North West Regional CollegePolicy and Procedures

Social Media Policy

Approved by Date____________________________ _______________Principal and Chief Executive

Issue Document Title Date Last Reviewed

Next Review Date

Responsibility of

2 Social Media Policy

November 2018

November 2020 Kate Duffy

1

North West Regional CollegeSocial Media Policy1 Introduction

1.1 Objectives

This policy sets out the College’s policy on social media.

The aims of this policy are to:

to encourage good practice

assist staff to work safely, legally and responsibly with social networking technology and to monitor their own standards and practice;

set clear expectations of behaviour relevant to social networking for educational, personal or recreational use and details the aspects of safer online behaviour;

support safer working practices;

clarify the consequences of unlawful or inappropriate behaviour.

Whilst every attempt has been made to cover a wide range of situations, it is recognised that this policy cannot cover all eventualities. There may be times when professional judgements are made in situations not covered by this document, or which directly contravene the standards outlined in this document. It is expected that in these circumstances staff will always advise their line manager of the justification for any such action already taken or proposed. Line Managers will in turn seek advice from the Leadership and Management team where appropriate.

This policy takes account of best practice guidelines and employment legislation and the College will continue to keep abreast of developments in this area.

The North West Regional College is committed to promoting equality of opportunity and good relations in accordance with Section 75 of the Northern Ireland Act 1998. This policy should be interpreted in a manner consistent with the aforementioned legislation.

The College will provide this policy in alternative formats on request where reasonably practicable, eg, Braille, Large Print, Computer Disk, Audio format, etc, and/or alternative language.

1.2 Scope

All employees are bound by this policy to ensure that their behaviour accords with the principles set out in this policy. It will be applied to all use and all forms of social media where there is a potential impact on the College, whether for work-related or personal use, whether during working hours or otherwise and whether social media

2

is accessed using the College’s IT facilities or equipment belonging to staff or a third party.

1.3 Status

This document does not replace or take priority over for example the Code of Conduct or other policies around safeguarding or IT issues for example the Safeguarding Policy or ICT Acceptable Use Policy, but is intended to both supplement and complement any such documents. 1.4 Principles

Staff should work and be seen to work, in an open and transparent way and should continually monitor and review their practice in terms of the continually evolving world of social networking and ensure they follow the guidance contained in this document.

Staff who work with children, young people and/or adults at risk of harm or in need of protection are responsible for their own actions and behaviour and should avoid any conduct which would lead any reasonable person to question their motivation and intentions.

2 Definition of Social Media

For the purpose of this policy, social media is ‘the broad term given to describe the latest evolution of internet and web based communication platforms which enable users to rapidly connect and interact in a variety of different formats. A social media site is a platform that allows user-generated content to emerge through interactions and collaborations in a virtual community.’ [ACAS Employment Relations Comment, September 2011].

Social networking websites such as Facebook, Twitter, Instagram, Linkedin and Snapchat are perhaps the most well-known examples of social media but the term also covers other web based services such as blogs, video and audio podcasts, wikis, forums, message boards, photo document and video sharing websites such as YouTube, micro blogging services such as Twitter and any other website that allows individual users to publish or share content with other users. This definition of social media is not exhaustive as technology develops with new ways of communicating advancing every day. This policy will apply regardless of the hardware used e.g. Smart phone, Tablet, PC or laptop etc.

3 Safer online behaviour

3.1 Protecting your personal information and privacy

Managing personal information effectively makes it far less likely that information will be misused.

In their own interests, staff need to be aware of the importance of protecting their own privacy whilst using social networking technologies and therefore should always

3

check their Privacy settings. Staff also need to be aware of the dangers of putting personal information onto social networking sites, such as addresses, home and mobile phone numbers. This will avoid the potential for unwanted contact from e.g. work colleagues, students, their families or friends outside of the work environment. It also reduces the potential for identity theft by third parties.

All staff, particularly those new to the College, should review their membership of social networking sites to ensure that information available publicly about them is accurate and appropriate. This includes any photographs that may cause embarrassment to themselves and the College if they are published outside of the site or are accessible to others. For information, Appendix 1 attached lists a range of organisations that can access internet history without a warrant.

3.2 Personal Information and Confidentiality

As per the Data Protection Policy, Personal Information is any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

By its very nature, social media enables and encourages users to share data, including personal data e.g. a photograph of an identifiable living person. The College must process all personal information that it collects and uses in compliance with the Data Protection Act 2018. All uploads, storage, communications must be lawful and fair. Staff intending to use a social media site must therefore ensure that all parties know what type of information they are expected to share, for what purpose and who will have access to it. Even where consent is in place to process personal data, staff must also ensure that adequate security is in place to protect it. Information may range from name, registration number to sensitive personal data relating to personal experiences or assessed work.

