1.  Why do we process personal data and under what basis?
2.  How do we process personal data?
3.  What types of personal data do we handle?
4.  Whose personal data do we handle and where do we obtain it from?
5.  How long does the PSNI retain personal data?
6.  How do we ensure the security of personal information?
7.  Who do we disclose personal data to?
8.  What are the rights of the individuals whose personal data is handled by the PSNI?
9.  Monitoring
10.  Contact Us

Additional Privacy Notice: CORONAVIRUS COVID-19

This temporary addition to PSNIs Adult Privacy Notice (March 2020) is to make it easier to understand and provide you with more information about how we may seek to collect and hold information about you in relation to the unprecedented challenges we are all facing during the Coronavirus pandemic (COVID-19).

We may seek to collect and process your personal data in response to the recent outbreak of Coronavirus, which is above and beyond what would ordinarily be collected from officers, staff and their dependents, to ensure their safety and well-being.

Such information will be limited to what is proportionate and necessary, taking into account the latest guidance issued by the Government and health professionals, in order to manage and contain the virus.

Where the information is to be used to make organisational decisions, steps will be taken to anonymise the data and general statistics/numbers used, wherever possible.

What personal data is being collected?

Personal data is being collected to enable us to identify anyone who is symptomatic or in any of the high risk categories and would be considered vulnerable, if infected with Coronavirus. This is necessary in the current climate to adhere to official guidance in order to protect the public, officers and staff.

What is our lawful basis for processing your personal data?

The General Data Protection Regulation requires specific conditions to be met to ensure that the processing of personal data is lawful. These relevant conditions are below:

• Article 6(1)(d) – is necessary in order to protect the vital interests of the data subject or another natural person.
• Recital 46 adds that “some processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread”.
• Article 6(1)(e) – is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• Section 8(c) of the Data Protection Act sets out that such a task must be necessary for the performance of a function conferred on a person by an enactment or rule of law. The Police Reform and Social Responsibility Act 2011 provides that Chief Constable may do anything which is calculated to facilitate or is conducive or incidental to the exercise of the functions Chief Constable.

The processing of special categories of personal data, which includes data concerning a person’s health, are prohibited unless specific further conditions can be met. These further relevant conditions are below:

• Article 9(2)(i) – is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.Schedule 1, Part 1(3) – is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law, e.g. Governmental guidance published by Public Health England
• Schedule 1, Part 1(1) – is necessary for the performance or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, e.g. Health and Safety at Work Act 1974.

Am I required to provide my personal data under a statutory or contractual requirement, or am I obliged to provide it?

Whilst the provision of data cannot be mandated in some cases, you are strongly advised that it is in the best interests of all to provide this information if requested.

All information will be held securely and processed on a ‘need to know’ basis by only a limited number of people. If there is a need to disclose outside of this, the minimal amount of personal data will be used.

How long will my personal data be retained?

We will only keep your information for as long as it is necessary, taking into account Government advice and the on-going risk presented by Coronavirus.

Information provided by officers and staff in relation to this outbreak of Coronavirus will not be used for any other purpose. When the information is no longer needed for this purpose, it will be securely deleted.

Your data and rights

If you would like to know more about how we process your personal data and your information rights or how to exercise them, you will find this within PSNISs adult or child privacy notices also on this web page.

Further advice and guidance from the ICO on this issue can be found:

https://ico.org.uk/for-organisations/data-protection-and-Coronavirus/

1.  Why do we process personal data and under what basis?

PSNI gathers and holds personal information which it uses for policing purposes.  The policing purposes are set out in Part 6 of the Police (Northern Ireland) Act 2000.  It states that it shall be the general duty of police officers to protect life and property, preserve order and to prevent the commission of offences and, where an offence has been committed, to take measures to bring the offender to justice.  They provide the legal basis for collecting, recording, evaluating, sharing and retaining police information.

The PSNI processes personal data for three broad purposes:

1. Policing;
2. Staff administration;
3. The provision of services to support the Policing Purpose.

The PSNI is also obliged to process information when required to do so by other legal obligations including enactments, court orders, or common law reasons and also for research and statistical purposes, including the production of official statistics.  On the unique occasion where the PSNI relies solely on consent to process personal data, individuals should be aware that they have the right to withdraw this consent at any time.  Where the PSNI have a legal basis to process information, consent will not be sought and will not be the basis relied upon to process that information.

 

2.  How do we process personal data?

The PSNI must ensure compliance with data protection principles; therefore, staff are directed by relevant policies and procedures in relation to data protection. In order to meet these standards the PSNI will ensure data is processed in a specified, legitimate, adequate, accurate, timely manner with stringent security controls. The PSNI maintains a record of processing activities throughout the organisation in order to retain these standards. We will only process personal data by lawful means and in line with processing conditions, for personal and Special Category Data[3] as dictated in legislation.

