Privacy Notice

Introduction

We have updated our Privacy Notice to make it easier for you to understand what information we collect about you, why we collect it, how we process it, share it, retain it and dispose of it. We have also explained our practices in more detail and in a clearer language. We take your privacy seriously and are making these updates to comply with our new obligations under the General Data Protection Regulation (GDPR) which takes effect across the European Union from the 25th May 2018. The GDPR is a regulation in EU law on data protection and privacy for all individuals with the European Union. It also addresses the export of personal data outside the EU. The GDPR aims primarily to give control to citizens and residents over their personal data and ensures greater transparency and accountability in the way organisations handle personal data. The UK Data Protection Act 2018 enshrines the GDPR and the Law Enforcement Directive into UK Law.

This document explains how Leicestershire Police handles your personal information (personal data [1]), the steps we take to ensure that it is protected, and also describes the rights you have in regard to any personal data we already hold about you and any further personal information we might collect about you, either from you or from a third party.

The use and disclosure of personal data is governed in the United Kingdom by the Data Protection Act 2018 (‘the Act’) together with the GDPR. The Chief Constable of Leicestershire Police is the ‘data controller’ for the purposes of the Act. You can contact the Chief Constable by post at Chief Constable, Leicestershire Police HQ, St Johns, Enderby Leicester, LE19 2BX. A ‘data controller’ is obliged to ensure that Leicestershire Police handles all personal data in accordance with the Act.

Leicestershire Police is registered with the Information Commissioner’s Office (ICO) who is the supervisory authority in the UK who enforces and monitors compliance with the data protection legislation. Our ICO Registration Number is Z4887579.

We have appointed a Data Protection Officer (DPO) who provides help and guidance to make sure we apply the best standards to protecting your personal information. Our DPO can be reached by email at [email protected] or by post at Data Protection Officer, Information Management Unit, Police Headquarters, St Johns, Enderby Leicester, LE19 2BX if you have any questions about how we use your personal information.

This Privacy Notice provides up to date information about how we use your personal information and updates any previous information we have given you about using your personal data. We will review and update this Privacy Notice from time to time to reflect our processes and make any changes available on our website. See section 11 for more information about your Privacy rights.

[1] Definition of personal data. Any information relating to an identified or identifiable living individual. An identifying characteristic could include a name, ID number or location data. Such information is treated as personal data even if it can only be potentially linked to a living individual.

1. Why do we handle personal data?

Leicestershire Police obtains, holds, uses, discloses etc. personal data for both Law Enforcement and General Data Protection Processing purposes.

1.1. The Law Enforcement Purpose (policing purpose) includes:

1.2 The provision of services to support the Law Enforcement Purposes includes:

2. Whose personal data do we handle?

In order to carry out the purposes described under why we handle personal data Leicestershire Police may obtain, use, disclose, handle etc. personal data relating to a wide variety of individuals including the following:

Leicestershire Police will only use appropriate personal data necessary to fulfil a particular purpose or purposes. Personal data could be information which is held on a computer, in a paper record e.g. a file, as images, but it can also include other types of electronically held information e.g. CCTV images.

3. What types of personal data do we handle?

In order to carry out the purposes described in why do we handle personal data above, Leicestershire Police may obtain, use, disclose, handle etc. personal data relating to or consisting of the following:

Leicestershire Police will only use appropriate personal data necessary to fulfil a particular purpose or purposes. Personal data could be information which is held on a computer, in a paper record e.g. a file, as images, but it can also include other types of electronically held information e.g. CCTV images.

4. Where do we obtain personal data from?

In order to carry out the purposes described under why we handle personal data above, Leicestershire Police may obtain personal data from a wide variety of sources, including the following:

Leicestershire Police may also obtain personal data from other sources, such as its own CCTV systems, or correspondence.

5. How do we handle personal data?

In order to achieve the purposes described under why do we handle personal data, Leicestershire Police will handle personal data in accordance with the principles [2] of the Act and the GDPR. In particular, we will ensure that personal data is handled fairly and lawfully with appropriate justification. We will strive to ensure that any personal data used by us or on our behalf is of the highest quality in terms of accuracy, relevance, adequacy and proportionality, is kept as up to date as required, is protected appropriately, and is reviewed, retained and securely destroyed when no longer required. We will also respect individuals’ rights under the Act.