Authorised staff posting content or setting up accounts are responsible for ensuring appropriate informed consents are in place. Staff must keep their colleagues and learners’ personal information safe and secure at all times. No personal information, including photographs, will be shared via social media sites without consent of the individual. Additional information can be found within the Data Protection Policy and related documents.

Confidentiality needs to be considered at all times. Social networking sites have the potential to discuss inappropriate information and employees need to ensure that they do not put any confidential or personal information on their site about their employer, their work colleagues or their students.

Data subjects have the right to obtain information that is being held about them and written about them. Staff should be mindful that information written about a student on a social media site, open or closed group, can be requested at any time through a Subject Access Request and can be provided to a student. Any attempts to destroy

4

such information after a SAR has been submitted is unlawful. Any information or comments posted on social media sites are subject to data protection and Freedom of Information legislation. Further information is available within the Data Protection Policy.

It is critical that once any member of staff have knowledge of a breach of personal or confidential data, you must report this immediately to the NWRC Data Protection Officer immediately to databreach@nwrc.ac.uk. Article 33 of GDPR obligates the College to report breaches to the Information Commissioners Office (ICO) within 72 hours of it being discovered. Please follow the guidance within the Data Breach Management Procedure.

3.3 Acceptable practice

Staff need to ensure that when they are communicating about others, even outside of work, that they give due regard to the potential for defamation of character. Making allegations on social networking sites (even in their own time and in their own homes) about other employees, students, stakeholders or other individuals connected with the College could result in formal action being taken against them.

Staff should never post derogatory remarks or offensive comments on-line or engage in on-line activities which may bring the College into disrepute or could reflect negatively on their professionalism or breach the College’s Code of Conduct for staff.

Some social networking sites and other web-based sites have fields in the user profile for job title etc. Staff should take care not to put any information onto their personal networking page that could identify the College as in some circumstances this could damage the reputation of the College.

Lecturing staff should never make a ‘friend’ or accept an invitation to become a ‘friend’ of one of their students, on their own personal social networking page.Behaviour that is in breach of this policy or behaviour that is deemed to be unlawful is unacceptable and where appropriate, disciplinary action will be taken against a staff member. Any breaches of this policy should be reported relevant line managers and to the Digital Marketing Officer.

Staff are required to follow the same standards of conduct and behaviour online as would be expected offline.

Staff are permitted to establish a social networking page to support students during their course.

3.4 Marketing and PR Requirements

The Marketing and PR team recognise the benefits and opportunities that social media can bring to the College. When used correctly, it can be a tool to reach out, engage and educate prospective learners, current learners and the region as a whole to the activities and provision of the College.

5

The College has a number of official social media accounts and these include Facebook, Twitter, Snapchat, Instagram, YouTube, LinkedIn and flickr. In order to streamline and co-ordinate effective communication through social media, it is essential that the Marketing and PR Team is notified of all current individual, curriculum or support area social media accounts attached to the College. It is also essential that the Marketing and PR Team is contacted in advance of any new accounts that are set up so that professional guidance from the team can be provided.

The Marketing and PR team have a responsibility for the main official College social media accounts. There may be occasions when the Marketing & PR Manager or Digital Marketing Officer may advise that all social media activity on accounts affiliated to the College will cease for a designated period of time.

There are many live social media accounts affiliated with the college. Before creating a new social media account it is essential that staff consider whether there is a different audience or objectives which cannot be met through an existing account before setting up a new account.

Should a department want to set up a new social media account it is therefore vital that the new account request and admin details are sent to the Marketing Manager and Digital Marketing Officer for request by emailing socialmedia@nwrc.ac.uk.

If a new account is set up it should start with ‘NWRC’ for consistency with other college accounts.

3.4.1 Requirements

The Marketing & PR Manager and Digital Marketing Officer are to be provided with contact telephone numbers for any staff member who is assigned as an administrator on a social media account affiliated to the College.

The Digital Marketing Officer is to be made aware of any social media account or page that is attributed to or connected with the College. The team will then furnish details of an email address that must be added to that page as an administrator.

The Digital Marketing Officer is to be provided with the account details and password of any page or account that is attributed to the College.

