Notice

Applying for energy bill support if you do not get it automatically (Northern Ireland): privacy notice

Updated 17 August 2023

This notice is provided to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA) to provide transparency in how we process and use personal data collected for the ‘Energy Bills Support Scheme Alternative Funding scheme, and your rights. It is made under Articles 13 and 14 of the UK GDPR.

The service is for applications to the Energy Bills Support Scheme (EBSS) Alternative Funding for households in Northern Ireland who did not receive the original Energy Bill Support Scheme payment automatically, such as those without their own electricity supply or those without a direct relationship with the electricity supplier. The Department for Energy Security and Net Zero (DESNZ) is the independent data controller for your data.

This privacy notice relates to how DESNZ and trusted third-party data processors use your data in connection with the service and covers information saved as you proceed through the application and after you submit your application. This privacy notice also relates to other sources of personal data which DESNZ is requesting from trusted third parties in order to verify applications as part of DESNZ’s legal obligations under the Energy Prices Act 2022.

Your data

We will process the following personal data:

• your name, date of birth and address, including when using the address lookup function;
• your email and phone number when you have provided them;
• bank account details to help us identify you and facilitate payment;
• Property Rates data, as provided by the Land and Property Service, to verify address and domiciliation details;
• Energy Supplier relationship data – or lack thereof – as provided by Northern Ireland Energy Networks;
• questions or feedback you leave, including your email address if you contact us; and
• evidence of power of attorney or other legal evidence to act on the applicant’s behalf.

This data is collected as you proceed through the application process and when you submit your application.

Purpose

To proceed with delivery of the service, also known as the Energy Bills Support Scheme (EBSS) Alternative Funding in Northern Ireland, to ensure support over winter 2022/23 to around 1% of households that will not receive £400 automatically through EBSS, nor £200 through the Alternative Fuel Payment. This includes monitoring the reach of the scheme across regions and vulnerable groups.

To conduct financial checks on payments including for assurance and the prevention, investigation, detection or prosecution of criminal offences including fraud.

To allow DESNZ to evaluate the scheme to understand its impact and to inform future government policy.

We also collect your personal data to:

• carry out counter fraud checks;
• reduce the risk of fraud and payment errors;
• verify your identity;
• confirm your entitlement to energy bill support;
• make and manage your payments;
• send notifications about your application; and
• provide support via our call centre if you encounter any issues with your application.

We also collect your personal data to help improve our services so we can:

• analyse uptake of the service;
• gather feedback and conduct research to improve the service;
• send email alerts if you request them;
• monitor use of the site to identify security threats; and
• identify and troubleshoot issues arising across multiple applications.

Legal basis of processing

The legal basis for processing your personal data is processing as necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, such as the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either House of Parliament; or the administration of justice. In this case, to ensure support this coming winter to around 1% of households that will not receive £400 through EBSS automatically, nor £200 through the Alternative Fuel Payment, as outlined within the Energy Prices Act 2022.

The legal basis for processing data to conduct research about the service is consent. Any research is voluntary and will not affect the outcome of your application. You have the right to withdraw at any time.

Recipients

To ensure the delivery of this service, facilitate identity verification, provide payment verification and processing services, and provide customer support services, DESNZ will be sharing personal data with several trusted providers, all of whom have ensured full compliancy with relevant UK GDPR rules, regulations and practices.

Arvato ltd. will provide identity verification, case management and customer support services throughout the duration of this scheme. In order to fulfil these obligations as part of the delivery of the EBSS AF NI, Arvato ltd. will have access to:

• your name, date of birth and address;
• your email and phone number when you have provided them;
• questions or feedback you leave, including your email address if you contact us; and
• evidence of power of attorney or other legal evidence to act on the applicant’s behalf.
• your contact details, including your email address and phone number

Arvato will also gather new data for scheme administration, as follows:

• Recordings of correspondence (including phone call recordings) from users who contact support helplines available for the administration and delivery of this scheme.

PayPoint plc. will provide bank detail verification services, ensuring that bank details provided match recipient details. This process is necessary for processing payments, and therefore critical to the delivery of the EBSS AF NI. In order to process this data, they will have access to the following:

• your name, date of birth and address, and
• bank account details.

