Annex F: Confidentiality and information security agreement

Overview

This document sets out arrangements for the REF panels to maintain the confidentiality and security of information they generate and have access to throughout the REF process (Confidential Information). All information shared throughout the REF process must be considered as confidential, unless explicitly stated otherwise. Confidential Information means all confidential or proprietary information (however recorded or preserved) related to the purpose that is disclosed or made available whether before or after the date of this agreement (in any form or medium), directly or indirectly by the REF team or Steering Group to the panel member.

All REF advisory, main, IL SPRE and sub-panel chairs, members, assessors, secretaries, advisors, observers, external advisors, consultants, and panel hosts for all REF assessment and advisory panels and their named delegates are bound by the terms set out below. For the purposes of this document these people will all be referred to as panel members.

This document deals only with the relationship between the REF team and the four UK higher education funding bodies on the one hand and panel members on the other. It does not give rise to any rights or obligations to or from HEIs participating in the REF.

If there is any doubt with regard to any issue of confidentiality, either in general terms or in relation to a particular piece of information, panel members should seek advice from the REF team, using admin@ref.ac.uk.

The Assessment systems refers to a suite of integrated tools and software solutions delivered to enable all panel members to undertake their roles. This includes:

• secure Panel Members’ Website (PMW)
• secure closed communication/document sharing solution (a closed Microsoft 365 tenancy known as the REF Hub)
• expenses – a third-party expenses solution integrated into the Hub
• library – a library solution will be integrated into the PMW to enable the distribution of outputs
• assessment functionality – full functionality to enable panel members to undertake assessment and record scoring online

Nothing in this agreement prevents panel members from disclosing information after it becomes freely available in the public domain (without the breach of any obligation of confidentiality), or that which they are required by law to disclose, or that which was already known and not subject to confidentiality obligations before being disclosed in the context of the REF. It would be prudent, however, to contact the REF Director in advance to discuss any such disclosure.

Some Confidential Information may have to be disclosed by the UK higher education funding bodies under the Freedom of Information Act 2000 or other legislation. If any requests for information are received, these must be passed to the REF team immediately for consideration and action and should not be responded to by panel members.

Purpose

The Confidential Information is being provided to panel members solely to enable panel members to carry out their agreed duties in relation to the REF, as set out in the REF appointment invitation and associated role information.

For the avoidance of doubt, all information acquired as a result of appointment to or involvement with the REF, is confidential to the REF team and REF panel members and must not be released or shared in any way, either during the period of appointment or afterwards, to third parties without the prior permission of the REF Director.

As set out in paragraph 3.6.2., the REF team will make available a secure communication system for panel members’ use during the exercise.

Sub-panels will meet to review HEI submission intentions and to consider recommendations for appointment and request further recruitment for sub-panel membership. This will involve the panel executive considering confidential personal information provided to support applications, and communication to discuss recommendations for appointment.

Rationale for confidentiality

Subject only to any other legal obligations on the UK higher education funding bodies to disclose further information, in order to properly manage the integrity of the REF as a fair and transparent process and our legal obligations in processing personal data, we need to ensure that public comment from REF panels and their constituent members on individual submissions is limited to:

• the Panel criteria and working methods publication and any REF guidance documents directly associated with formal guidance to HEIs developing submission material
• the overall assessment outcomes awarded to each submission (comprising the overall quality profile and the three sub-profiles for Contribution to Knowledge and Understanding, Engagement and Impact and Strategy, People and Research Environment) 
• the Panel overview reports detailing how the assessment was carried out, and providing observations about the assessment and the state of research within their discipline or advisory areas

Subject to any overriding legal obligation, we seek to avoid any situation in which parties not involved in the assessment process approach or place pressure on panel members to disclose information about the panel’s discussion of particular submissions. In other words, maintenance of confidentiality is essential if panel members are not to be inhibited from expressing their opinions freely in panel discussions, which is essential to the effective operation of the REF as an expert review exercise.

Given the nature of the information that panel members will have access to, the confidentiality arrangements also set out measures to prevent acts by a panel member which might, in certain circumstances, lead to a claim being made against them or the UK higher education funding bodies for breach of a common law duty of confidentiality; breach of data protection legislation; defamation; infringement of intellectual property rights in research outputs; or otherwise give rise to financial or reputational losses for which a legal claim is made or may be made.

Panel members’ obligations

General obligations

Acceptance of the purpose and rationale as set out in this document is a condition of appointment as a panel member. Panel members are required to provide written confirmation of agreement to these terms alongside acceptance of the appointment. If you agree to these terms, you are immediately bound by them, irrespective of whether you are appointed or not.

