Personal data and surveys, consultations and market research

This page explains how and why we use personal data to undertake surveys, consultations and market research (collectively referred to in this privacy notice as ‘research’) as part of our work as a regulator.

The personal data we use

When conducting our research work we try to keep our collection of personal data to a minimum. We use anonymised data as far as possible and only ask for personal data where we believe it is necessary for the purpose of the research exercise in question.

The type of personal data that we typically use as part of our research is normally limited to contact details (of the person completing an FCA questionnaire or survey or responding to a consultation) and personal views and opinions of consumers and those who submit questionnaires, surveys and consultation responses to us.

We also occasionally, where required for the purposes of a specific project, use financial information, dates of birth and location data as part of our research, although this is usually pseudonymised by us when used in research.

How we collect this personal data

We collect personal data in a variety of ways in order to conduct our research. In order to get a holistic and accurate view of the markets, understand consumer behaviour and properly identify issues, trends and risks, we collect personal data from third parties as well as from individuals directly.

Below are some examples of how and from where we collect personal data for this purpose:

  • questionnaires and surveys issued to targeted individuals by us and by our third party research providers
  • social media analytics tools which gather information from more than 20,000 data sources (such as Twitter, Facebook, blogs, forums and mainstream media) to analyse real-time consumer opinions
  • data collection and public consultation papers for market studies (examples of our recent market studies include the Asset Management Market Study, Investment and Corporate Banking Market Study, Cash Saving Market Study, Credit Cards Market Study, Retirement Income Market Study and Mortgages Market Study – all of which are published on our website)
  • data extracted from our in-house systems which hold information collected by us from regulated firms (such as Gabriel) and individuals during our authorisation process
  • due diligence checks on regulated individuals and firms and other organisations across various relevant third-party databases;
  • ad hoc requests for data from regulated firms and individuals and from credit reference agencies

Why we use this personal data

We use this personal data to ensure that we are able to fulfil our statutory functions and, in particular, to help us:

  • understand how well the markets are functioning
  • identify areas of concern, inform our strategic thinking as a regulator and help us decide if we need to make new rules, change existing rules or publish guidance
  • manage and prioritise decision making within the FCA in a way which reacts appropriately to emerging risks and trends
  • build strong relationships with consumer groups, the industry, media and stakeholders to reflect our accountability to Parliament, enrich our insight, enhance are credibility and maximise our usefulness to the public

The lawful basis for us using this personal data

We use this personal data under Article 6(1)(e) of the GDPR (it is necessary for the performance of a task carried out in the public interest) and Section 8(c) of the DPA 2018. Our research work is essential to enable us to understand the firms and markets that we regulate and to carry out effectively our statutory functions as a regulator of financial conduct and the related firms and markets. To the extent that we use any special categories of data in our research work, we do so under Article 9(2)(g) of the GDPR (it is necessary for reasons of substantial public interest) and Section 10(3) of the DPA 2018, in that it meets a condition in Part 2 of Schedule 1 of the DPA 2018 and we have an appropriate policy document covering this processing activity.

Different rules apply to the processing of personal data for certain research and statistical work under the GDPR and the DPA 2018. This means that as long as we ensure that appropriate safeguards are in place, including adopting technical and organisational measures (such as, where possible, pseudonymisation techniques), we are entitled to use for research or statistical purposes information that we have already collected from you for a different purpose (such as, during the authorisations process). We would not use personal data in this way if it was likely to cause substantial damage or distress to individuals. We also do not use this research or statistical data to make decisions about or take measures against particular individuals. All our research work is done by us in the public interest.

The rules about research and statistical work in the GDPR and the DPA 2018 also mean that certain rights that you may have in respect of your personal data under the GDPR (such as the right to restrict or object to processing activity) may not apply to the personal data that we use about you as part of our research work. If you would like more information about this, please contact us.

When we share personal data used to undertake our surveys, consultations and market research

Given our role as a regulator, where necessary and appropriate we do share personal data with other regulators, public authorities and law enforcement agencies both inside and outside the UK. We also publish our market surveys, consultation papers and other research papers, where appropriate, on our website. That said, in the majority of cases and where possible, we remove any personal data from the research data and associated reports that we share or make public in this way.

We also regularly use third-party research agencies and data analytics tools to help us with our research work.

When this personal data is transferred outside the EU

It is rare for us to transfer personal data collected as part of a research exercise outside the EU. However, as mentioned above, given our role as a regulator we occasionally share personal data with regulators, public authorities and law enforcement agencies outside the EU.

We regularly use third party research agencies, data analytics tools and other third party suppliers to help us with our research work. Some of these third parties transfer data outside the EU in their provision of services to us.

Before we transfer personal data outside the EU, we have robust processes to ensure that appropriate safeguards are put in place to protect any personal data included in such as transfer. If you would like to obtain more details about the safeguards that we have in place with regard to any personal data about you that we may transfer to a particular non-EU country, please contact us.

Learn about your rights

Under the GDPR, individuals have a number of rights relating to their personal data. Read more about your rights and how to exercise them.