What we do with your data

To make an enquiry

We will process the personal data you provide in order to respond to your enquiry and to fulfil our responsibilities as a regulator.

This is necessary for us to perform our public tasks.

Refer to number 5 and 12 below, where we specify the legal basis for this.

To make a complaint about us

We will process the personal data you provide, and any other relevant information, to investigate, action and resolve your concerns as part of our statutory duties and public tasks.

If your complaint involves the processing of special category personal data, whether about yourself or others, it is in the public interest and regulatory good practice for us to process this data in order to investigate.

Refer to number 5 and 12 below, where we specify the legal basis for this.

To make a claim

We will process your personal data and any other relevant information, including special category personal data, where it is necessary for us to establish, exercise or defend legal claims, including claims against the EHRC.

We may share this data with third parties such as our solicitors, HM Courts and Tribunals Service (HMCTS), and other legal professionals where it is necessary for the purpose of legal proceedings, obtaining legal advice or otherwise establishing, exercising or defending legal rights, or as required by a rule of law.

Refer to number 5 and 11 below, where we specify the legal basis for this.

To make a Freedom of Information (FOI) request

We will process your contact information and any other personal data you provide in order to fulfil your request.

This is necessary for us to comply with our legal obligations under the Freedom of Information Act 2000 or The Environmental Information Regulations 2004.

Refer to number 3 and 12 below, where we specify the legal basis for this.

To make an information rights request

We will process your contact information and any other personal data you provide in order to fulfil your request.

This is necessary for us to comply with our legal obligations under the UK General Data Protection Regulation and the Data Protection Act 2018.

Refer to number 3 and 12 below, where we specify the legal basis for this.

To submit a notice of commencement of court proceedings

When you bring a discrimination claim relating to equality in the County Court or Sheriff Court, you need to tell us. Failure to do so may affect the progress of your claim.

We will process the personal data you provide, and any other relevant information, to monitor the nature and volume of discrimination cases brought to the Courts for breaches of the Equality Act 2010.

If your claim involves the processing of special category personal data, it is in line with our function as a regulator and within our statutory powers to process this data.

We may also decide to intervene in a case brought to our attention if we feel the case is of strategic interest and believe we can assist the Court by providing expert testimony.

Refer to number 5 and 12 below, where we specify the legal basis for this.

To make a complaint about another organisation or individual

We will process the personal data you provide, and any other relevant information, to investigate your complaint.

If your complaint involves the processing of special category personal data, it is in line with our function as a regulator and within our statutory powers to process this data.

Refer to number 5 and 12 below, where we specify the legal basis for this.

To report bad practice or whistleblow

We will process the personal data you provide, and any other relevant information, to consider your concerns.

If your concerns involve the processing of special category personal data, it is in within our statutory powers to process this data.

Reporting anonymously or confidentially

You do not need to give us your name or contact details, but it is helpful if you do.

If you report concerns anonymously, it might make it harder for us to investigate or to conduct any enquiries.

We cannot guarantee that your identity will remain protected, however we will treat the information you provide as confidential and we will not disclose it without a valid reason as set out in law. You should be aware that even if you have contacted us anonymously, if we need to share information, you could still be identified by the particular circumstances of your concern.

Refer to number 5 and 12 below, where we specify the legal basis for this.

What we do with your information

The information you provide helps us decide whether to look more closely at an organisation’s compliance with equality and human rights law. 

We will make a record of your concern and decide whether to take any action on it in line with our business plan and litigation and enforcement policy.  

We are unlikely to get in touch with you again unless we need more information. If we do need more information and you have given us your contact details, we will get in touch using the details you have provided, unless you have indicated that you do not wish to be contacted. Your contact details and any reasonable adjustments requested are processed to ensure we have accurate information to contact you and we are aware of reasonable adjustments that you require.

Refer to number 6 below, where we specify the legal basis for this.

Even if you do not hear from us, or we don’t take immediate action, we will use the information you provided in our work. For example, to help us plan what we will do in the future. We take all concerns seriously and deal with them on a case-by-case basis.

You will not have a say in how we deal with your concern and we may not be able to give you much detail if we have to keep the confidence of other people. Section 6 of the Equality Act 2006 may also limit what we can share with you about any action we take.

If you make a ‘protected disclosure’ as a whistleblower, the information you provide with will be handled in accordance with our whistleblowing policy.

Visiting our office

We will process your name and sometimes a photo of you so that we can issue you with a personalised visitor badge.

This will be shared with reception staff who, depending on the site, will ask to see a copy of your photo identification for verification purposes, but they will not make a copy.

You will also be asked to sign in and out of the building. This is necessary under our legitimate interests in security and health and safety at our offices.

Refer to number 6 below, where we specify the legal basis for this.

Please note, security controls are slightly different at each of our offices.

