Special category data POLICY

This document sets out: 

• how to comply with the data protection principles to process special category personal data.
• how to handle special category data that is processed, our lawful basis and purpose of processing and the relevant condition for processing under GDPR and data protection law.
• it explains policies for the retention and erasure of personal data processed under the relevant condition.

This policy document will be retained, reviewed and (if appropriate) updated by  Condor Ferries and (if requested) made available to the Information Commissioner, until six months after Condor cease carrying out the processing.

Special category data at a glance: 

Special category data is personal data which the General Data Protection Regulations (GDPR) says is more sensitive, and so needs more protection.  In order to lawfully process special category data, Condor must identify both a lawful basis under GDPR and a separate condition for processing special category data.

The special categories are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

The special category personal data that Condor may process relate to the equal opportunities act, including ethnic origin, health or religion/belief, and the Maritime passenger rights Regulation (EU Regulation 1177/2010) which aims to provide disabled persons and persons with reduced mobility with the same opportunities to travel by ferry as they have in other transport sectors across the EU.

The provision of equality monitoring data such as race or ethnic origin and health (disability) is optional in some circumstances. As the data subject, Condor Ferries will tell you when this applies at the time we collect the information.

Protecting children’s data

Except where Condor is required to collect disability data under the Maritime passenger rights Regulation, we do not collect specialist category data of children under 16 years of age unless this is voluntarily disclosed by the parent or legal guardian.

Principles: General Data Protection Regulations (GDPR) has 6 rules that must be followed when collecting and using personal information and to comply Condor must take steps to make sure all personal information is:

• processed lawfully, fairly and in a transparent manner.
• collected for specified, explicit and legitimate purposes.
• adequate, relevant and limited to what is necessary.
• accurate and up to date.
• kept in a form which permits identification of data subjects for no longer than is necessary.
• processed securely.

What are the lawful bases for processing?

The lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever processing personal data:  

• Consent: the individual has given clear consent to process their personal data for a specific purpose.
• Contract: the processing is necessary for a contract with the individual, or because they have asked to take specific steps before entering into a contract.
• Legal obligation: the processing is necessary to comply with the law (not including contractual obligations).
• Vital interests: the processing is necessary to protect someone’s life.
• Public task: the processing is necessary to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
• Legitimate interests: the processing is necessary for Condor legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if to a public authority processing data to perform official tasks.)

The special conditions under GDPR which allow processing of special category personal data are: 

• Article 9(2) (a) – explicit consent has been given.
• Article 9(2) (b) – for employment, social security and social protection purposes.
• Article 9(2) (c) – for vital interests.
• Article 9(2) (d) – for legitimate activities by a foundation, association or any other not for profit body with political, philosophical or religious or trade union aim.
• Article 9(2) (e) – for employment, social security and social protection purposes.
• Article 9(2) (f) – for defence of legal claims.
• Article 9(2) (g) – for substantial public interest purposes.
• Article 9(2) (h) – for health and social care purposes.
• Article 9(2) (i) – for public health purposes.
• Article 9(2) (j) – for archiving, research and statistics purposes.

Conditions relating to the processing of the special categories of personal data Schedule 1 of the Data Protection Act 2018 establishes conditions that permit the processing of the special categories of personal data and criminal convictions data.

The Schedule is split into four parts:

• Part 1 – Conditions relating to employment, health and research
• Part 2 – Substantial public interest conditions
• Part 3 – Additional conditions relating to criminal convictions.
• Part 4 – Appropriate policy document and additional safeguards.

Schedule 1 of the Data Protection Act 2018 establishes conditions that permit the processing of the special categories of personal data as follows:

• The processing of the special categories of personal data meets the requirements in points (b), (h), (i) or (j) of Article 9(2) of the GDPR if it meets one of the conditions listed in Part 1 of Schedule 1.
• The processing of the special categories of personal data meets the requirement in point (g) of Article 9(2) of the GDPR if it meets one of the conditions listed in Part 2 of Schedule 1.
• Processing meets the requirement in Article 10 of the GDPR if it meets one of the conditions listed in Part 1, 2 or 3 of Schedule 1.

