Privacy policy

High Speed 2 (HS2) Ltd – your privacy

There are rules about what personal information we can record, hold, use and share.

You have rights over your personal information.

The rules that apply to your personal information in the United Kingdom is the Data Protection Act 2018. (DPA 2018)

In line with these rules, we are registered with the Information Commissioner as a ‘data controller’. Our registration number is Z1711200.

This page is our main privacy notice. We are providing this to support your ‘right to be informed’ and so that HS2 Ltd is compliant with the transparency requirements of the UK GDPR. You can find more about your rights in Chapter 3 of the UK GDPR.

HS2 Ltd has adopted a layered approach to privacy notices, so you will see short privacy statements highlighting the main details on our forms, websites, email footers, CCTV signs, etc., and more ‘activity specific’ notices published where required, as well as this notice. We are serious about looking after your personal information and protecting your privacy, because we understand how important it is. We want you to have trust and confidence in our organisation.

We do not, and will not, sell your personal information for financial gain.

1. Legal background for using personal data

All of our collection and use of personal data is governed by legislation, dependent on the particular activity we are carrying out. For the large majority of our processing, the following pieces of legislation are relevant:

• High Speed Rail (London to West Midlands) Act 2017
• Health and Safety at Work Act 1974
• Equality Act 2010

Other legislation may be relevant or, such as the High Speed Rail (West Midlands to Crewe) Act will also become relevant once they are passed through Parliament. Where this is the case, this notice will be updated.

2. Why do we process personal information?

A. Our activities

We are building a new high speed railway to better connect people and places across Britain.

The main reasons we need to process personal data, including special category personal data (also known as ‘sensitive data’), are to:

• build links with people, communities and organisations based on fairness and openness with all; and
• lead an inclusive and safe operation with a diverse workforce.

B. Providing services to support our activities

We may process your personal information as we carry out and support our activities. This includes:

• in the case of our employees, paying and managing our staff, including running performance management and pension schemes;
• processing compensation claims for properties affected by HS2;
• managing property and estates, including procuring, leasing and selling property;
• managing complaints and defending legal complaints;
• managing and testing information technology systems; and
• any of our duties or responsibilities under common law, statute or good governance.

Any processing of your personal information is in line with our business needs and the law.

3. Whose personal information do we process?

To carry out our activities (see section 1), we may process personal information from people, including:

• our staff and contractors, including volunteers, agents, temporary and casual workers;
• our suppliers;
• advisers, consultants and other professional experts;
• people who give us information or ask for information from us;
• people who complain or write to us, make claims, or are involved in any legal action involving our organisation;
• former and potential members of staff, pensioners and beneficiaries;
• Members of Parliament and Members of the House of Lords; and
• external stakeholders and partners.

4. What types of personal information do we process?

A. For people working on the HS2 programme

To carry out our activities (see section 1), we may process the personal information of our employees and potential employees. We may also process the personal information of the employees of our potential and actual contractors, subcontractors, suppliers, consultants, sub-consultants or other organisations proposing to supply HS2 with goods, services or works.

The type of personal information we process for people working on the HS2 programme includes:

• name, address, contact details and biographical details;
• financial information;
• goods or services provided;
• all protected characteristics under the Equality Act 2010 (including disability and age);
• trade union and other similar memberships;
• criminal proceedings, outcomes and sentences;
• sound and visual images (still and moving); and
• licences or permits held.

B. For all other people

For all other people, we may process your personal information so we can:

• communicate with you if you are affected by HS2;
• answer your questions and address your concerns;
• ensure we have the correct information regarding those with an interest in land or property affected by HS2;
• support those with extra needs affected by the HS2 project;
• safeguard the health and safety of people affected by, or working for, the project; and
• promote the HS2 project with the use of audio, photos or video in which you may be included.

For example, under the Exceptional Hardship Scheme / Need to Sell Scheme (or equivalent), you may give us a range of information to support your application. This could include name, address, contact details and biographical details, financial information and personal characteristics such as health information and age.

For people who hand in petitions or attend our public consultation sessions, we collect and anonymise information about equality, diversity and inclusion to make sure:

• the facilities at consultation sessions are suitable;
•  we are able to respond to you about HS2 in a way that answers your concerns; and
• HS2 does not unfairly affect some groups of people more, or in a different way, than other groups where possible.

The equality, diversity and inclusion information we record is used to help us understand trends and future requirements for our events. It is not linked to any personal records.

5. Is there a requirement to provide HS2 with personal data?

In many circumstances, particularly in regards to employees, contractors and other people who work for, or with, us, there is a requirement to provide certain information to HS2 so that we can comply with our obligations under the law (as described above).

In some cases, this legislation also requires us to gather information from you to support certain aspects of the HS2 project.

Wherever we are collecting personal information we will be clear about whether we are collecting information due to a legal requirement or under your consent. Where providing information to HS2 Ltd is by consent, we will be transparent about obtaining that consent and provide a means for you to withdraw that consent at any time.