 

3.  What types of personal data do we handle?

PSNI holds information relating to a range of individuals including victims, witnesses, complainants, suspects and offenders, in connection with this policing purposes as well as details of others who work for or with PSNI. The PSNI may process both personal information and special category information relating to or consisting of the following:

Personal details such as name, date of birth, address and biographical details	Physical identifiers including DNA, fingerprints and other genetic samples
Family, lifestyle and social circumstances	Criminal proceedings, outcomes and sentences
Religious or other beliefs of a similar nature	Physical or mental health or condition
Education and training details	Employment details
Financial details	Goods or services provided
Racial or ethnic origin	Political opinions
Trade union or staff association membership	Offences (including alleged offences)
Sound and visual images	Licenses or permits held
Criminal Intelligence	Sexual life/Sexual orientation
References to manual records or files	Complaint, incident and accident details

 

This information will be held both electronically and in hard copy. Electronic records include information stored on a computer and CCTV, while hard copy records include paper records, i.e. in a file.

 

4.  Whose personal data do we handle and where do we obtain it from?

The PSNI may process personal data relating to a wide variety of individuals (data subject); this data can come from a wide variety of sources, these are noted below:

Data Subject
Witnesses and victims	Correspondents, enquirers and complainants
Offenders and suspected offenders	Personnel including permanent police officers and police staff, volunteers, agents, temporary and casual workers
Relatives, guardians and associates of the individual concerned
Other individuals necessarily identified in the course of police enquiries and activity	Former and potential members of staff, pensioners and beneficiaries
Advisers, consultants and other professional experts	Suppliers
Data Source
Individuals themselves including witnesses, victims, offenders, suspected offenders and persons making an enquiry or complaint	PSNI may also obtain personal data from other sources such as its own CCTV systems, or correspondence
Relatives, guardians or other persons associated with the individual	Producers of statistics and research including surveys[4]
Employees of PSNI	Private sector organisations working with the police in anti-crime strategies
Ombudsmen and regulatory authorities	Voluntary sector organisations
Prisons	Auditors
HM Revenue and Customs and other law enforcement agencies	Current, past or prospective employers of the individual
Courts, legal representatives, prosecuting authorities and defence solicitors	Healthcare, social and welfare advisers or practitioners
Her Majesty’s Inspectorate of Constabulary	Education, training establishments and examining bodies
Central and Local government - governmental agencies and departments	Business associates and other professional advisors
The media	Suppliers, providers of goods or services
Emergency services	Persons making an enquiry or complaint
Licensing authorities	Financial organisations and advisors
Security companies	Survey and research organisations
Partner agencies involved in crime and disorder strategies	Trade, employer associations and professional bodies
Voluntary and charitable organisations	Publicly accessible sources e.g. internet search
Staff Associations

 

5.  How long does the PSNI retain personal data?

The PSNI retains information, including personal information, as long as the Service considers necessary for the purpose or purposes for which it was collected.  The time periods are as detailed in the Service Review, Retention and Disposal Schedule. 

 

6.  How do we ensure the security of personal information?

PSNI takes the security of all personal information under our control very seriously; we have a number of policies in place which provide detailed procedures on specific information security controls, countermeasures and practices which must be adhered to. We will comply with the relevant parts of the legislation relating to security. We will ensure that appropriate policy, training, technical and procedural measures are in place, including audit and inspection, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so, and then under strict guidelines as to what use may be made of any personal data contained within them. These procedures are continuously managed and enhanced to ensure up-to-date security.

 

7.  Who do we disclose personal data to?

In order to carry out the purposes described under paragraph 1 above the PSNI may disclose personal data to a wide variety of recipients. This will include, but not be limited to disclosures to those listed as “data sources” in section 4 including, law enforcement agencies, partners in criminal justice, and to bodies or individuals working on our behalf such as contractors or survey organisations for example within the Criminal Justice System as part of the pre-charge and post charge processes, i.e. prosecuting someone through the Court. We may also disclose to other bodies or individuals where necessary to prevent harm to individuals. Disclosures of personal data will be made on a case-by-case basis, using the personal data appropriate to a specific purpose and circumstance, and with necessary controls in place.

Some of the bodies or individuals to which we may disclose personal data are situated outside of the European Union - some of which do not have laws that protect data protection rights as extensively as in the European Union. If we do transfer personal data to such territories, we will take proper steps to ensure adequate safeguards are in place as required by the Data Protection legislation and policing guidelines.

PSNI will also disclose personal data to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and by court order such as to other professional or regulatory bodies PSNI may also disclose personal data on a discretionary basis where it is necessary for the purpose of, and in connection with, any legal proceedings or for obtaining legal advice. Any disclosure of personal information is carefully considered in accordance with legislation, policy, and/or information sharing agreements governing that sharing.

 

8.  What are the rights of the individuals whose personal data is handled by the PSNI?

Individuals have various rights enshrined in the Data Protection legislation, these are detailed below. Further detail on these rights can be accessed within Articles 15 – 23 of the GDPR and Part 3 of the Data Protection Bill. The PSNI are permitted to ask data subjects to provide proof of their identity before giving effect to their rights. This ensures the security of your personal information. Requested information or responses to individuals requesting their rights are enacted should be provided, subject to exemptions[5], to the individual without undue delay and in any event within one month of receipt of the request and free of charge. Where a controller receives large numbers of requests from individuals, or they are especially complex, the time limit may be extended by a maximum of two further months. Requests deemed excessive or manifestly unfounded will not be processed. Individuals will be made aware of this extension and the reasons for delay explained. The PSNI will process any requests from individuals in relation to these rights; however, where PSNI have a legitimate business purpose for processing this data, or an exemption applies, PSNI does not have to give effect to the right. We will communicate this to you and highlight our reliance on the Data Protection legislation for this. By requesting your rights are enacted, the PSNI will be required to further process your personal information in order to keep a record of what amendments, if any, have been made and the justification for any decisions made. Where PSNI need to enact the rights of rectification, erasure and restriction, we will do so as far as is reasonably practicable.