Each social media account / page should be set up and established with a view to it being active and relevant, and for it to continue to be such into the future.

The Marketing & PR Team reserve the right to remove or request the removal of any College social media pages or accounts which it deems to be inactive, irrelevant, or have breached acceptable use policies.

All administrators have a responsibility for the accounts affiliated to the College that they run.

3.4.2 Acceptable Usage for all College Social Media Accounts

6

Only offer advice, support or comment on topics that are within their area of expertise of that particular social media account. Posts or tweets coming from a social media account attached to the College should only contain information pertaining to the College. False or misleading information is prohibited from posting. All statements must be true and all claims substantiated.

There should be no posting on issues that could be deemed controversial or sensitive; e.g. politics, tragedies etc. Posting should be refined to the specific curriculum area/ support area associated with the account. There should be no posting of material that could be considered defamatory or that breaches copyright.Any queries relating to the relevance or appropriateness of information due to be posted should be directed to the Digital Marketing Officer or Marketing & PR Manager.

All staff must conform to College GDPR procedures when publishing content e.g. photographs of students, staff and guests. For guidance on GDPR practice, please consult the College’s Compliance Officer.

All staff must not download & publish images from other websites and/or sources (i.e. www.google.com; https://pixabay.com/ https://unsplash.com/ https://pikwizard.com/) unless having sought the permission to do so – the College would breach copyright regulations in this case.

Before responding to complaints or contentious posts or messages received on social media platform, staff should contact the Digital Marketing Officer or Marketing & PR Manager. All press queries received via social media must be forwarded for the attention of the Marketing and PR Manager

Personal social media accounts must not purport to act on behalf of the College, ie, a personal twitter account should not reflect any reference or affiliation to the College. If such an account exists, the handle or hashtag must be changed immediately.

3.4.3 Best Practice Guide for Personal Accounts

Staff are encouraged to apply the same standards of conduct online as they are expected to apply offline.

Staff are encouraged to be familiar with privacy settings of social networking platforms and should ensure that these are appropriate for both content and intended audience. Social networking platforms are in the public domain and it is not always possible to be sure what is being viewed, shared or archived, even if material is posted on a closed profile or group. There can be no reasonable expectation that posts will remain private and will not be passed on to other people, intentionally or otherwise. Material published online may have the potential to be available publicly, indefinitely.

Staff are responsible for their words and actions in an online environment and are therefore advised to consider whether any comment, photograph or video they are about to post on a social networking site is something they would want students,

7

colleagues and other employees of the College, their manager or people outside the College to see. When disagreeing with others’ opinions, remain appropriate and polite. If you find yourself in a situation online that looks as if it may be becoming antagonistic, do not get overly defensive and do not disengage from the conversation abruptly; instead you are encouraged to disengage from the dialogue in a polite manner that reflects well on the College.

Where employees disclose their association with the College through Social Media for personal purposes, any views they publish should be presented as purely personal views and not being representative of the views of the College. It is the College’s recommendation that staff do not associate their personal Social Media accounts with the College.

The College must be notified on the creation of a group or discussion page on Social Media between a member of staff and pupils. An internal record will be kept of the group, the participants and the date of creation.

Never comment on anything related to legal matters, litigation or any parties the College may be in dispute with.

Staff should be aware that any unacceptable use of social media and failure to comply with this policy may result in bringing the College’s name into disrepute. Breach of this policy may be dealt with under the College’s disciplinary procedure.

3.4.4 Social Media in an emergency

All communications on social media from the College in an emergency situation will be issued via the main College social media accounts (#mynwrc). In order to minimise the risk of conflicting and/or incorrect information, staff must not post information or updates from any other College account during a live incident.

3.5.1 Expected Behaviors

The College requires that all staff using social media adhere to the standard of behaviour as set out in this policy and other relevant policies.

Staff will not use social media to infringe on the rights and privacy of colleagues or make ill-considered comments or judgments about staff. Digital communications by staff must be professional and respectful at all times and in accordance with this policy.

Unacceptable conduct, (e.g. defamatory, discriminatory, offensive, harassing content or a breach of data protection, confidentiality, copyright) will be considered extremely seriously by the College and will be reported as soon as possible to a relevant Head of Department and escalated where appropriate. The College will take appropriate action when necessary.

Where conduct is found to be unacceptable, the College will deal with the matter internally. Where conduct is considered illegal, the College will report the matter to the police and other relevant external agencies, and may take action according to the Disciplinary Policy.

