Legitimate interest assessment
The Information Commissioner's Office recommends performing a legitimate interests assessment (LIA) by answering a set of questions that they have posed, to demonstrate compliance in line with the accountability obligations under the GDPR. We include our LIA for reference below.
You need to assess whether there is a legitimate interest behind the processing.
Why do you want to process the data?
Please refer to 'Why do we collect a process data' in our privacy notice.
What benefit do you expect to get from the processing?
Broadly, the main benefits of the processing are aligned with the aims of the project: to reduce domestic energy consumption and thereby mitigate climate-change impact, and to improve the health and wellbeing of those who cannot afford to heat their homes properly. Both have positive impacts on wider society.
Are there any wider public benefits to the processing?
The outcomes of the project are aligned with wider public benefits. See the answer to the last question.
Do any third parties benefit from the processing?
Apart from the benefits to the wider public that we outline in our reasons for data collection and processing, no other third parties benefit directly from the processing.
How important are the benefits you have identified?
Climate change is one of the most significant threats to the delicate ecosystem in which we all live. With current levels of emissions, it is expected that global temperatures will increase by 2 to 4 degrees centigrade, which will result in significant changes in the sea level, habitability of huge areas of the planet and the frequency of extreme weather events.
It is estimated that 11% of UK households are in fuel poverty, defined as not being able to afford the costs of keeping a home adequately warm, and doing so would class them as being under the official poverty line. Fuel poverty leads to poor quality of life, poor health and preventable deaths. In 2015, approximately 15,000 people died unnecessarily between December and March from living in cold homes.
What would the impact be if you couldn’t go ahead with the processing?
If we were not able to collect or process data on the basis of legitimate interest for the wider public benefits, we would only be able to deliver surveys and thus benefits to those receiving the surveys. This would significantly limit the development of the CHEESE Project and its aims, making it difficult to apply for funding, to scale the project in Bristol or other areas and to expand its influence.
Would your use of the data be unethical or unlawful in any way?
To the best of our knowledge, we are complying with all relevant laws, industry guidelines and codes of practice, and there are no ethical issues associated with our processing.
You need to assess whether the processing is necessary for the purpose you have identified.
Will this processing actually help to achieve your purpose?
Yes. Please refer to 'Why do we collect a process data' in our privacy notice.
Is the processing proportionate to that purpose?
We believe that our approach to data collection and processing is proportionate since we only collect data that is necessary to achieving our aims, and we are transparent about the ways in which we use the data.
Is there another less intrusive way to achieve the same purpose?
Since the nature of our surveys are personal with visiting and assessing people's homes, their results necessarily involve personal data. There is no other obvious alternative to achieving the aims of the project without using that data as the basis of scientific analysis of our methods.
You need to consider the impact on individuals’ interests and rights and freedoms and assess whether this overrides your legitimate interests.
Nature of the personal data
What is the nature of your relationship with the individual?
The individual is someone concerned about their energy use and thus the recipient of a survey. Surveys are typically paid for but in some cases are provided for free. As part of the application for a survey, the individual agrees to report on their progress after one month and one year.
Did you collect the data directly from the individual?
All of our personal data is collected directly from the individuals and not via any third parties.
What did you tell them at the time?
Prior to the GDPR (25th May 2018), we provided the following privacy notice at the point of submitting a survey application or feedback:
Your data remains confidential with The CHEESE Project and we will never share your personal details with third parties. However, in order for us to be able to collect data city-wide on building faults and energy saving, etc. we may use anonymised recordings, photos, and details of the survey for the purposes of analysis, publicity, fund-raising etc. As part of our processes of recording survey outcomes, we may contact you by telephone or email to find out what action has been taken after a survey, and the effects of these actions.
How long ago did you collect the data? Are there any changes in technology or context since then that would affect expectations?
Collection of data up until enactment of the GDPR on 25 May 2018 includes the previous three surveying seasons of the CHEESE Project. The above privacy notice has been replaced on that date in order that our compliance with the GDPR is documented clearly. However, we have not altered significantly any of our processes regarding the collection and processing of data.
Is your intended purpose and method widely understood?
We make every effort to balance our processing with the privacy interests of the individual and to be transparent about our aims and methods with respect to data collection and processing, which are consistent with the aims the project. Details can be found on the pages of this website and in our privacy notice.
Are you intending to do anything new or innovative?
The CHEESE Project, by its nature, is innovative and is in constant development. We do not however expect our data processing activities to change significantly. Where changes are made, appropriate changes are made to our documentation and information relayed to those it affects.
Do you have any evidence about expectations – eg from market research, focus groups or other forms of consultation?
We collect feedback from individuals at various stages of the survey process, and we find that their expectations are closely aligned with the way that we operate.
Are there any other factors in the particular circumstances that mean they would or would not expect the processing?
Not that we are aware of.
Is any of the data particularly sensitive or private?
The survey video will necessarily contain detailed footage of the inside of an individual's house. For this reason, the video is retained by the CHEESE Project only for a short time to conduct CPD assessment, after which it is deleted. No other personal data that we collect is particularly sensitive or private.
What are the possible impacts of the processing on people?
Apart from the survey video, which is subject to only very limited processing and retention, the most intrusive data that we collect is contact details such as name, street address, email address, telephone numbers etc. An individual may be impacted by the use of these details outside of the processing specified in our privacy notice, for example if there was a data breach, the details might be used for direct marketing purposes.
Other personal data that we collect such as on thermal faults in a home or behavioural changes in terms of energy use as the result of a survey would likely have negligible impact on an individual's privacy interests were they to be used wrongfully outside of our data processing policy.
What is the likelihood and severity of any potential impact?
The likelihood of any potential impact is low since we take necessary security measures. The severity is low since we do not hold any particularly sensitive personal data.
Can you adopt any safeguards to minimise the impact?
Will individuals lose any control over the use of their personal data?
Individuals have various rights over their data in line with the GDPR, which we uphold as long as we retain their data.
Are some people likely to object to the processing or find it intrusive?
We don't anticipate that would be likely, but we do provide means for individuals to raise such concerns with us, in line with the GDPR individual rights.
Would you be happy to explain the processing to individuals?
We have done in our privacy notice.
Can you offer individuals an opt-out?
Our surveys are entirely optional, and an individual can exercise their right to erasure at any time.