Privacy policy
- Introduction
- Who are we?
- Why do we collect and process personal data?
- Whose personal data do we hold?
- What type of personal data do we process?
- Where do we receive personal data from?
- How do we handle your personal information?
- Who do we share your personal information with and why?
- How do we keep personal data safe?
- How long do we keep personal data for?
- What are my rights?
- How do you contact the Information Commissioner?
- Changes and updates to this privacy notice
Introduction
This privacy notice sets out how we, the Office of the Police and Crime Commissioner (OPCC) for Gloucestershire, obtain, hold, use and disclose information about you – your personal data – and the steps we take to ensure that it is protected. It describes the rights you have over your personal data that the OPCC obtains and handles and includes how to contact the Information Commissioner should you have any concerns regarding how your personal data has been handled.
Who are we?
The Chief Executive of the OPCC is the data controller for the OPCC and has overall responsibility for the lawful processing of all personal data within the OPCC. You can contact the Chief Executive at [email protected] or at the below address. Please address it for the attention of the Chief Executive.
The Data Protection Officer of Gloucestershire Constabulary assists the OPCC by providing advice and guidance on data protection legislation. The data protection officer can be contacted by writing to the Data Protection Officer, Gloucestershire Constabulary at the address below.
Why do we collect and process personal data?
The Police and Crime Commissioner has a statutory duty to ensure the provision of an effective and efficient police service on behalf of the public of Gloucestershire.
Other statutory duties which may require processing of personal data include:
- Audit
- Collaboration and working in partnership
- Commissioning
- Contracts and tenders
- Freedom of information and data protection rights
- Governance
- Health and safety
- Human resource management
- Human rights and equalities
- Oversight and reviews of complaints and police conduct
- Pensions
- Performance analysis
- Public consultation and engagement
- Reducing crime and disorder
- Reducing re-offending
- Restorative justice and criminal justice transformation
- Safeguarding
- Scrutiny of animal welfare (Animal Welfare Scheme volunteers)
- Scrutiny of police custody (Independent Custody Visitors scheme and volunteers)
- Scrutiny of police functions
- Victim care
In order for us to fulfil our statutory duties, it may be necessary for us to process your personal information.
The lawful bases under which we process personal data will depend on the purpose of the processing, and we will provide this information in our specific privacy notices, and / or by request. We will process personal data only when there is a legal basis by which to do so.
Where we would wish to process your personal data and there is not a legal basis by which to do so, we will contact you and ask you to provide consent prior to taking any further action.
The OPCC also processes personal data for the following “lawful purposes” of: assisting us in meeting our “Legal Obligations” as employers; manage “Contracts” with those who supply us with goods and services; help us support those who we come into contact with, which can be done by obtaining their “Consent”; due to our “Legitimate Interests” which includes processed to improve the service we provide the public, and, perform tasks which are considered as being in the “Public Interest”.
Whose personal data do we hold?
In order to carry out the above functions, the OPCC may obtain, use and disclose personal information relating to a wide variety of individuals, including: our staff; volunteers; agents; temporary and casual workers; suppliers; complainants; correspondents; litigants and enquirers; relatives, guardians and associates of an individual concerned; advisers; consultants and other professional experts; victims (current, past and potential); witnesses or reporting persons; individuals passing information to Gloucestershire Constabulary; offenders and suspected offenders; and, former and potential members of staff, pensioners and beneficiaries.
What type of personal data do we process?
This may vary depending on the reason the OPCC has contact with you but could include:
- Complaint, incident, and, civil litigation and accident details
- Criminal proceedings, outcomes and sentences
- DNA or photographs
- Education and training details
- Employment details
- Family
- Financial details
- Fingerprints
- Goods or services provided
- Information relating to health and safety
- Lifestyle and social circumstances
- Offences and alleged offences
- Physical or mental health conditions
- Political opinions
- Racial or ethnic origin
- References to manual records or files
- Religious or other beliefs of a similar nature
- Sexual life
- Sound and visual images
- Trade union membership
- Your name and address
We will use the minimum amount of personal information necessary to fulfil a particular purpose. Your personal information may be held on a computer system, in a paper record such as a physical file or image, but may also be held in other formats such as CCTV footage, audio files or a photograph.
Where do we receive personal data from?
In order to carry out the purposes described above, the OPCC may obtain personal information from a wide variety of sources, including:
- Approved organisations and people working with the police
- Auditors
- Business associates and other professional advisors
- Central government
- Current and past employees
- Data processors working on behalf of the OPCC
- Defence solicitors
- Education and training establishments
- Emergency services; credit reference agencies
- Employees and agents of the OPCC
- Examining bodies
- Financial organisations and advisors
- Gloucestershire Constabulary
- Governmental agencies and departments
- Healthcare
- His Majesty’s Courts and Tribunals Service
- His Majesty’s Inspectorate of Constabulary, Fire and Rescue Services
- His Majesty’s Revenue and Customs
- Independent Office for Police Conduct
- Individuals
- International law enforcement agencies and bodies
- Legal representatives
- Licensing authorities
- Local government
- Media outlets
- Ombudsmen and regulatory authorities
- Other law enforcement agencies
- Partners agencies involved in crime and disorder strategies
- Persons making an enquiry or complaint
- Police forces
- Prisons
- Private sector organisations working with the police on anti-crime strategies
- Prosecuting authorities
- Providers of goods or services
- Relatives, guardians and other persons associated with the individual
- Security companies
- Social and welfare advisers or practitioners
- Suppliers
- Survey and research organisations
- Trade, employer associations and professional bodies
- Voluntary and charitable organisations
- Voluntary sector organisations
The OPCC may also obtain personal information from other sources such as its own CCTV systems, other police forces, correspondence and our own police systems.