8

The use of social media by staff while at work may be monitored, in line with the Acceptable Use Policy.

The following general guidelines apply to staff posting content via social media:

The Do’s

Check with a line manager before publishing content that may have controversial implications for the institution

Use a disclaimer when expressing personal views

Make it clear who is posting content

Use an appropriate and professional tone

Be respectful to all parties

Ensure you have permission to ‘share’ other peoples’ materials and acknowledge the author

Express opinions but do so in a balanced and measured manner

Manage your social media presence on behalf of the College

Think before responding to comments and, when in doubt, get a second opinion

Set up a shadow system i.e. a colleague who can edit/access posts

Seek advice and report any mistakes to your line manager

The don’ts

Don’t make comments, post content or link to materials that will bring the College into disrepute

Don’t use the College logo or branding on personal accounts

Don’t publish confidential or commercially sensitive material

Don’t breach copyright, data protection or other relevant legislation

Consider the appropriateness of content given the age and capacity of the learners, and don’t link to, embed or add potentially inappropriate content

Don’t post derogatory, defamatory,[17] offensive, harassing or discriminatory content

Don’t use social media to air internal grievances

3.6 Promoting Equality of Opportunity

Staff must at all times comply with Section 75 Equality legislation in their on-line communications.

9

3.7 Communication between staff and students

Communication between staff and students by whatever method, should take place within clear and explicit professional boundaries. This includes the wider use of technology such as mobile phones, text messaging, e-mails, digital cameras, videos, web-cams, websites and blogs.

3.8 Cyberbullying

Cyberbullying can be defined as ‘any use of information and communications technology to support deliberate and hostile attempts to hurt, upset or embarrass another person’. (Llewellyn 2009)

“The use of electronic communication to bully a person, typically by sending messages of an intimidating or threatening nature.” (Oxford Dictionary)

Prevention activities are key to ensuring that staff are protected from the potential threat of cyberbullying. All staff are reminded of the need to protect themselves from the potential threat of cyberbullying. Following the advice contained in this policy should reduce the risk of personal information falling into the wrong hands.

If cyberbullying does take place, employees should keep records of the abuse, text, e-mails, website or instant message and should not delete texts or e-mails. Staff are advised to take screen prints of messages or web pages and be careful to record the time, date and place of the site.

Staff are encouraged to report all incidents of cyberbullying to their line manager or HR Services. All such incidents will be taken seriously and dealt with in accordance with the College’s Harassment Policy.

4 Legal obligations and good practice

This policy takes account of employment legislation and best practice guidelines in relation to social networking in addition to the legal obligations of employers and the relevant legislation listed below.

Staff should be aware of the legislative framework which currently surrounds the use of social media / communication technology in the UK. It is important to note that in general terms an action that is illegal if committed offline is also illegal if committed online.

4.1 Computer Misuse Act 1990 This Act makes it an offence to: • erase or amend data or programs without authority; • obtain unauthorised access to a computer; • “eavesdrop” on a computer; • make unauthorised use of computer time or facilities; • maliciously corrupt or erase data or programs; • deny access to authorised users.• unauthorised access to a computer with intent to commit or facilitate the

commission of a further offence

10

4.2 Data Protection Act 2018The Data Protection Act 2018 controls how your personal information is used by organisations, businesses or the government. The Data Protection Act 2018 is the UK’s implementation of the General Data Protection Regulations (GDPR).

Everyone responsible for using personal data has to follow strict rules called ‘data protection principles’. Staff should ensure that information is;

used fairly, lawfully and transparently used for specified, explicit purposes used in a way that is adequate, relevant and limited to only what is necessary accurate and, where necessary, kept up to date kept for no longer than is necessary handled in a way that ensures appropriate security, including protection

against unlawful or unauthorised processing, access, loss, destruction or damage

There is stronger legal protection for more sensitive information, such as:

race ethnic background political opinions religious beliefs trade union membership genetics biometrics (where used for identification) health sex life or orientation

There are separate safeguards for personal data relating to criminal convictions and offences.

Individual rightsUnder the Data Protection Act 2018, individuals have the right to find out what information the government and other organisations store about them. These include the right to:

be informed about how your data is being used access personal data have incorrect data updated have data erased stop or restrict the processing of your data data portability (allowing you to get and reuse your data for different services) object to how your data is processed in certain circumstances rights relating to automated decision-making and profiling.

