The Data Protection Act 2018 applies the EU’s GDPR standards for the processing of data considered as general data, this is data which is processed for a reason not involving law enforcement or national security. How organisations should process general data can be found in Part 2 of the DPA 2018.
The processing of data for law enforcement purposes is covered in Part 3 of the DPA 2018 and can only be done by an organisation which is considered as a competent authority. Law enforcement purposes are defined as the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. The description of a competent authority is laid down in the Data Protection Act 2018, it includes but is not limited to, organisations such as Police Forces, the Financial Conduct Authority and the Information Commissioner.
A copy of the OPFCC’s Privacy Notice can be downloaded here
This document explains how The Office of the Northamptonshire Police, Fire and Crime Commissioner (OPFCC) obtains, holds, uses and discloses information about people (their personal data), the steps we take to ensure that it is protected, and also describes the rights individuals have in regard to their personal data handled by the OPFCC.
The use and disclosure of personal data is governed in the United Kingdom by the Data Protection Act 1998 (‘the Act’). The Police, Fire and Crime Commissioner of Northamptonshire is registered with the Information Commissioner as a ‘data controller’ for the purposes of the Act. As such he is obliged to ensure that the OPFCC handles all personal data in accordance with the Act.
The OPFCC takes that responsibility very seriously and takes great care to ensure that personal data is handled appropriately in order to secure and maintain individuals’ trust and confidence in the force.
Why do we handle personal data?
The PFCC obtains, holds, uses and discloses personal information for two broad purposes:
The remit and power of the PFCC – which includes rendering assistance to the public in accordance with PFCC policies and procedures; and any duty or responsibility of the PFCC arising from common or statute law.
The provision of services to support the remit of the PCC – which include:
Staff administration, occupational health and welfare
Management of public relations, journalism, advertising and media
Management of finance
Internal review, accounting and auditing
Vehicle and transport management
Payroll and benefits management
Management of complaints
Management of information technology systems
The OPFCC also holds, uses and discloses personal data for the following purposes:
To improve accountability within the police force.
Ensuring that our local police force is combating issues important to our local community; managing our staff.
Maintaining our accounts and records.
Promoting our services and activities.
Carrying out research.
The use of CCTV systems for crime prevention.
Whose personal data do we handle?
In order to carry out the purposes described under section 1 above The OPFCC may obtain, use and disclose (see section 6 below) personal data relating to a wide variety of individuals including the following:
Advisers and professional experts
Members of the public
Individuals captured by CCTV images
Recipients of police services
The OPFCC will only use appropriate personal data necessary to fulfill a particular purpose or purposes. Personal data could be information which is held on a computer, in a paper record i.e. a file, as images, but it can also include other types of electronically held information i.e. CCTV images.
What types of personal data do we handle?
In order to carry out the purposes described under section 1 above The OPFCC may obtain, use and disclose (see section 6 below) personal data relating to or consisting of the following:
Education and employment details
Goods and services
Lifestyle and social circumstances
Visual images, personal appearance and behaviour
We also process sensitive classes of information that may include:
Offences and alleged offences
Criminal proceedings, outcomes and sentences
Racial and ethnic origin
Religious or similar beliefs
Trade union membership
Physical or mental health or condition
How do we handle personal data?
In order to achieve the purposes described under section 1, The OPFCC will handle personal data in accordance with the Act. In particular we will ensure that personal data is handled fairly and lawfully with appropriate justification. We will strive to ensure that any personal data used by us or on our behalf is of the highest quality in terms of accuracy, relevance, adequacy and non-excessiveness, is kept as up to date as required, is protected appropriately, and is reviewed, retained and securely destroyed when no longer required. We will also respect individuals’ rights under the Act (see section below).
How do we ensure the security of personal data?
The OPFCC takes the security of all personal data under our control very seriously. We will comply with the relevant parts of the Act relating to security, and we will ensure that appropriate policy, training, technical and procedural measures are in place, including audit and integrity monitoring, to protect our manual and electronic information systems from data loss and misuse. We would only permit access to them when there is a legitimate reason to do so, and then under strict guidelines as to what use may be made of any personal data contained within them. These procedures are continuously managed and enhanced to ensure up-to-date security.
Who do we disclose personal data to?
The OPFCC will sometimes need to share the personal information we process with the individual themselves and also with other organisations. Where this is necessary we are required to comply with all aspects of the Data Protection Act (DPA). What follows is a description of the types of organisations we may need to share some of the personal information we process with for one or more reasons. Where necessary or required we share information with:
Business associates, advisers
Consultants and other professional experts
Family, associates and representatives of the person whose personal data we are processing
Suppliers and providers of goods and services
Healthcare and social and welfare advisers or practitioners
Police forces and security organisations
Local and central government
Credit reference agencies, debt collection and tracing agencies
Traders in personal data
Employment and recruitment agencies
Ombudsmen and regulatory authorities
Press and the media
Some of the functions we carry out may involve collecting, using and sharing special category data as defined by the General Data Protection Regulation and Data Protection Act 2018. We do not disclose or share this sensitive or confidential information without your explicit consent except in a small number of situations where disclosure is allowed by law, or where we have good reason to believe that failing to do so would put you or someone else at risk. Where the potential for high-risk processing is identified, we will undertake a Data Protection Impact Assessment to assess and mitigate any risks.
It may sometimes be necessary to transfer personal information overseas. When this is needed information is only shared within the European Economic Area (EEA). Any transfers made will be in full compliance with all aspects of the data protection act.
What are the rights of the individuals whose personal data is handled by the Northamptonshire OPFCC?