How do we handle your personal information?
Your personal information is handled according to the requirements of Part 2 of the UK Data Protection Act 2018, which applies the EU’s General Data Protection Regulation (GDPR) standards for the processing of data considered as ‘general’. Your personal information held on our systems and our files, is secure and accessed by staff, contractors and data processors working on our behalf, outsourced providers in accordance with their contract and volunteers when required to do so for a lawful purpose.
We will ensure that your personal information is handled fairly and lawfully. We will strive to ensure that any personal information used by us or on our behalf is of the highest quality in terms of accuracy, relevance and adequacy, is not excessive and is kept as up to date as possible and that it is protected appropriately. We will regularly review to ensure it is still required and is lawful for us to continue to retain it and when no longer required for any purpose detained in this notice, securely destroy it. We will respect your information rights under the Act.
Who do we share your personal information with and why?
To carry out the purposes described above, the OPCC may disclose personal information to a wide variety of recipients including those from whom personal data is obtained (as listed above). This includes, but is not exclusive to, other law enforcement agencies, partner agencies, commissioned services (such as Victim Support) and other bodies or individuals working on our behalf.
Disclosures of personal information are made on a case-by-case basis and only relevant information, specific to the purpose and circumstances will be disclosed and with the necessary controls in place.
We may also disclose to other bodies or individuals where necessary to prevent harm to individuals. The OPCC may also disclosure personal information to other bodies or individuals when required to do so, such as under an act of legislation, by rule of law or by a court order. This may include:
- Child Maintenance Services
- Children and Family Courts Services
- His Majesty’s Courts and Tribunals Service
- The Home Office
- Any other regulatory body who can demonstrate that there is a legitimate purpose for the processing of your personal data.
How do we keep personal data safe?
The OPCC takes the security of all personal information under our control very seriously. We will comply with the relevant parts of the legislation relating to security, and seek to comply with the College of Policing Authorised Professional Practice.
We will ensure that appropriate policy, training, technical and procedural measures are in place. These will include, but are not limited to: ensuring our buildings are secure and protected by adequate physical means; the areas restricted to our police officers, staff and partner agencies staff is only accessible by those holding the appropriate identification; and, that those personnel have legitimate reasons for entry. We carry out audits of our buildings security to ensure they are secure. Our systems meet appropriate industry and government security standards.
We carry out regular audits and inspections, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so. Our standard operating procedures and policies contain strict guidelines as to what use may be made of any personal information contained within them. These procedures are reviewed regularly to ensure our security of information is kept up-to-date.
How long do we keep personal data for?
The OPCC will retain personal data for as long as necessary for the purpose that it was collected for. Records that contain personal data are held in accordance with the [Retention Schedule].
What are my rights?
A key area of change in the new Data Protection Act relates to individuals’ rights. The law was refreshed by clarifying and extending existing rights and introducing new ones. However, your information rights will be dependent on the reason why and how the data was collected and why it is being used.
Your information rights in relation to personal data, considered as “general data”, are:
Right to be informed. This places an obligation upon the OPCC to tell you how we obtain your personal information and describe how we will use, retain, store and who we may share it with. We have written this Privacy Notice to explain how we will use your personal information and tell you what your rights are under the legislation
Right of access. This is commonly known as subject access and is the right which allows you access to your personal data and supplementary information, however it is subject to certain restrictions. You can access your right of access by clicking on the following link: [link to subject access request form]
Right to request rectification. You are entitled to have personal data rectified if it is inaccurate or incomplete.
Right to erasure. The right to erasure is also known as ‘the right to be forgotten’. This right enables you to request the deletion or removal of personal data where there is no compelling reason for its continued processing.
Right to restrict processing. Individuals have a right to ‘block’ or suppress processing of personal data. When processing is restricted, organisations are permitted to store the personal data, but not further process it.
Right to data portability. The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services.
Right to object. Individuals have the right to object to:
- The processing of your personal data based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
- The processing of their personal data for direct marketing (including profiling); and,
- The processing of their personal data for the purposes of scientific/historical research and statistics.
Rights relating to automated decision making. Automated individual decision making and profiling is a decision made by automated means without any human involvement. The OPCC do not conduct any automated individual decision making or profiling.
How do you contact the Information Commissioner?
The information Commissioner is the independent authority responsible within the UK for ensuring compliance with data protection legislation. If you have a concern about how the OPCC have used your personal information or you believe you have been adversely affected by our handling of your data you may wish to contact them using the information below:
By phone: 0303 123 1113 (Monday-Friday, 9am -5pm)
By email: [email protected]
By post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.
Changes and updates to this privacy notice
This privacy notice will under regular review. It was last updated in January 2024.
If we plan to use personal information for a new purpose we will update our privacy notice accordingly, and communicate any changes before we start the new processing activity.
Version history
| Version number | Changes since last version | Status | Date | Updated by |
|---|---|---|---|---|
| 01. | Original published version | Draft | January 2020 | N/A |
| 02. | Updated format in line with organisational protocol and changes in national agency names | Draft | 14 January 2024 | R. Greenwood |