4.3 Freedom of information Act 2000 The Freedom of Information Act gives individuals the right to request information held by public authorities. All public authorities and companies

11

wholly owned by public authorities have obligations under the Freedom of Information Act. When responding to requests, they have to follow a number of set procedures. If you engage on a social media platform (and indeed on other platforms such as text messages or private email accounts), even if you make the message private, may be subject to access legislation such as FOI 2000 or DPA 2018.

4.4 Communications Act 2003 Sending by means of the Internet a message or other matter that is grossly offensive or of an indecent, obscene or menacing character; or sending a false message by means of or persistently making use of the Internet for the purpose of causing annoyance, inconvenience or needless anxiety is guilty of an offence liable, on conviction, to imprisonment. This wording is important because an offence is complete as soon as the message has been sent: there is no need to prove any intent or purpose.

4.5 Malicious Communications Act 1988 It is an offence to send an indecent, offensive, or threatening letter, electronic communication or other article to another person.

4.6 Regulation of investigatory Powers Act 2000 It is an offence for any person to intentionally and without lawful authority intercept any communication. Monitoring or keeping a record of any form of electronic communications is permitted, in order to: • establish the facts; • ascertain compliance with regulatory or self-regulatory practices or procedures; • demonstrate standards, which are or ought to be achieved by persons using the system; • investigate or detect unauthorised use of the communications system; • prevent or detect crime or in the interests of national security; • ensure the effective operation of the system.

Monitoring but not recording is also permissible in order to: • ascertain whether the communication is business or personal; • protect or support help line staff.

The College reserves the right to monitor its systems and communications in line with its rights under this act.

4.7 Investigatory Power Act 2016 This action came into force on 30 December 2016 and aims to expand the powers of the UK Intelligence Community. It introduced new powers, and restated existing ones, for UK intelligence agencies and law enforcement to carry out targeted interception of communications, bulk collection of communications data, and bulk interception of communications. It allowed police, intelligence officers and other government department managers (See Section 3.1) to see the Internet connection records, as part of a targeted and filtered investigation, without a warrant

4.8 Trade Marks Act 1994

12

This provides protection for Registered Trade Marks, which can be any symbol (words, shapes or images) that are associated with a particular set of goods or services. Registered Trade Marks must not be used without permission. This can also arise from using a Mark that is confusingly similar to an existing Mark.

4.9 Copyright, Designs and Patents Act 1988 It is an offence to copy all, or a substantial part of a copyright work. There are, however, certain limited user permissions, such as fair dealing, which means under certain circumstances permission is not needed to copy small amounts for non-commercial research or private study. The Act also provides for Moral Rights, whereby authors can sue if their name is not included in a work they wrote, or if the work has been amended in such a way as to impugn their reputation. Copyright covers materials in print and electronic form, and includes words, images, and sounds, moving images, TV broadcasts and other media (e.g. YouTube).

4.10 Telecommunications Act 1984 It is an offence to send a message or other matter that is grossly offensive or of an indecent, obscene or menacing character. It is also an offence to send a message that is intended to cause annoyance, inconvenience or needless anxiety to another that the sender knows to be false.

4.11 Criminal Justice & Public Order Act 1994 This defines a criminal offence of intentional harassment, which covers all forms of harassment, including sexual. A person is guilty of an offence if, with intent to cause a person harassment, alarm or distress, they:

use threatening, abusive or insulting words or behaviour, or disorderly behaviour; or

display any writing, sign or other visible representation, which is threatening, abusive or insulting, thereby causing that or another person harassment, alarm or distress.

4.12 Racial and Religious Hatred Act 2006 This Act makes it a criminal offence to threaten people because of their faith, or to stir up religious hatred by displaying, publishing or distributing written material which is threatening. Other laws already protect people from threats based on their race, nationality or ethnic background.

4.13 Protection from Harassment ActA person must not pursue a course of conduct, which amounts to harassment of another, and which he knows or ought to know amounts to harassment of the other. A person whose course of conduct causes another to fear, on at least two occasions, that violence will be used against him is guilty of an offence if he knows or ought to know that his course of conduct will cause the other so to fear on each of those occasions.

4.14 Protection of Children Act 1978

13

It is an offence to take, permit to be taken, make, possess, show, distribute or advertise indecent images of children in the United Kingdom. A child for these purposes is anyone under the age of 18. Viewing an indecent image of a child on your computer means that you have made a digital image. An image of a child also covers pseudo-photographs (digitally collated or otherwise). A person convicted of such an offence may face up to 10 years in prison.