[2] Data protection principles:

Principles relating to processing of personal data (Article 5 GDPR): 1. Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject 2. Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes 3. Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed 4. Personal data shall be accurate and, where necessary, kept up to date 5. Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed 6. Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

6. How do we ensure the security of personal data?

Leicestershire Police takes the security of all personal data under our control very seriously. We will comply with the relevant parts of the Act relating to security, and seek to comply with the Association of Chief Police Officers’ Community Security Policy. We will ensure that appropriate policy, training, technical and procedural measures are in place, including audit and integrity monitoring, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so, and then under strict guidelines as to what use may be made of any personal data contained within them. These procedures are continuously managed and enhanced to ensure up-to-date security.

7. Who do we disclose personal data to?

In order to carry out the purposes described under why do we handle personal data above Leicestershire Police may disclose personal data to a wide variety of recipients in any part of the world, including those from whom personal data is obtained (as listed where we obtain personal data above). This may include:-

Disclosures of personal data will be made on a case-by-case basis, using the personal data appropriate to a specific purpose and circumstances, and with necessary controls in place. Some of the individuals and bodies to which we may disclose personal data are situated outside of the European Union - some of which do not have laws that protect data protection rights as extensively as in the United Kingdom. If we do transfer personal data to such territories, we will take proper steps to ensure that it is adequately protected as required by the Act.

Leicestershire Police will also disclose personal data to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and by court order. This may include disclosures to the Child Support Agency, the National Fraud Initiative, the Home Office, to the Courts, the General Medical Council and the Nursing and Midwifery Council. Leicestershire Police may also disclose personal data on a discretionary basis for the purpose of, and in connection with, any legal proceedings or for obtaining legal advice.

8. Our legal basis for using your personal information

8.1 We only use your personal information where we have an appropriate lawful basis for doing so. For example, we use your personal data where:

Where we rely on consent as our lawful basis for processing, you have the right to withdraw your consent at any time. To withdraw your consent, please use the instructions on the form used to gain your consent or by contacting the relevant department to whom the consent was given. However, we won’t always need consent to process your personal information – for example - if we need it to meet regulatory requirements, perform a contract with you or if the processing in necessary for Law Enforcement purposes.

Where the provision of personal data is part of a statutory or contractual requirement or obligation, we may be unable to progress with that process should the personal data not be made available to us.

8.2 Special protection is given to certain kinds of personal information that is particularly sensitive. This is information about your health status, racial or ethnic origin, political views, religious or similar beliefs, sex life or sexual orientation, genetic or biometric identifiers, trade union membership or criminal convictions or allegations. Processing sensitive data (including ‘special category data’ and ‘criminal offences’ data) may include cases where:

9. How long does Leicestershire Police retain personal data?

9.1 Leicestershire Police keeps personal data only as long as is necessary for the particular purpose or purposes for which it is being processed. Personal data which is placed on national police systems namely, the Police National Computer, National DNA Database or National Fingerprint Database are managed in accordance with 'NPCC Deletion of Records from National Police Systems (PNC/NDNAD/IDENT1)'.

9.2 Other records containing personal data relating to crime recording, domestic violence, child abuse investigation, public protection, missing persons, case and custody, incident records, firearms licensing and intelligence will be retained in accordance with the Authorised Professional Practice on the Management of Police Information(this can also be found on the College of Policing’s website www.app.college.police.uk). Leicestershire Police also adhere to the Review, Retention & Disposal Policy (PD54) and Retention of Police Records (not subject of Review, Retention and Disposal) (PD156) Policy.

10. Monitoring

Leicestershire Police may monitor or record and retain telephone calls, text, emails and other electronic communications to and from the force in order to deter, prevent and detect inappropriate or criminal activity, to ensure security, and to assist the purpose described under section 2 above. Leicestershire Police does not place a pre-recorded ‘fair processing notice’ on telephone lines that may receive emergency calls (including misdirected ones) because of the associated risk of harm that may be caused through the delay in response to the call.

