• Privacy Notice - Coordinating and Recording of Live Education Events and Meetings

    • The Royal College of Physicians of Edinburgh (RCPE) is committed to continuing to build on the highly valued education services including live education events and meetings that we organise. These events allow participation from our building in Edinburgh, from well over one hundred partner venue locations throughout the UK and overseas, and increasingly also via live streaming to the workplace or home.

      During the COVID-19 pandemic, RCPE quickly switched in-person live education events and meetings to fully online delivery and now offers fully hybrid (online and in-person) attendance wherever possible. RCPE records live education events and meetings to allow later on-demand access where possible.

      RCPE is the Data Controller for any personal data processed in connection with the recording of live events and meetings. RCPE uses General Data Protection Regulation (GDPR) compliant internal infrastructure along with external third party provided services to enable secure and compliant data processing and storage. This includes audio and video recordings captured during live-streaming of events as well as the storage of content relating to interactive features such as chat, polling and Q&A.

      Our lawful basis for obtaining and using your data

      Under data protection law, GDPR Article 6(1), the College has a number of lawful bases that allow the collection and processing of personal information. For those agreeing to present at live events or attend meetings where recording the College will in the main rely on Article 6(1)(f) Legitimate Interests to process this data. This applies when the data processing is not required by law but is of a clear benefit to the organisation or the individual, there is limited privacy impact on you as the individual and we think you would reasonably expect us to use the personal data in the way that we wish to.

      The following definitions provide the College’s wider legal bases for processing data in relation to live events and meetings organised by the College:

      6(1) (b) – Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract When you agree to be a speaker at a College event or take part in a scheduled meeting you are entering into an event or meeting coordination contract with us. In order to perform this contract we need to process and store your data. For example, we may need to contact you by email or telephone to verify your information or to pass on or request information relating to the event.
      6(1) (f) – Necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject The Royal College of Physicians of Edinburgh has a genuine and legitimate reason to take forward the College’s objectives of ensuring that patients receive the highest standards of care by providing Fellows and Members with lifelong education and training opportunities for their continuing professional development. In the process of delivering these important education services we will collect and process additional personal information from those taking part for purposes that are required for these legitimate interests. We will only do this if there is no overriding prejudice to you by using your personal information in this way.
      6(1) (a) – Consent of the data subject Any other personal data we collect based on consent will only be used for the stated purpose and not be shared with third parties except where we have specified this may happen.

      The data we collect

      The College may capture the following personal data for live events and during recorded meetings:-

      • Name and contact details which may include email and telephone number
      • Your audio and video where provided in advance of an event or captured during an event or meeting
      • Transcription of presentations, contributions to discussions including responses to questions asked
      • Typed text provided during chat, polling and Q&A sessions

      What we do with your data

      We store recordings and presentations provided by speakers for use during events and within an internal archive after the event. Limited speaker details and photos may also be made available within our Events Calendar and Education Portal.

      Recordings that will be used on our Education Portal are uploaded to a US-based third-party video on-demand service from where they can only be accessed through College websites (and may be shared securely with third-party services that provide captioning).

      Meeting recordings are retained within an EU- or US-based archive depending on the third-party web conferencing service used.

      Q&A, transcriptions, and other text-based data captured during meetings and events are stored securely within the College network and by relevant third-party services.

      All third parties are required to show that they comply with EU GDPR Legislation.

      How will the data be used and shared?

      The purpose of recording sessions is to:

      • Make available live event material to those eligible to get access who are unable to attend live;
      • To provide long-term access to these same learning resources for the purposes of Continuing Professional Development (CPD).

      When we share your data

      Your event related data will not be shared with any external third party other than:

      • Where the College has your express consent to do so
      • Where the College has a legal obligation
      • We may share your data with our own service providers who process data on our behalf and on our instructions, such as with providers of transcription services. In these cases we make every effort to ensure that these third parties comply strictly with our instructions and with relevant data protection laws – see above.

      How long we keep your data

      Data will be kept in line with the College data retention policy. In general the College will only retain personal data for as long as necessary to fulfil the purpose it is collected for and for the purpose of satisfying any legal, accounting or reporting requirements.

      Wherever possible, your personal data will be processed within the UK. In some circumstances, it might be necessary to transfer your personal data outside of the UK – for example where we use third party supplier to process data on our behalf. In the event of an international transfer of data, appropriate safeguards will be implemented and processing will be based on documented instructions of the Royal College of Physicians of Edinburgh.

      How you can access your data

      To make an informal request for any personal information we may hold you should get in touch with the College using the contact details provided at the end of this section.

      Additionally you can find out which personal information we hold by making a ‘subject access request’ under the GDPR. Where we hold information about you we will provide:

      • A description of what we hold
      • An overview of why we are holding it
      • Details of who it could be disclosed to
      • A copy of the information in a suitable format within 30 days.

      If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

      Other Rights

      If we do hold personal data about you, you can:

      • Request that incorrect data is amended
      • Ask for data to be erased where there is no longer an ongoing need for processing
      • Specify that access to your data to be restricted
      • Request that any objection you have to the processing of your personal data is considered.
      • Ask not to be contacted as part of any fundraising activities

      If you wish to exercise any of these rights please contact us using the details below.

      Contact us and getting assistance

      You may get further assistance with our use of your data by contacting our Data Protection Officer. You can also request details of personal information which we hold about you under your rights within GDPR by requesting this from our Data Protection Officer.

      To do this, contact us either:

      • In writing to: Data Protection Officer, Royal College of Physicians of Edinburgh, 9 Queen Street, Edinburgh EH2 1JQ.
      • By email: dpo@rcpe.ac.uk

      For information on your individual rights in relation to the General Data Protection Regulation (GDPR) please see: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/ (link is external).