Individuals have various rights enshrined in the Act:
The most commonly exercised right is that used by individuals to obtain a copy, subject to exemptions, of their personal data processed by The OPFCC. Requests for a Subject Access Request must be put in writing to the Monitoring Officer of the OPFCC (see section 10 below). To help establish your identity your application must be accompanied by COPIES of TWO official documents, which between them clearly show your name, date of birth and current address. For example, driving licence, medical card, birth/adoption certificate, passport and any other official document, which shows your name, date of birth and address.
Right to prevent processing likely to cause damage or distress
Under Section 10 of the Act an individual is entitled, in limited circumstances, to write to the Monitoring Officer of the OPFCC requiring that we do not handle their personal data in a manner that was causing or would be likely to cause unwarranted substantial damage or substantial distress to themselves or another person. Requests under Section 10 must describe the personal data involved; describe the handling to which the individual objects; state that the handling was causing or would be likely to cause substantial damage or substantial distress to him/her or another; describe the damage or distress; state that the damage or distress was/would unwarranted; and give reasons why the handling was causing/would cause such distress and was/would be unwarranted.
All requests of this nature may be sent in writing to the Monitoring Officer of the OPFCC (see section 10 below). It is worth noting that the Act includes certain provisions which may mean in a particular case the OPFCC can continue to handle the personal data as intended despite the objection.
Right to Prevent Processing for the Purposes of Direct Marketing
Under Section 11 of the Act and subject to certain exemptions, an individual has the right to request in writing that the OPFCC stops within a reasonable time, or does not start, using their personal data for direct marketing purposes. This includes the communication by any means (e.g. mail, email, telephone, door-to-door canvassing) of any advertising or marketing material directed at particular individuals.
Any requests under Section 11 may be sent to the Monitoring Officer of the OPFCC (see section 10 below).
Rights in relation to automated decision-taking
Although the OPFCC is unlikely to carry out any automated decision-taking that does not involve some human element, under Section 12 of the Act and subject to certain exemptions, an individual has the right to require that the OPFCC ensures that no decision that would significantly affect them is taken by the OPFCC or on its behalf purely using automated decision-making software. The right has to be exercised in writing. If there is a human element involved in the decision-making the right does not apply. Requests under Section 11 may be sent to the Monitoring Officer of the OPFCC (see section 10 below).
Right to take action for compensation if the individual suffers damage by any contravention of the Act by data controllers
Under Section 13 of the Act any individual who believes they have suffered damage and/or distress as a result of any contravention of the requirements of the Act may be entitled to compensation from the OPFCC where the organisation is unable to prove that it had taken such care as was reasonable in all the circumstances to comply with the relevant requirement. Any claim for compensation arising from this provision may be sent to the Monitoring Officer of the OPFCC (see section 10 below).
Right to take action to rectify, block, erase or destroy inaccurate data
Under Section 14 of the Act an individual has the right to seek a court order for the rectification, blocking, erasure or destruction of their inaccurate personal data handled by the OPFCC. The right cannot be exercised directly to the OPFCC.
Right to request the Information Commissioner to assess a data controller’s Processing
Under Section 42 of the Act any person can request the Information Commissioner to make an assessment if they believe that they are/have been adversely affected by the handling of personal data by the OPFCC. Such requests should be made direct to the Information Commissioner whose contact details can be found below.
Generally if individuals have any concerns regarding the way their personal data is handled by the OPFCC or the quality (accuracy, relevance, non-excessiveness etc.) of their personal data they are encouraged to raise them with the Monitoring Officer of the OPFCC (see section 10 below).
The Information Commissioner is the independent regulator responsible for enforcing the Act and can provide useful information about the Act’s requirements.
The Information Commissioner’s Office may be contacted using the following:
The Information Commissioner’s Office
Tel: 0303 123 1113
How long does Northamptonshire OPFCC retain personal data?
The OPFCC keeps personal data as long as is necessary for the particular purpose or purposes for which it is held. A copy of the OPFCC’s Record Retention Policy can be downloaded here
Subject to the law, the OPFCC will monitor or record and retain your telephone calls, texts, emails, social media posts and other communications in relation to your dealings with us. We do this for regulatory compliance, self-regulatory practices, crime prevention and detection, to protect the security of our communications systems and procedures, to check for obscene or profane content, for quality control and staff training and when we need to see a record of what’s been stated. We aim to communicate and correspond efficiently and effectively with you and to assist the role and remit of the PFCC.
Any individual with concerns over the way the OPFCC handles their personal data may contact the Monitoring Officer at address below:
The Monitoring Officer
Northamptonshire Police, Fire and Crime Commissioner
Park Farm Industrial Estate
Tel: 01604 888113
If you want to raise a concern with the Supervisory Authority
The Information Commissioner is the independent Authority responsible within the UK for ensuring we comply with data protection legislation. If you have a concern about how we have used your personal information or you believe you have been adversely affected by our handling of your data you may wish to contact them using the information below:
The Information Commissioner’s Office,
Telephone 0303 123 1113
Further information about the ICO can be found here.
This website contains external links to third party sites. Our privacy notice applies only to information collected by or on behalf of the Police and Crime Commissioner. If you go to another website, you should read their privacy notice before you give them any personal details.
This document is designed to help satisfy the ‘Fair Processing Requirements as required by Schedule 1 Part II Paragraphs 1-4 of the Data Protection Act 1998. Additional Fair Processing Notices may be included on other such items including but not limited to forms, OPFCC policies and email footers.
‘Personal Data’ is defined under Part I of the Data Protection Act 1998. In practical terms it means information handled by the OPFCC that relates to identifiable living individuals. It can include intentions and expressions of opinion about an individual. The information can be held electronically or as part of a paper record and can include CCTV images and photographs. Part I of the Act uses the term ‘processing’ to effectively cover any usage of personal data.