11. Your Privacy Rights

You have the right to see what personal information we hold about you and also have the right to object to how we use your personal information. In addition, you can ask us to correct inaccuracies, delete or restrict the processing of your personal information in certain circumstances or to ask for some of your personal information to be provided to someone else (data portability). To make enquires for further information about exercising any of your rights in this Privacy Notice, please contact our Data Protection Team by post addressing your letter to the Data Protection Team, Information Management Unit, Police Headquarters, ,St Johns, Enderby Leicester, LE19 2BX or by emailing

[email protected] .

11.1 The right to be informed:

This area is covered by this privacy notice.

11.2 The right of access – also known as a Subject Access Request (SAR):

You can request access to a copy of your personal information that we hold, along with information on what personal information we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making. You can usually make a request for access free of charge by contacting the Data Subject Access team at Data Protection Team, Information Management Unit, Police Headquarters, St Johns, Enderby Leicester, LE19 2BX or by emailing

[email protected] .

We may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Please make all requests for access in writing, where possible, and provide us with evidence of your identity. Please see our website for further information on how to request personal information (also known as a ‘subject access’ request): www.leics.police.uk

11.3 The right to rectification:

Under Article 16 of the GDPR, individuals have the right to have inaccurate or incomplete personal data rectified. Leicestershire Police can refuse this request where it is necessary and proportionate or relates to ‘relevant personal data’, i.e. to avoid obstructing an official or legal inquiry, investigation or procedure.

11.4 The right to erasure:

Under Article 17 of the GDPR, individuals have the right to have personal data erased and to prevent processing in specific circumstances, for example if there is no compelling reason for its continued processing. Leicestershire Police can refuse this request where it is necessary and proportionate or relates to ‘relevant personal data’, i.e. to avoid obstructing an official or legal inquiry, investigation or procedure or to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties. The erasure of personal data relating to criminal offences cannot be considered until its full period of retention has been reached.

11.5 The right to restrict processing:

Under Article 18 of the GDPR, individuals have the right to restrict the processing of personal data, for example, if an individual believes that the data is incorrect, is processed unlawfully or is no longer required by the Data Controller. Leicestershire Police can refuse this request where it is necessary and proportionate or relates to ‘relevant personal data’, i.e. to avoid obstructing an official or legal inquiry, investigation or procedure or to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties.

11.6 Rights in relation to automated decision making including profiling:

Article 22 of the GDPR has rules to protect individuals if solely automated decision [3] making (making a decision without any human involvement) has taken place and in relation to profiling. Leicestershire Police do not currently employ automated decision making and therefore currently do not make any decisions solely using automated means. However we will notify you if this position changes. [3] Automated decision-making

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision-making in the following circumstances:

  1. Where we have notified you of the decision and given you 21 days to request a reconsideration.
  2. Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights.
  3. In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.

If we make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

11.7 Right to withdraw consent:

If you have given us your consent to use your personal information, you can withdraw your consent at any time by using the above contact methods or as specified on the relevant consent form(s). However, we won’t always need consent to process your personal information – for example - if we need the data to meet regulatory requirements, perform a contract with you or if it is held for Law Enforcement purposes.

11.8 Right to object:

You can object to our processing of your personal information. Please contact us as noted above, providing details of your objection.

Please note that certain rights under the GDPR which relate to General processing do not exist in Part 3 of the DPA which relate to Law Enforcement Processing (LEP). Therefore the above right only applies to general processing and not to law enforcement processing.

11.9 Portability:

You can ask us to provide you or a third party with some of the personal information that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred.

Please note that this right only applies to general processing and does not apply to law enforcement processing.

11.10 Make a complaint:

You can make a complaint about how we have used your personal information to us, by emailing the Data Protection Officer at [email protected] or by writing to Data Protection Officer, Information Management Unit, Police Headquarters, St Johns, Enderby, Leicester, LE19 2BX

If you are not satisfied with our response, you can further contact the Information Commissioner's Office at https://ico.org.uk/

12. Contact Us

Any individual with concerns over the way Leicestershire Police handles their personal data may contact the Data Protection Team as below:

Data Protection Team Information Management Unit Police Headquarters St Johns Enderby Leicester LE19 2BX

Tel: 0116 248 5222 Email: [email protected]

Share this page: