- Publication date
- 13th September 2019
- Information types
- Policy areas
This privacy notice tells you what to expect when we collect and process your personal information under the Domestic Renewable Heat Incentive (DRHI) scheme in Great Britain. It applies to information we process concerning:
- Scheme applicants and participants, registered users of the DRHI Register (MyRHI), and installations of renewable heating systems.
- People who contact Ofgem with a query or information request (e.g. a right of access or freedom of information request) regarding the DRHI scheme.
- People who sign up to receive our newsletters.
This privacy notice only covers the processing of information relating to Ofgem’s administration of the DRHI scheme.
The controller for the processing of any personal information as outlined in this privacy notice is the Gas and Electricity Markets Authority, (GEMA). For ease of reference, this privacy notice refers to the administrative office of GEMA, "Ofgem" throughout.
What personal information do we collect?
We collect information about you, including:
- Any information you provide us in the application form for the DRHI scheme, including (but not limited to): your name, date of birth, address, e-mail address, telephone number and bank account details.
- Your unique RHI number and details of RHI payments made in respect of the installation.
- Details of your installation, including: information relating to meters installed, the technology type, commissioning date, installed capacity, the renewable heat generated, and the address of the installed renewable heating system.
- Import and export data relating to electricity supply and distribution, including metering information and the Meter Point Administration Number (MPAN) assigned to the meter(s) associated with the renewable heat installation.
- Documentary evidence in support of your application and ongoing obligations, including (but not limited to): Microgeneration Certificate Scheme (MCS) and Energy Performance (EPC) certificates, Green Deal reports and other relevant certificates, installation and testing records (including declarations, documents and information about and from the installer), funding agreements, planning permission, property rating and building control statements, schematic diagrams, and fuel, emission, or other records for the installation, if applicable.
- We also collect any other information required for the purpose of administering the DRHI scheme.
Why we need to collect and process your information
We only collect and process information that we need in order to carry out our functions in relation to the DRHI scheme, and for purposes arising from Ofgem’s regulatory functions. More detail about the legal basis for collecting and processing your information is detailed below.
In relation to the DRHI scheme, we collect and process your information (including disclosing it to our agents, representatives or successors, or to other public bodies or third parties) in order to:
- Effectively administer the DRHI scheme.
- Verify the eligibility of installations applying for accreditation or registration under the DRHI scheme.
- To make automatic decisions in relation to applications, i.e. decisions made solely by automated means without any human involvement. These decisions are undertaken only when an application is submitted online and if the application meets all the application criteria and does not trigger a manual review. If this is the case, then the application is automatically accredited to the DRHI scheme.
- Verify the volumes of renewable energy generated by any accredited installation. Assign the correct tariff rate applicable to the installation for which support is claimed.
- Ensure any RHI support payments are timely and accurate.
- Monitor compliance with the scheme regulations.
- Carry out site inspections and audits for the purposes of the DRHI scheme.
- Assist us in the identification of fraud, misuse and misreporting.
- Enable us to inform you about, or provide literature about, our services, renewable heat and / or the DRHI scheme.
- To carry out statistical analysis or research and development in relation to the DRHI scheme.
- To assist in enforcement and / or debt recovery where non-compliance, and / or overpayment has occurred.
We use data analytics software to:
- Validate claims made in respect of renewable heat generated.
- Improve the services we provide.
- Ensure compliance with the DRHI scheme requirements.
- To identify fraud.
- To make automatic decisions, i.e. decisions made solely by automated means without any human involvement.
Your information is not used for profiling, i.e. automated processing of personal data to evaluate certain things about an individual, e.g. direct marketing.
How we collect your information
Information collected directly from you
We will collect information directly from you when you:
- Engage with us when we carry out our statutory and administrative functions.
- Contact us with an enquiry relating to the DRHI scheme, or in relation to information requests, complaints and general enquiries.
- Register as a user or participant on the DRHI Register.
- Apply for accreditation or registration under the DRHI scheme.
- Email, fax, or telephone us, or send information related to the DRHI scheme in paper format
- Submit information and data to us (including via an online portal, e.g. the DRHI Register) such as periodic data or declarations as part of your ongoing obligations under this scheme.
- Use our services, e.g., subscribe to our RSS feeds, social media sites, email alerts or request a publication from us.
- We also collect information during any subsequent audit of an accredited or registered installation.
Newsletters and surveys: We will collect information directly from you when you sign up to our newsletter(s), or respond to our customer satisfaction (CSAT) surveys hosted by Qualtrics. We will collect and store your name, and email address in order to send these to you, as well as your responses to questions relating to our performance in administering the scheme(s). You can request your information to be removed from the newsletter distribution list at any time by emailing: RHI.Enquiry@ofgem.gov.uk.
Information collected indirectly
We receive information about you or others indirectly via:
- Credit-checking agencies [Experian] who verify the information you have provided
- Gemserv: we receive data to validate the sustainability information provided for your installation, if applicable.
- Land Registry: we receive Information received relating to ownership of property to which your heating system provides heat.
- The Department for Business, Energy and Industrial Strategy (BEIS), and other third parties in relation to your scheme application, accreditation or registration, including (but not limited to): public grants funding and audit information.
- Third-parties relating to any Green Deal Scheme accreditation and EPC certificates – we receive information that may be relevant to your application and installation address (if applicable), e.g. for EPCs we receive information from Northgate for England and Wales, and the Energy Savings Trust for Scotland.
- The MCS Service Company Limited and the MCS Charitable Foundation: we receive information relating to MCS certificates that are relevant to your application and / or accreditation.