The chief executives of the four UK higher education funding bodies reserve the right to terminate appointments in the event of any breach of these terms.

Panel members must use Confidential Information only for the purposes of the REF. Confidential information must be handled in accordance with reasonable instructions given by the REF team. In particular, the REF team may require the deletion of any confidential information or all copies of confidential information, or to take such additional reasonable steps to preserve the security of the confidential information as the REF team may determine. Panel members must promptly comply with any such instructions. Panel members must respect the confidentiality of the information provided in any form (electronically or otherwise) and the discussions panel members will be privy to, by:

• only using such information for the purposes of the REF criteria development and REF assessment, as applicable
• taking all reasonable steps to ensure the security of the information, and handling it in accordance with reasonable instructions given by the REF team
• keeping the information for the purposes of the REF criteria development and REF assessment, as relevant, and securely disposing of information when requested by the REF team
• promptly reporting any incident of information loss to incident@ukri.org
• not disclosing any unpublished information about the REF assessors’ or panel members’ discussion of individual or other submissions
• observing protocols issued by the REF team for responding to media or other requests for further information. This includes consulting the REF team should panel members be invited to speak about the REF
• seeking advice from the REF team if panel members have any concerns during the process or are unsure about the appropriate course of action

Confidential information shall not be disclosed to any other person except panel members and the REF team. All reasonable steps shall be taken to ensure that other people cannot have access to the information, whether held in paper or electronic copy. In particular:

• it is important to remember that computer systems, and specifically email, are not necessarily secure. Panel members shall agree to exercise appropriate caution when using them and ensure that they do not send Confidential Information via email, other than through the secure REF email address.
• confidential information will be made available to panel members via secure, password-protected systems. Passwords must not be divulged to any other person, other than in cases where this is agreed to support panel members’ REF work and with the permission of the REF Director
• the obligations set out in this document will subsist indefinitely

During the assessment phase panel members will have access to a range of Confidential Information, including information provided by institutions about their submission intentions, information in their submissions and information generated by the panels when assessing those submissions.

All Confidential Information, including any sensitive personal information such as panel member appointments, will be provided to members through the secure systems and should not be transmitted in whole or in part through other means.

Where any written discussion is undertaken this must be done through secure communications in the assessment systems.

Information contained in REF submissions

Institutions will submit a range of information to the REF team for the purpose of assessment by the REF panels. In recognition of this purpose, panel members shall use any information contained in REF submissions, supplied by the REF team, only for the purposes of carrying out their functions as panel members.

Panel members shall not make copies of such information except as is necessary to carry out their functions as a panel member. Panel members shall destroy, or return to the REF team, originals and any copies made of such information, as soon as they are no longer needed for that function or on the request of the REF Director, whichever may be sooner. This provision applies equally to paper copies and those stored in electronic or other non-paper formats.

Information identified as confidential by institutions

Submissions may include information that the institution identifies as Confidential or Sensitive. Panel members must agree to the following, to enable institutions to include such information in their submissions:

• institutions may identify the names of panel members who the institution believes would have a conflict of interest in assessing a specific output or case study. The REF team will not make the output or case study available to those named panel members. Panel members who do have access must not share the output or case studies with other panel members. Panel members identified in this way must not request this information from other panel members or the REF team.
• institutions may identify parts of their submissions (including specific members of staff, outputs or case studies) that should be redacted or excluded from publication by the funding bodies, where publication of that information is likely to cause harm to an individual or organisation. Information about material that has been identified for redaction or exclusion from publication may be discussed only with fellow panel members and may not be divulged to any other party even after the submissions have been published.
• panel members will be provided with unredacted material. It may not be clear which part, or parts, of the material will be redacted. Therefore, panel members must not disclose any of the material at any time.
• a separate process for the submission of classified outputs and impact case studies will be available. These materials will be received by and managed through a separate process and will only be made available for assessment by panel members with appropriate national security vetting clearance.

Panel members will treat as confidential all information identified as such by institutions, including the research outputs or case studies themselves, details of sponsors or commissioning organisations, and other information to be excluded from publication. Even if a panel member personally considers that a designation as confidential may be wrong, they shall accept any designation of confidentiality which an institution has placed upon any part of its submission. If a panel member feels in a particular case that this inhibits them from carrying out their function as a panel member, they should raise the issue with the REF Director who will provide or seek advice.