Whilst in our office premises, your image will be caught by CCTV cameras which are operated and managed by us. Sometimes, this may also involve the processing of special category personal data, for example where the image captures a visible disability.

Processing this data is necessary under our legitimate interests in security and health and safety, and to prevent or detect unlawful acts.

Refer to number 6 and 12 below, where we specify the legal basis for this.

There are also CCTV cameras operated and managed by the relevant building management companies at the sites in which our offices are based.

Subscribing to our newsletter, bulletin or other updates about our work

We will process your contact information to send information to you. We do this with your consent or as part of our public tasks and functions.

Refer to numbers 1 and 5 below, where we specify the legal basis for this.

If you opt out of hearing from us, we will retain a copy of your contact information and communication preferences in relation to newsletters, bulletins and other updates to ensure you are not contacted again in the future. This is necessary for us to comply with our legal obligation to respect your request.

Refer to number 3 below, where we specify the legal basis for this.

Joining one of our networks, campaigns or groups

We will process your contact information if you join one of our networks, groups, campaigns or sign one of our pledges to:

• Share knowledge, best practice and exclusive content with you
• Follow up with materials to support your pledge or subscription

This may include:

• News and updates relevant to your subscription or pledge
• Tips, advice and guides
• Invitations to training, events, conferences and webinars

We do this with your consent or as part of our public tasks and functions.

Refer to numbers 1 and 5 below, where we specify the legal basis for this.

If you opt out of hearing from us, we will retain a copy of your contact information and communication preferences in relation to our networks, groups, campaigns and pledges to ensure you are not contacted again in the future. This is necessary for us to comply with our legal obligation to respect your request.

Refer to number 3 below, where we specify the legal basis for this.

If you are one of our stakeholders

A stakeholder could be an organisation or individual who we already work with or is interested in working with us.

We will process your contact information in order to liaise with you about related work, events, training, research or our other activities if:

• You work with us or might be interest in working with us
• You work for an organisation that undertakes relevant work
• You are an academic or researcher in a similar field
• You work in the press, media or journalism sectors
• You are a blogger
• You are any other relevant stakeholder

We do this with your consent or as part of our public tasks and functions. If you work in the press, we may obtain your contact information and engagement data from online journalist databases and other public relations platforms, such as Onclusive.

Refer to numbers 1 and 5 below, where we specify the legal basis for this.

We may also store information about your potential interests based on your work, research or publications you may have been involved in. We believe it is in your legitimate interest to receive information relevant to your work and interests.

Refer to number 6 below, where we specify the legal basis for this.

Using our publications

If you wish to re-use our information or publications, we will process the personal data you provide and any other relevant information, to administer intellectual property licenses and copyright permissions granted to or given by us.

This is necessary for us to fulfil our contract with you, and where applicable, to comply with our legal obligations.

Refer to number 2 and 3 below, where we specify the legal basis for this.

For more information, read our terms of use.

Attending an event or training session

We will process your name and contact information to register your attendance at an event or training session.

We do this under our legitimate interest to facilitate events, to provide you with an acceptable service, and to ensure appropriate security and health and safety at such events. 

Refer to number 6 below, where we specify the legal basis for this.

We will maintain a record of your attendance and may follow up with you in relation to the event and any potential further relationship.

We do this under our legitimate interest to provide you with a good service and to maintain relationships with our stakeholders. 

Refer to number 6 below, where we specify the legal basis for this.

If you contact us for advice on equality and human rights

We will process the personal data you provide and any other relevant information in order to advise you.

If your request involves the processing of special category personal data, it is in line with our function as a regulator and within our statutory powers to process this data.

Refer to number 5 and 12 below, where we specify the legal basis for this.

If we are involved in a legal case relating to you or where there is information about you

We will process your personal data and any other relevant information as necessary for the case.

If the case involves the processing of special category personal data, it is in line with our function as a regulator and within our statutory powers to process this data.

Refer to number 5 and 12 below, where we specify the legal basis for this.

If the case involves the processing of criminal conviction data, it is within our statutory powers and necessary for the purposes of legal claims to process this data.

Refer to number 5 and 15 below, where we specify the legal basis for this.

This includes where we impose injunctions, interdicts or undertake judicial reviews.

Refer to number 5 and 12 below, where we specify the legal basis for this.

If we collect your data as part of an inquiry

We conduct inquiries in the public interest, and under our statutory powers, into any matter relating to Sections 8 or 9 of the Equality Act 2006.

We will process your personal data and any other relevant information, including special category personal data, as necessary and relevant to the inquiry.

We may collect this information from you or from other sources, including:

• Government departments
• Private companies
• Voluntary sector organisations
• Members of Parliament and Ministers
• Public sector organisations
• Regulators
• Solicitors
• Unions
• Advice organisations
• Publicly available information
• Other sources

If necessary, we may require organisations or individuals to provide information to us. Failure to do so may result in us applying for a court order to acquire the information.