The Right to Access

Subject Accessis the most commonly exercised right.  Individuals can request a copy of their personal data and other information about how PSNI processes your information. Where PSNI withholds some/all of the requested information we will provide details, where possible, around the decision in line with Data Protection legislation.

The right to rectification

Individuals are entitled to have personal data rectified if it is inaccurate or incomplete. If PSNI has disclosed the personal data in question to third parties; we must inform them of the rectification where possible. We will also inform the individuals about the third parties to whom the data has been disclosed, where appropriate. Where the PSNI is not taking action in response to a request for rectification, we will provide details around the decision.

The right to erasure

The right to erasure does not provide an absolute ‘right to be forgotten’. Individuals have a right to have personal data erased and to prevent processing in specific circumstances including, if consent is withdrawn, the data was processed unlawfully, compliance with legal obligation, and where processing if no longer necessary for the purpose it was originally collected.  

There are some specific circumstances where the right to erasure does not apply and PSNI can refuse to deal with a request including, if it is necessary to meet a legal obligation or defend a legal claim.

The right to restrict processing

In certain conditions individuals have a right to request PSNI ‘block’ or suppress/restrict processing of personal data such as where individuals dispute the accuracy of their information or the processing is no longer needed.

Once processing is restricted, the PSNI is permitted to store the personal data, but not process it further except on limited grounds such as with individual’s consent or in relation to legal claims. If the PSNI has disclosed the personal data in question to third parties, we must inform them about the restriction on the processing of the personal data, unless it is impossible or involves disproportionate effort to do so.

The PSNI must inform individuals before any restriction is lifted.

 As above, the PSNI may be required to restrict processing when an individual has contested the accuracy of data or has objected to the processing and these issues are being investigated. Or when the data subject has opposed erasure or requires the data to be retained in order to progress a legal claim.

The right to data portability

The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services, this includes individuals being provided with their data in a commonly used electronic format in order that it can then be easily transferred or ‘ported’ to another data controller as and when required (either by the individual themselves, or PSNI). This right only applies to personal data which an individual has provided to PSNI which is processed by automated means; by virtue of the individual’s consent or for the performance of a contract. The right to data portability does not extend to processing of personal information for law-enforcement processing.

The right to object

Individuals have the right to object to processing unless the PSNI can demonstrate explicitly how it is linked to the purposes described under paragraph 1 or the processing is for the establishment, exercise or defence of legal claims. Individuals have the right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling), and processing for purposes of scientific/historical research and statistics. The right to object does not extend to processing of personal information for law-enforcement processing.

Rights in relation to automated decision making and profiling

Although the PSNI is unlikely to carry out any automated decision-taking or automated profiling that does not involve some human element, an individual has the right to require that PSNI ensures that no decision that would significantly affect them is taken by PSNI or on its behalf purely using automated decision making software.

Further details on all of the rights within Data Protection legislation can be found on the Information Commissioner’s Office website at www.ico.org.uk.

 

9.  Monitoring

PSNI may monitor or record and retain telephone calls, texts, emails and other electronic communications to and from the Service in order to deter, prevent and detect inappropriate or criminal activity, to ensure security, and to assist the purposes described under section 1 above. PSNI does not place a pre-recorded ‘fair processing notice’ on telephone lines that may receive emergency calls (including misdirected ones) because of the associated risk of harm that may be caused through the delay in response to the call.

The PSNI will utilise CCTV within their establishments for the security and protection of the Police Estate.

 

10.  Contact Us

If you would like to exercise any of the rights discussed in this document, you can do so by contacting the following department.

 

Corporate Information

Police Service of Northern Ireland
Police Headquarters
65 Knock Road
Belfast
BT6 5LE
Telephone: 028 9070 0164
Email: DataProtection@psni.police.uk

 

The PSNI has a designated Data Protection Officer (DPO). The DPO is an independent advisor to the PSNI and is responsible for ensuring that PSNI are processing personal data in line with the legislation. Any individual with concerns over the way PSNI handles their personal data may contact our Data Protection Officer at the address above or by email via DataProtectionOfficer@psni.police.uk

If you remain unhappy about how your request has been handled you have the right to apply directly to the information Commissioner. The Information Commissioner is the independent regulator responsible for enforcing the legislation and can provide useful information about the legislation’s requirements. Our local Information Commissioner’s address is:

Information Commissioner’s Office
3^rd Floor                                   
14 Cromac Place                    
Belfast, BT7 2JB
Email: ni@ico.org.uk
Tel: 028 9027 8757