate.

• Your right to object to your information being used
  You can ask for any information held about you not to be used. This is not an absolute right and TfGM may need to continue to use your information. We will tell you why if this is the case.

• Your right to get your information deleted
  You can ask for any information held about you to be deleted. This is not an absolute right and TfGM may need to continue to use your information. We will tell you why if this is the case.

To find out what information we hold about you, you need to make a Subject Access Request. If you wish to exercise any of your information rights including making a Subject Access Request, please contact us on data.protection@tfgm.com

If you are not satisfied with the response from us, you can complain to the Information Commissioner’s Office. For further details on this and your information rights please visit the Information Commissioner’s Website.

---

Data Protection Officer (DPO)

TfGM is required by law to have a DPO. The DPO has several duties, including:

• Monitoring the organization’s compliance with data protection law;
• Providing expert advice and guidance on data protection;
• Acting as the point of contact for data subjects; and,
• Co-operating and consulting with the Information Commissioner’s Office (see ‘Complaints’ below).

TfGM’s DPO can be contacted at data.protection@tfgm.com. Further details of how TfGM process your data and how you can exercise your rights are available on our Privacy Policy page.

For Ipsos MORI’s privacy policy please the Ipsos MORI website or email compliance@ipsos.com

In relation to the Virtual Engagement Platform, please see AECOM’s privacy policy by visiting their website or email privacyquestions@aecom.com.

Further information about data privacy and your rights under the General Data Protection Regulation (the “GDPR”) can be found at the ICO website.

If you have any concerns about our use of your personal information, you can make a complaint to us at data.protection@tfgm.com.

You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow
Cheshire. SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

---