An institution’s submission may contain material which is patented or patentable or which is subject to other intellectual property (IP) rights. Institutions make submissions to the REF on the understanding that their position in these respects will not be prejudiced by the fact of submission. Panel members shall respect and honour that understanding and agree not to infringe the IP rights of the property owners. Panel members are reminded that all IP rights infringements are actionable in the civil courts. Panel members’ attention is drawn to the danger of prior disclosure in the case of potentially patentable material, and the paramount need therefore to respect the confidentiality of such material.

Personal data and special categories of personal data

Information about equality-related circumstances that is submitted to the REF will be kept confidential to the REF team, the People and Diversity Advisory Panel, and main panel chairs. Sub-panel members and the REF Steering Group will know where there are reductions on the basis of staff circumstances but will not have access to further information about the circumstances.

Personal data and special categories of personal data may be shared with panel members. Panel members must take extra care to ensure that any information relating to these is kept confidential and is destroyed or returned to the REF team once no longer required for the assessment. Panel members must handle personal data and special categories of personal data in line with the current UK Data Protection legislation (Privacy notice – UKRI and Data protection policy – UKRI).

Information generated by the REF panels

The REF panels will generate a range of information when assessing submissions including personal notes, provisional scores, comments, and other communications. Panel members must store and transmit all such information securely and confidentially, according to the directions in sub-section 3.6.. Personal notes, provisional scores, comments and other communications should preferably be generated on the Assessment system. Where this is not possible, panel members are expected to delete these as soon as they are no longer needed.

Panel members will restrict their discussion of submissions and their assessment (in any media) to other panel members they are working with and the REF team. They shall not discuss with anyone who is not involved in the assessment process as described above, either the submission or the assessment of an identifiable institution or group of institutions whose individual members could be identified, still less the work of individual researchers named in submissions, even if ostensibly made anonymous. Panel members may comment on the process and conduct of the REF in general terms and should seek advice from the REF team (admin@ref.ac.uk) if unsure what is covered by ‘in general terms’.

Storage, transmission and retention of information

Panel members will be provided with the information contained in submissions that is necessary for the panel to carry out its assessment. Submitted information will be provided to panel members via the assessment systems, electronically and by exception only (and only where requested) will hard copies be made available.

Panel members will be provided with an online system for the purposes of assessment; this will enable the assessment and scoring of items allocated to them. Panel members must not keep copies of scores or comments outside of this online system.

Panel members will also have access to a secure closed system for communication with other panel members and the REF team about the assessment of submissions, in between meetings. All correspondence with other panel members or the REF team containing Confidential Information should be conducted via this facility.

Panel members are obliged to adhere to the following directions:

• confidential REF data can only be accessed through the secure assessment systems. Material and data cannot be downloaded to personal devices.
• only information that is not confidential, such as publicly available published outputs, may be stored on other devices.
• panel members must take appropriate precautions when using desktop computers, laptops and similar devices when undertaking REF business. This includes ensuring that there is an appropriate level of virus protection on the devices, having password security in place, and locking the device when not in use. Further guidance on the precautions which should be taken will be available in the assessment systems in advance of the assessment phase.
• paper copies of confidential data must be kept in a secure place and not disclosed to anyone not directly involved in the assessment. It is the responsibility of the panel member to take the necessary precautions to ensure the security of the information.
• paper copies of REF data must not be transmitted in any way, for example faxed, scanned, emailed, or photographed.
• the secure REF communication system provided to all panel members must be used if Confidential Information is to be exchanged electronically. This includes any distribution or discussion of REF submissions and their assessment. REF panel member communication system accounts will be closed and contents destroyed by the REF team at the end of the assessment phase.
• panel members must receive authorisation from the REF team before obtaining any hard copies, whether the hard copy is printed by the REF team or using other means. Panel members must destroy or return to the REF team, originals and any copies (physical and digital) made of REF data including but not limited to the submissions and information generated by panels, as soon as they are no longer needed for the assessment and no later than 31 March 2030. Paper based information must be destroyed using a cross-cutting shredder with a cutting width of 4mm or less (BS EN 15713:2009 shred number 6 is recommended).

Panel members must report any security incident in relation to information contained in the REF submissions or generated by the REF panels. A security incident is any unplanned or unforeseen event which has the potential to cause a security breach by disclosing the data deliberately or accidentally and must be reported immediately to incident@ukri.org. Possible security incidents include, but are not limited to, loss of paper copies of submissions or other confidential REF data, passwords, or laptops containing information relating to the REF.