6. Where do we get your personal information?

You may share personal information directly with us when you work with us or contact us about the HS2 programme, as set out in section 3. We may use this to carry out and support our activities (see section 1).

We may also collect your information from government departments or public registers, such as the Land Registry, where it is needed to support our decisions and activities.

We may also record your personal information, where we are allowed to, from things like events (e.g. consultations), our own CCTV systems, training records, letters and emails, or information that’s been given to us by people about a specific matter or purpose (as explained in section 1).

7. How do we make sure your personal information is secure?

Protecting your privacy and looking after your personal information is important to us. We make sure that we have the right policies, training, processes, and systems in place to protect our manual and electronic information systems from loss and misuse.

We take every reasonable step to make sure that we keep your personal information safe, in line with best practice, ICO guidance, the UK General Data Protection Regulations and any other relevant laws.

8. Who do we share your personal information with?

To carry out our activities (see section 1), we may share your personal information with other organisations that we need to work with, such as our partner agencies, utility companies and government.

We may also share personal information with other organisations or people in connection with legal proceedings or getting legal advice, or when required to do so by any law or court order.

We do not, and will not, sell personal information for financial gain.

9. Where do we process your data?

The large majority of personal data that HS2 is processed within the European Economic Area.

There may be occasions where some of your personal information may be processed by organisations or people based outside the European Economic Area. Where this is the case, we will be clear with you about why we need to do this and what steps we have taken to make sure we have the right safeguards in place to certify that your information is protected in line with the UK General Data Protection Regulations.

10. Will your personal data be subject to any form of automated decision making?

For employees or sub-contractors there may be rare occasions where HS2 uses systems that result in automated decision making. We will be clear in our privacy notices when this occurs and we will respect all the rights that individuals have in regard to that kind of processing.

For people not working on the programme, HS2 does not and will not process your personal data in a manner that results in automated decision making.

11. What are your rights if we process your personal information?

The UK General Data Protection Regulations sets out the rights you have. We have outlined them below. If you wish to contact us regarding any of these rights please contact our Data Protection Officer via our HS2 Helpdesk

A. Right of transparency

Whenever HS2 uses your personal data you have a right to be informed of certain information about how and why that information is being used. This notice forms part of that information process.

B. Right of access

You have the right to obtain a copy of the personal data we hold about you.

As soon as we have received all the information we need to deal with your request, you have the right to be sent a copy of that information within one month. This may be extended with an additional two months if the request is particularly large or complex.

You can apply for a copy of your information by contacting our Data Protection Officer via the help desk.

A valid request must:

• explain what personal information you want (and, where possible, explain the circumstances in which we may be processing this information, so that we can find it more easily); and
• include photocopies of two official identification documents, providing enough information about your name, date of birth, current address and signature to make sure that it’s you.

For example: a combination of driving licence, with a utility bill (dated within the last six months) or bank statement (dated within the last six months).

We are allowed to ask for original documents and to refuse a request where we cannot be sure of the identity of the person asking. All original documents will be returned by post.

We will then carry out a search based on the description you’ve provided and provide you with the personal information you are entitled to receive under the regulations.

Some types of personal information do not have to be shared under these rules. For example, we do not have to share personal information where it is part of legally privileged communications.

If you are making an application for another person, we need an original signed letter of authorisation from the person who the information is about. It should state the full reason for the request, and the person or organisation making the request for that person. We also need a copy of your identification documents as above, as part of our standard procedures.

C. Right of erasure (‘right to be forgotten’)

Where we have collected information on the basis of your consent or explicit consent, if you change your mind about us using your personal information, you are unhappy about how we use your personal information or, the information is no longer needed for the purpose it was collected, you  have a right to have the relevant information deleted.

Please note that we can’t always stop all the ways we process your personal information when you ask us to, as there may be other fair and lawful reasons for needing to continue to process this, however we will tell you where this is the case. It can also take us a reasonable amount of time to make these changes after you’ve made a request and we’ve agreed to it.

D. Right to correct information

You can ask us to correct the information we hold about you, where you believe it is wrong.

To help us maintain accurate records, please make sure that the information you choose to share with us is accurate. If your details change, please update us as soon as you can.

E. Right to object, the right to restrict processing and the right to withdraw consent

In certain circumstances you have a right to request that HS2 stops processing your personal data, or to stop processing it in certain ways.

In addition, where we have obtained information under the basis of your consent, you have the right to withdraw that consent at any time.

12. How long do we keep your personal information?

We keep personal information only for as long as we are required to by law, or, where there is no specific legislation, for as long as we need to for the particular reason we have it. We do not hold information indefinitely unless we are legally obliged to do so.

Activity specific privacy notices.

HS2 Ltd has adopted a layered approach to privacy notices, so  more ‘activity specific’ notices published on this page where required, These can be found in the activity specific privacy notice library.