Guidance

Animal health and welfare privacy notice

Updated 30 September 2024

Applies to England, Scotland and Wales

Your data is being collected by

The data controller is the Department for Environment, Food and Rural Affairs (Defra) for personal data that you give to the Animal and Plant Health Agency (APHA).

APHA is an Executive Agency of Defra. You can contact APHA’s Data Protection Manager by email at: data.protection@defra.gov.uk.

APHA also works with the Scottish Government and Welsh Government, who are joint controllers with APHA for any relevant personal data.

Any questions about how Defra and APHA are using your personal data and your associated rights should be sent to APHA’s Data Protection Manager by email at: data.protection@defra.gov.uk.

The Data Protection Officer responsible for monitoring that Defra and APHA are meeting the requirements of the legislation can be contacted by email at: DefraGroupDataProtectionOfficer@defra.gov.uk.

What personal data is collected

We hold the following items of personal data:

• name
• address
• contact details including your landline and mobile phone numbers, and e-mail address
• records of APHA visits and related paperwork and correspondence

How your data has been obtained

Data used by APHA is usually obtained directly from the data subjects (individuals themselves). Occasionally, where necessary under the relevant Animal Health and Welfare legislation, and for disease surveillance and control, data is referred from other bodies working closely with APHA (such as the UK Health Security Agency (UKHSA), or local authorities).

Why APHA is using your data

APHA uses your data to:

• safeguard animal health and welfare; and protect human health where relevant (zoonoses)
• uphold and comply with Animal Health and Welfare legislation

The legal basis for processing your data

The legal bases for processing your data are:

• for compliance with a legal obligation on the controller (Article 6(1)(c) UK GDPR)
• the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e) UK GDPR)

A legal or contractual requirement to provide personal data

Yes, there is a legal requirement for you to provide personal data. The keeping of animals carries with it a legal responsibility for their health and welfare; and there is a legal requirement to report any suspicion of notifiable disease to the competent authority.

The provision of personal data, such as a keeper’s name and address, is required for APHA to carry out official duties to abide by such legislation.

Consequences of not providing the necessary data

For statutory and public interest purposes it is necessary that you provide data as stated in the relevant legislation. Persons not providing the data required for APHA to safely operate under the Animal Health and Welfare Legislation will be in breach of the legislation; and will not be able to receive results from relevant tests, if appropriate.

For a current list of legislation managing these diseases visit legislation.gov.uk.

Who APHA shares your data with

Personal data may be made available to local authorities and other public bodies in the UK and EU to meet legal requirements. APHA may share data with Defra and its agencies, Welsh Government, Scottish Government, Food Standards Agency, Public Health, and other organisations and enforcement authorities. When testing samples from animals, APHA will usually only need to share pertinent data if a positive result is identified at the laboratory.

APHA may have to release information (including personal data and commercial information) under the following legislation:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Freedom of Information Act 2000
• Environmental Information Regulations 2004

APHA will not allow any unwarranted breach of confidentiality and will not act in contravention of our obligations under UK data protection legislation.

Personal data may be made available to local authorities and other public bodies in the UK and EU to meet legal requirements for animal, and sometimes human disease control (where zoonosis is a concern), and for animal welfare.

APHA may share data with Defra and its agencies, Welsh Government, Scottish Government, Food Standards Agency, Public Health, and other organisations and enforcement authorities.

Storing and using personal data outside the UK

A very small percentage of government records containing personal data are selected for permanent preservation at the National Archives. They are made available in accordance with the Freedom of Information Act 2000, as amended by the Data Protection Act 2018.

The data you provide will largely not be transferred outside of the UK. However, data, may be shared with internationally- recognised animal health authorities for auditing purposes (the World Organisation for Animal Health). On rare occasions, when it is lawful and complementary to our work carried out in the public interest, research data may be transferred securely outside of the UK.

How long APHA holds personal data for

Retention periods are set by considering statutory, regulatory, legal, and security reasons, alongside historic value.

All information in APHA is held in accordance with our retention policy. If you would like more information contact enquiries@apha.gov.uk.

Your rights

Find out about your rights under data protection law.

Complaints

You have the right to lodge a complaint about the use of your personal data at any time with the Information Commissioner’s Office (ICO – the data protection supervisory authority).

APHA’s personal information charter

APHA’s personal information charter broadly sets out details of Defra’s processing of personal data.