General Data Protection Regulations (GDPR) Privacy Notice

Highways England have fully committed to adherence of the General Data Protection Regulations (GDPR) following implementation on the 25th May 2018. In relation to our collection and processing of personal data, please see the below information.

Section 1 - Collection of Data

1. Highways England will be the data controller and the contact details for the company are:
   
   a) Data Protection Officer: Graham Woodhouse
   b) E-mail: DataProtectionAdvice@highwaysengland.co.uk
   
   
2. The data is being collected for: Technology Software Services Contract TMT-054
   
   
3. The data processors, working on behalf of Highways England in relation to this will be:
   
   Mott MacDonald & Costain
   
   
4. Collected data will stored within secure electronic records management systems, with the system being dependant on the nature of information. The systems used by Highways England are:
   
   Live TSS supported systems, i.e. HATMS Hosting system, Site Data Centre website and Halogen.
   
   
5. Information stored by third parties will be held on the following systems:
   
   Information is securely held on the live TSS supported systems listed under point 4) above. Secure encrypted backups of TSS systems (which will include user data) is gathered weekly and transferred to Mott MacDonald premises for:
   
   • Restoring system functionality if an operational equipment failure occurs.
   • Updating secure CAT spares at MM premises which can then be used for issue investigation and formal testing of system updates. These systems are securely isolated and access is only permitted for MM project personnel approved by Highways England.
   
   Mott MacDonald also maintain a standalone database application to track user accounts and their expiration, used by our helpdesk to export user email addresses for service announcements.

Section 2 - Processing of data

In addition to the information referred to in section 1, at the point of collection we will, at the time when personal data are obtained, provide you with the following further information necessary to ensure fair and transparent processing:

1. The personal data will be stored for until the user requests for their information to be removed from the system or we are informed that they are no longer employed by the company which their data is held under.
   
   
2. Under GDPR you have rights to request information from the company
   • Right of access to the data (Subject Access Request)
   • Right for the rectification of errors
   • Right to erasure of personal data - not an absolute right
   • Right to restrict of processing or to object to processing
   • the right to data portability;
   
   
3. If the processing is based on receiving the consent of the data subject then we have to inform the data subject that they have the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
   
   
4. You have the right to lodge a complaint with a supervisory authority (in the UK that is the Information Commissioners Office)
   
   
5. If we are to process the personal data we hold for a purpose other than that for which it was originally collected then we will provide the you with information on what that other purpose is prior to that further processing taking place. The extra information will include any relevant further information as referred to above including the right to object to that further processing.