UK Shared Business Services (UKSBS) is a subsidiary of the Department for Business, Energy and Industrial Strategy. UKSBS will be responsible for processing payments, which is necessary for payment to successful applicants. In order to process these payments they will have access to the following personal data:

• your name, date of birth and address, and
• bank account details.

Salesforce UK ltd. is our data storage partner, responsible for the secure storage of your data. As all applicant data will be stored in Salesforce data centres, Salesforce will have the following data shared with them:

• your name, date of birth and address, including when using the address lookup function;
• your email and phone number when you have provided them;
• bank account details;
• Property Rates data, as provided by the Land and Property Service;
• Energy Supplier relationship data – or lack thereof – as provided by Northern Ireland Energy Networks;
• questions or feedback you leave, including your email address if you contact us; and
• evidence of power of attorney or other legal evidence to act on the applicant’s behalf.

Salesforce is fully compliant with the relevant UK GDPR requirements, including maintaining an active ISO27001 certificate. ISO27001 is an information security standard that ensures support centres and data centres securely manage and protect sensitive data.

We have a data sharing agreement with Arvato, UKSBS, Salesforce and PayPoint so that we can share your personal data with our partners to deliver this service. The sharing of the data between the contracted providers listed above and DESNZ is for the purpose of administration, delivery, reporting, monitoring, evaluation and fraud prevention necessary within the scheme.

Your personal data will also be shared with our technology supplier Digital Modus to process your application. In some cases it will also be shared with Experian for the purpose of carrying out counter fraud checks.

We may share your name and address with a contracted provider to contact you in writing to conduct research and evaluation about the service so we can deliver the scheme effectively and analyse the impact of the scheme. Any research is voluntary and will not affect the outcome of your application. You would have the right to withdraw at any time using the contact details provided by the contracted provider at the time of the research request.

We will share your data with other government bodies if we are required to do so by law - for example, by court order, or to prevent fraud or other crime.

Retention

We will only keep your personal data for as long as required to support the delivery, evaluation and scrutiny of the service.

We will store data entered as you complete this application and retain this until 30 June 2023. During this time it wlll be accessible by DESNZ and our technology supplier (Digital Modus) but our contact centre provider (Arvato) may have access to this information for up to 14 days after you enter it to enable provision of telephone support to you if you encounter any issues submitting your application.

If you submit your application, data will be securely deleted no later than 7 years after collection in line with our department policy.

Automated decision making

Your personal data may be subject to automated decision making. Initial eligibility checks will be made for the prevention and detention of fraud for example, to determine whether a payment has already been made under the main EBSS scheme or whether another application is in progress. Bank account verification assurance checks will also take place to ensure payments are made to the correct bank account.

Should your application be turned down following the initial eligibility checks, you will be informed of the reason why your application has been rejected. You will also be informed of how you can ask for a review of the decision which is not solely based on automated processing.

Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.

You have the right to object to the processing of your personal data including the right to object automated processing.

International transfers

We design, build and run our systems to make sure that your data is as safe as possible at all stages, both while it’s processed and when it’s stored.

As your personal data is stored on our IT infrastructure and shared with our data processors Microsoft and Amazon Web Services, it may be transferred and stored securely in the UK and European Economic Area. Where it is the case that your personal data is stored outside the UK and EEA it will be subject to equivalent legal protection through the use of Model Contract Clauses.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Telephone: 0303 123 1113

Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ).

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Email dataprotection@energysecurity.gov.uk

Changes to this policy

We may change this privacy policy. In that case, the ‘last updated’ date at the bottom of this page will also change. Any changes to this privacy policy will apply to you and your data immediately.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated 13 July 2023

Change log:

13 July 2023 – to include reference to Experian carrying out counter fraud checks

19 May 2023 – to clarify steps that may be taken to identify where Energy Bills Support Scheme payments have already been made

5 March 2023 – updated ‘Retention’ segment to reflect retention period for unfinished applications and accessibility to this information for the purposes specified and updated opening segment and ‘Your data’ segment to clarify when data will be collected during submission.