Your personal data will only be processed for the purposes of the inquiry, in line with its published terms of reference, and in any investigations launched as a result of the inquiry.

This data will not be disclosed unless explicitly permitted by Section 6 of the Equality Act 2006.

Refer to number 5 and 12 below, where we specify the legal basis for this.

We may process your personal data to contact you about the information you have provided. We do this with your consent, unless it is otherwise necessary and within our statutory powers to do so.

Any findings, reports or recommendations shared or otherwise published as part of the inquiry will only contain anonymised statistics or case studies, unless you have otherwise consented to publication of identifiable information.

Refer to number 1 below, where we specify the legal basis for this.

If you respond to one of our public consultations, research projects, calls for evidence or respond to a survey

We will process the personal data you provide for analysis and evidence purposes relevant to the stated activity. For example, to understand experiences of discrimination or in support of the National Human Rights Institutions (NHRIs) accreditation process.

If the activity involves the processing of special category personal data, it is within our statutory powers to process this data, and in some cases, we will instruct other organisations to undertake these activities on our behalf.

We often use the information you provide to publish anonymised data such as statistics, but these will not identify you in any way.

Refer to number 5 and 12 below, where we specify the legal basis for this.

If you provide us with your story or details about your experiences for a case study

We will process the personal data you provide, and any other relevant information to your story or experience(s), to publish publicly as a case study. This can include material in written, audio and / or video formats.

We will consider if we can publish case studies in an anonymised form wherever possible. If we are unable to do this, we will only publish case studies that identify you with your consent.

If your story or experience involves the processing of special category personal data, we will only process and publish this information with your explicit consent.

We will also process your contact information to liaise with you about the case study itself, but this information will not be published in any event.

Refer to number 1 and 7 below, where we specify the legal basis for this.

If you provide or allow us to take photos or images of you to use for our publications or website

We will use these photos or images in our publications, website or in other public facing media, such as on our social media channels.

Sometimes, this may also involve the processing of special category personal data, for example where the image captures a visible disability.

We do this with your explicit consent.

Refer to number 1 and 7 below, where we specify the legal basis for this.

If you provide us with or we legally obtain evidence relating to you as part of our compliance or enforcement work

We will process your personal data and any other relevant information, including special category personal data, as necessary to review practices, compliance standards and undertake our enforcement work.

It is within our statutory powers to process this data.

Refer to number 5 and 12 below, where we specify the legal basis for this.

We may ask you to provide evidence containing personal or special category personal data to us. In some cases, we may have legal powers to compel you to provide such information where it is necessary and reasonable.

We may also use information in the public domain and data provided by other organisations and individuals to support this work.

Evidence we collect as part of our compliance or enforcement work may be shared with the party we are regulating. Where possible, we will ensure that individuals are not identifiable in the information we share. In some circumstances, individuals may be identifiable by their name the information we share, where this is necessary to undertake our work.

Refer to number 5 and 12 below, where we specify the legal basis for this.

If we intend to criticise you in our draft report, we will provide you with the opportunity to make representations, which we will consider before finalising our report.

If we intend to make an unlawful act finding against you as an individual, we will notify you and provide you with a copy of our draft report. You will be given at least 28 days to make any representations, which we will consider before publishing the final report.

If we conclude at the end of an investigation that you have committed an unlawful act, we are legally required to publish details of this finding in a report.

Refer to number 3 and 12 below, where we specify the legal basis for this.

Where possible, we will ensure that individuals are not identifiable in any reports published as part of our enforcement work, however in some circumstances individuals may be identifiable by being named or due to the context of the report. Such context is necessary to meet our legal obligation to publish our findings and evidence relied on for our findings.

If you are named in the report, or if there is a risk of you being identified from the report, we will make reasonable efforts to notify you prior to publication.

Refer to number 3 and 12 below, where we specify the legal basis for this.

Where we receive evidence as part of a statutory investigation, inquiry, assessment, agreement or notice, there are restrictions on our ability to release this type of information. Equally, where we are legally required to publish findings, this may affect your ability to object to publication. This does not affect your rights under data protection legislation.

If you provide us with or we legally obtain evidence relating to your organisation's compliance with equality and human rights obligations as part of our compliance or enforcement work

We will process personal data and any other relevant information, including special category personal data, as necessary to review practices, compliance standards and undertake our enforcement work.

It is within our statutory powers to process this data.

Refer to number 5 and 12 below, where we specify the legal basis for this.

We may ask you to provide evidence containing personal or special category personal data to us. In some cases, we may have legal powers to compel you to provide such information where it is necessary and reasonable.

We may also use information in the public domain and data provided by other organisations and individuals to support this work. For example, for our gender pay gap enforcement work we obtain contact details from the Government Equalities Office (GEO).