- We contact local authorities to view planning applications and building usage; registered social landlords; and housing associations - in some cases this information provided will include further documentary evidence relating to the property and / or installation, including photographs.
- Third parties you may have nominated to provide us with information.
- Third parties we believe may be able to independently verify information provided to us on your application, or as part of your accreditation.
- A third party whom we have contracted to undertake auditing work on our behalf – in some cases the information provided will include further documentary evidence relating to the installation, including photographs.
- Third party public bodies or organisations involved in the prevention and detection of crime.
- An investor or third party organisation (if you have applied for the RHI schemes via an investor third-party, or Assignment of Rights arrangement) who collect data from you, they share this data with Ofgem for the purposes of gaining accreditation / registration under the RHI schemes.
- Baker Goodchild who are the third party supplier who handle the distribution and returns for the Domestic RHI welcome packs.
How and when will we process and disclose your information
We will only process (including sharing and receiving) your information with the following organisations or official bodies:
- Third-party auditors who audit the information provided to us by you. We process and share relevant information during audits and will require such third parties to agree to treat the information in accordance with this privacy notice).
- Action Fraud in England or Wales or the police (and other public bodies or organisations involved in the prevention and detection of crime) when we or they have found instances of suspected fraud.
- BEIS, who are responsible for the RHI policy and legislation in Great Britain, for the purposes of its functions in relation to the DRHI scheme, including for, but not limited to:
- surveys and statistical purposes (e.g. to publish official statistics and to fully monitor the rollout and progress of the scheme)
- quality assurance
- forecasting expenditure for degressions, and
- wider purposes connected with analysis, research, monitoring, evaluation, development and understanding of the RHI schemes and BEIS policies.
- BEIS may share your data with its contractors or sub-contractors for these purposes.
- Power companies, the Environment Agency, local authorities and electricity distributors as part of a Data Sharing Agreement.
- Qualtrics, to enable us to send you, and for you to respond to, one of our customer (CSAT) surveys through their platform.
- Experian, a third-party credit checking agency, to verify the information you provide to us. This information includes your name, date of birth, and bank account details.
- With industry, accreditation and certification bodies to help ensure that renewable heat installation work is carried out to the required standards and in accordance with the requirements of the scheme. We share data with MCS, the Renewable Energy Consumer Code (RECC), the Home Insulation & Energy Systems Contractors Scheme (HIES), in relation to DRHI applicants and participants (e.g. we may share data on complaints received about members of these third-parties). We also share data with RECC and HIES on sanctions, investigations, and complaints regarding their members and DRHI scheme applicants and participants.
We will additionally disclose your personal information where:
- You give us explicit permission to disclose it; or
- The disclosure is necessary for the purposes of the administration of the DRHI scheme or where we are legally obliged to by law, statutory direction or court order (e.g. we are required to share information with public inquiries, the National Audit Office or the Ombudsman).
We process and share your information with third-parties using secure file transfer portals or via Huddle.
Legal basis for processing your information
We collect and process your information as part of our remit as the administrator of the DRHI scheme, and for purposes arising from Ofgem’s functions conferred by law, including (but not limited to) the:
- Domestic Renewable Heat Incentive Regulations 2014 (as amended)
- Gas Act 1986
- Electricity Act 1989
- Utilities Act 2000
- Energy Acts of 2008 and 2011
We would not be able to fulfil our legal obligations as the administrator of the DRHI scheme without collecting and using your information.
If you subscribe to receive our newsletters, we also process your information on the basis of consent, where, if you have opted in, we store your name and email address in order to send you updates on the RHI schemes. You are free to unsubscribe from the newsletters at any time, either by emailing us at RHI.Enquiry@ofgem.gov.uk, or by clicking on the ‘unsubscribe’ button at the bottom of any newsletter you receive.
How long do we keep your information?
Your personal information is deleted when we no longer need it for our functions in administering the DRHI scheme. As such, it is retained by Ofgem for the duration of scheme participation (up to 7 years), and for a period of 5 years thereafter.
Sharing your information outside the European Union
Any information you provide will not be transferred outside the European Union.
Where we use cloud processing to support our data processing, the servers are located within the European Union.
If we hold information about you, you have the right to:
- Be informed about the data we hold about you.
- Access the information we hold about you.
- Have your personal information corrected if it is incomplete or inaccurate.
- Ask us to restrict how we process your information.
- Object to certain ways we use your information.
- In some circumstances, you may have a right to object to Ofgem processing your information.
Disclosure of personal information
You can also get information about:
- agreements we have with other organisations for sharing information
- circumstances where we can pass on your personal information without consent for example, to prevent and detect crime and to produce anonymised statistics
- our instructionsto staff on how to collect, use and delete personal information
- how we check that the information we hold is accurate and up to date
How to contact us or make a complaint to us
If you would like to:
- make an FOI or EIR request please refer to Freedom of Information section.
- make a complaint about Ofgem please refer to Complaints about Ofgem section.
- make a Subject Access Request please refer to Subject Access Request section- add hyperlink once created
The Data Protection Officer
10 South Colonnade
You can also contact us to request this notice in an oral format.
Complaints to the Information Commissioner
You have a right to complain to the Information Commissioner. If you want to raise a concern about how we have handled your information, you can report it directly to the Information Commissioner’s Office at the following address:
Information Commissioner's Office
Telephone: 0303 123 1113
Online: Live chat
Privacy notice changes
We regularly review our privacy notices. This notice was last updated on 13 September 2019. During this update we made changes to align the wording with the General Data Protection Regulation and Data Protection Act 2018.