4.15 Sexual Offences Act 2003 The new grooming offence is committed if you are over 18 and have communicated with a child under 16 at least twice (including by phone or using the Internet) and you arrange to meet them or travel to meet them (anywhere in the world) with the intention of committing a sexual offence. Causing a child under 16 to watch a sexual act is illegal, including looking at images such as videos, photos or webcams, for your own gratification. It is also an offence for a person in a position of trust to engage in any sexual activity with any person under 18, with whom they are in a position of trust. (Typically, teachers, social workers, health professionals, connexions staff fall in this category of trust). Any sexual intercourse with a child under the age of 13 commits the offence of rape.

4.16 Public Order Act 1986 This Act makes it a criminal offence to stir up racial hatred by displaying, publishing or distributing written material which is threatening. Like the Racial and Religious Hatred Act 2006 it also makes the possession of inflammatory material with a view of releasing it a criminal offence. Children, Families and Education Directorate page 38 April 2007.

Obscene publications act 1959 and 1964 Publishing an “obscene” article is a criminal offence. Publishing includes electronic transmission.

4.17 Human Rights Act 1998 This does not deal with any particular issue specifically or any discrete subject area within the law. It is a type of “higher law”, affecting all other laws. In the school context, human rights to be aware of include:

• the right to a fair trial; • the right to respect for private and family life, home and correspondence; • freedom of thought, conscience and religion; • freedom of expression; • freedom of assembly; • prohibition of discrimination; • the right to education.

These rights are not absolute. The College is obliged to respect these rights and freedoms, balancing them against those rights, duties and obligations, which arise from other relevant legislation. In relation to the contract for service, the College will ensure all successful contractors will adhere to the principles and best practice within this policy.

14

5 Breach of Procedure

Staff who are found to be in breach of this policy will be subject to disciplinary proceedings.

6 Monitoring

Information Services maintain logs of all firewall, internet and email use within the College by staff and students. The College utilises monitoring to:

Establish the facts in case of investigation; Ascertain compliance with regulatory or Information Services SLA; Ensure that systems are running effectively within normal parameters; Investigate or detect unauthorised use of the internet or Email systems; Prevent or detect crime or in the interests of national security; Protect or support help line staff.

All logs are generally maintained for one year as per the College data retention policy. The College reserves the right to monitor its systems and communications in line with its rights under the Regulation of Investigatory Powers Act 2000.

7 Links with other policies

This document should be read in conjunction with relevant College policies on:

ICT and Acceptable Use Safeguarding Disciplinary Equal Opportunities Code of Conduct Grievance Data Protection Policy Data Breach Management Procedure

8 Review of policy

Due to the ever changing nature of information and communication technologies it is best practice that this policy be reviewed every 2 years and, if necessary, more frequently in response to any significant new developments in the use of technologies, new threats to e-safety or incidents that have taken place.

15

16

APPENDIX 1

The following organisations can now access internet history whether at home or in college without a warrant:

o Metropolitan police forceo City of London police forceo Police forces maintained under section 2 of the Police Act 1996o Police Service of Scotlando Police Service of Northern Irelando British Transport Policeo Ministry of Defence Policeo Royal Navy Policeo Royal Military Policeo Royal Air Force Policeo Security Serviceo Secret Intelligence Serviceo GCHQo Ministry of Defenceo Department of Healtho Home Officeo Ministry of Justiceo National Crime Agencyo HM Revenue & Customso Department for Transporto Department for Work and Pensionso NHS trusts and foundation trusts in England that provide ambulance

serviceso Common Services Agency for the Scottish Health Serviceo Competition and Markets Authorityo Criminal Cases Review Commissiono Department for Communities in Northern Irelando Department for the Economy in Northern Irelando Department of Justice in Northern Irelando Financial Conduct Authorityo Fire and rescue authorities under the Fire and Rescue Services Act

2004o Food Standards Agencyo Food Standards Scotlando Gambling Commissiono Gangmasters and Labour Abuse Authorityo Health and Safety Executiveo Independent Police Complaints Commissionero Information Commissionero NHS Business Services Authorityo Northern Ireland Ambulance Service Health and Social Care Trusto Northern Ireland Fire and Rescue Service Board

17

o Northern Ireland Health and Social Care Regional Business Services Organisation

o Office of Communicationso Office of the Police Ombudsman for Northern Irelando Police Investigations and Review Commissionero Scottish Ambulance Service Boardo Scottish Criminal Cases Review Commissiono Serious Fraud Officeo Welsh Ambulance Services National Health Service Trust

18