Refer to number 5 and 12 below, where we specify the legal basis for this.

This includes where you or your organisation may be subject to formal enforcement action including investigations, Public Sector Equality Duty assessments and / or Judicial Reviews.

Refer to number 5 and 12 below, where we specify the legal basis for this.

If you provide a service, act as a supplier or bid or tender for a contract

We will process your contact information or that of a representative, and any other relevant information, in order to liaise with you about, and fulfil, the contract of service(s).

This is necessary for us to fulfil our contract with you.

Refer to number 2 below, where we specify the legal basis for this.

We will share relevant information with external organisations such as HM Revenue and Customs (HMRC) and the National Audit Office (NAO).

This is necessary for us to comply with our legal obligations.

Refer to number 3 below, where we specify the legal basis for this.

If you provide legal services to us, we will publish the names of any legal professionals and related expenditure in line with our statutory obligations.

Refer to number 3 below, where we specify the legal basis for this.

If you apply to join our panel of counsel

We will process the personal data you provide to assess your suitability for the panel, to contact you about your application, and to proceed with any future contract we may have with you.

This is necessary for us to be able to consider your application or to enter a contract with you.

Refer to number 2 below, where we specify the legal basis for this.

We will also collect special category personal data from you to monitor and ensure equality of opportunity and treatment on the panel. This information will be held separately and will not be used to consider your suitability for the panel.

Refer to number 3 and 12 below, where we specify the legal basis for this.

We will share relevant information with external organisations such as HM Revenue and Customs (HMRC) and the National Audit Office (NAO), and publish your name and our expenditure relating to your services on our website. This is necessary for us to comply with our legal obligations.

Refer to number 3 below, where we specify the legal basis for this.

If you apply for a grant from us

We will process your contact information or that of a representative, and any other relevant information, in order to liaise with you about and / or award the grant, and other related services.

If you are an organisation, we may also collect references to ensure the appropriate use of public funds.

It is within our statutory powers to process this data.

Refer to number 5 below, where we specify the legal basis for this.

If you apply for a role at the Equality and Human Rights Commission

Please refer to our privacy notice for prospective employees.

If you contact us, visit one of our offices, attend an event or otherwise engage with us and require any reasonable adjustments

We will process your personal data and any other relevant information, including special category personal data, to put in place any adjustments or requirements you may need.

We may need to share this information with our service providers, such as building facilities, health and safety or catering staff to ensure appropriate arrangements are in place.

This is necessary for us to comply with our legal obligations.

Refer to number 3 and 12 below, where we specify the legal basis for this.

We may collect details

We will process your name, contact information and any other relevant information, such as your Internet Protocol (IP) address when you visit our website.

We do this under our legitimate interest to keep our website working, but also as part of our legal obligations to maintain appropriate security.

Refer to number 3 and 6 below, where we specify the legal basis for this.

We may store cookies on your device

A ‘cookie’ is a small file that we store on your device to collect information about how you use our website.

For more information on how we use these, read our cookies policy.

Personal Data

When processing your personal data, we will always meet at least one of the following bases within the UK General Data Protection Regulation (UK GDPR):

1. We have your consent
   Article 6 (1)(a)
    
2. The processing is necessary to fulfil a contract that we have with you
   Article 6 (1)(b)
    
3. The processing is necessary for us to meet a legal obligation
   Article 6 (1)(c)
    
4. The processing is necessary to protect someone’s vital interests
   Article 6 (1)(d)
    
5. The processing is necessary for us to perform our public tasks or a task in the public interest
   Article 6 (1)(e)
    
6. There is a legitimate interest in the processing
   Article 6 (1)(f)

Special category personal data

There may be occasions where we need to process more sensitive information about you, such as data relating to your:

- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Health
- Sex life or sexual orientation
- Genetic or biometric data for identification purposes

If we process any of the data listed above, we will also meet at least one additional condition within the UK GDPR:

 7. We have your explicit consent
     Article 9 (2)(a)

 8. The processing is necessary for employment purposes
     Article 9 (2)(b) and Schedule 1, Part 1 (1) of the DPA 2018

 9. The processing is necessary to protect someone’s vital interests
     Article 9 (2)(c)

 10. The information has been made public by you
       Article 9 (2)(e)

 11. The processing is necessary to exercise or defend legal claims
       Article 9 (2)(f)

 12. The processing is necessary for reasons of substantial public interest
       Article 9 (2)(g) and Schedule 1, Part 2 of the DPA 2018

 13. To assess your working capacity in relation to your health
       Article 9 (2)(h)

 14. The processing is necessary for archiving purposes
       Article 9 (2)(j)

Criminal convictions data

15. The processing is carried out in relation to legal claims
      Article 10 and Schedule 1, Part 3 (33) of the DPA 2018

Read the UK General Data Protection Regulation and DPA 2018 text for more information.