Schedule 1 Conditions that are relevant to Condor:

1. Schedule 1, Part 1 conditions for processing in connection with employment, health and research that are relevant are:
   • Employment, social security and social protection: Processing necessary for the purposes of performing or exercising obligations or rights of the controller or the data subject under employment law, social security law or the law relating to social protection.
   • Health or social care: Processing necessary for health or social care purposes such as, but not limited to, the assessment of the working capacity of an employee.

1. Schedule 1, Part 2 conditions for processing in the substantial public interest that are relevant are:
   • Equality of opportunity or treatment: Processing necessary for identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people with the view to enabling such equality to be promoted or maintained.
   • Support for individuals with a particular disability or medical condition: processing of data concerning health.

1. Schedule 1, Part 3 conditions for processing of criminal convictions data that is relevant are:
   • Consent: processing with the consent of the data subject.
   • Extension of certain conditions under Schedule 1, part 2: allows processing of criminal convictions data where processing meets a condition in schedule 1 part 2 that meets the substantial interest test.

The processing of special category personal data:

1. a) Race or ethnic origin, health.

• Purpose: Equality and diversity.
• Law: Equality Act 2010 and associated regulations.
• Article 9 (2) (g) substantial public interest.
• Data Protection Bill Schedule 1 part 2, 3 condition: equality of opportunity or treatment.
• Retention period: current record retained as long as is necessary to comply with equality law.
• Disclosed to: refer to Condor Ferries’ privacy notice for details .

1. b) Race or ethnic origin, health, sexual orientation.

• Purpose: Employment.
• Law: Employment Law.
• GDPR Article 6 (1) (b) contract, Article 9 (2) (b) for the purpose of employment, social security and social protection.
• Data Protection Bill Schedule 1 part 1, 1 condition: employment, social security and social protection.
• Retention period: current record retained as long as is necessary to comply with employment law.
• Disclosed to: refer to Condor Ferries’ privacy notice for details.

1. Criminal Convictions,
   • Purpose: the processing of criminal convictions data where necessary for the purposes of performing or exercising employment law obligations or rights (criminal conviction disclosure certificate, criminal conviction declaration form at recruitment and selection) or consent has been granted to process the information.
   • Law: Employment Law and Data Protection Law.
   • GDPR Article 6 (1) (b) contract, and Article 6 (1) (a) Consent, Article 9 (2) (b) for the purpose of employment, social security and social protection.
   • Data Protection Bill Schedule 1 part 3, 1 condition: processing criminal convictions data with consent and/or the extension of certain conditions under schedule 1 part 2 processing in the substantial public interest.
   • Retention period: disclosure certificates are destroyed after 90 days; criminal conviction forms are destroyed after 6 months.
   • Disclosed to: refer to Condor Ferries’ privacy notice for details .

Our official functions have a clear basis in law which are:

• EU Directive 98/41/EU and associated regulations;
• Maritime passenger rights (EU Regulation 1177/2010) and associated regulations;
• Equality Act 2010 and associated regulations.
• Employment Law and associated regulations.

The purposes of the processing, where relevant, are:

• Employment for managing absence, reporting on health and safety, and recruitment monitoring;
• Equality and diversity monitoring;
• Adhering to Maritime passenger rights (EU Regulation 1177/2010) requiring Condor to ensure that passengers with disability or impaired mobility have the same opportunities to travel as they do in other areas of travel in the EU;
• Adhering to obligations under the EU Directive 98/41/EU and associated regulations.

In respect of equality monitoring reports the data is either anonymised or excluded to ensure individuals cannot be identified.

Retention period or criteria used to determine the retention period:

Condor retain and erase personal data in accordance with our Data Retention policy. Our retention schedules for each area are published on our website. They contain a list of records, the length of time the records are kept and what happens to them. Condor retain personal data in accordance with legal requirements or as long as is necessary to deal with an enquiry or complaint.

Data security:

Condor is committed to protecting the information you provide. To safeguard the special category data provided, physical and electronic processes are in in place to protect the security of the data collected and processed.

Privacy Notice:

Our privacy notice is available on our website condorferries.co.uk/privacy-policy

Our Data Protection Officer is:

C/O Data Protection Officer
Condor House
New Harbour Road South
Poole
Dorset
BH15 4AJ

Email: dataprotection@condorferries.co.uk