Guidance

Privacy notice

Updated 22 August 2024

© Crown copyright 2024

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/defra-privacy-notice-national-fraud-initiative/privacy-notice

Purpose

This notice sets out how we will use your personal data as part of the Cabinet Office’s National Fraud Initiative (NFI) data matching exercise to aid in the prevention and detection of fraud.

The data

We process information that you provide when seeking payment of an invoice from us. This is referred to as trade creditor standing and payment history data.

Criminal convictions

Should data matching through the NFI result in a prosecution, then this may also be recorded by participating organisations.

Automated profiling

Your personal data will be subject to the following automated profiling (as defined in Article 4, paragraph 4 GDPR):

Data matching involves comparing sets of data, such as the payroll or benefits records of a body, against other records held by the same or another body to see how far they match. The data is usually personal information. The data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency that requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

The processing of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under its powers in Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under data protection legislation or the GDPR.

All bodies participating in the Cabinet Office’s data matching exercises receive a report of matches that they should investigate, so as to detect instances of fraud, over- or under-payments and other errors, to take remedial action and update their records accordingly.

The legal basis for processing your personal data is that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

The National Fraud Initiative is conducted using the data matching powers bestowed on the Minister for the Cabinet Office by Part 6 of the Local Audit and Accountability Act 2014 (LAAA). View further information on the Cabinet Office’s legal powers and the reasons why it matches particular information.

The Cabinet Office conducts data matching exercises to assist in the prevention and detection of fraud. The processing of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under its powers in Part 6 of the Local Audit and Accountability Act 2014.

Our legal basis for processing your criminal convictions data is paragraphs 6 and 10 of schedule 1 to the Data Protection Act 2018.

Recipients

Your personal data will be shared by us as necessary for the purposes of preventing and detecting fraud with other participants taking part in the NFI as listed on National Fraud Initiative privacy notice - GOV.UK

Retention

Your personal data will be kept by Cabinet Office for the periods set out in the Data Deletion Schedule (pending release following consultation).

Your rights

You have the right:

  • to request information about how your personal data are processed, and to request a copy of that personal data
  • to request that any inaccuracies in your personal data are rectified without delay
  • to request that any incomplete personal data are completed, including by means of a supplementary statement
  • to request that your personal data are erased if there is no longer a justification for them to be processed
  • in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted

Where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, such as the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either House of Parliament; or the administration of justice: You have the right to object to the processing of your personal data. This right does not apply where your data is disclosed to us under a legal obligation under paragraph 2 of schedule 9 of the Local Audit and Accountability Act 2014.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

Department for Environment, Food and Rural Affairs (Defra) is the controller for the personal data we collect:

Department for Environment, Food and Rural Affairs
Seacole Building
2 Marsham Street
London
SW1P 4DF

If you need further information about how Defra uses your personal data and your associated rights you can contact the Defra data protection manager. Email data.protection@defra.gov.uk.

The data protection officer for Defra is responsible for checking that Defra complies with legislation. You can contact them by email at DefraGroupDataProtectionOfficer@defra.gov.uk.

Back to top