Notice

Applying for support for alternative fuels if you do not get it automatically (Great Britain): privacy notice

Updated 17 August 2023

This notice is provided to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA) to provide transparency in how we process and use personal data collected for the ‘Domestic Alternative Fuel Payment Alternative Fund’ scheme in Great Britain (the Scheme), and your rights. It is made with reference to Articles 13 and 14 of the UK GDPR.

This notice is relevant to you if you apply on GOV.UK for a payment under the Scheme. Your application will be processed initially by the Department for Energy Security and Net Zero (DESNZ), and then by your local authority who will ask you for further information and evidence. DESNZ and your local authority are the independent data controllers for your data.

This privacy notice only relates to how DESNZ uses your data for the Scheme. It does not cover your local authority and how it uses your data. You should also read your local authority’s privacy notice on their website to understand how they use your data. They are also required to manage your personal data in a way that meets the UK GDPR and Data Protection Act.

Your data

We will process the following personal data:

• your name, where you live, date of birth, postcode and address, including when using the address lookup function API, as part of the initial application process
• your email and phone number when you have provided them
• bank account details to help us identify you and facilitate payment
• questions or feedback you leave, including your email address if you contact us
• evidence of power of attorney or other legal evidence to act on the applicant’s behalf

Special category data will not be expressly requested in connection with applications for the scheme, but it is possible that co-incident collection and sharing of special category data could occur as a result of information provided by applicants (or third party individuals acting on your behalf) in connection with the applications, including, but not limited to, information relating to the ethnic origin of applicants or data concerning applicant’s health or age.

This data is collected as you proceed through the application process and when you submit your application.

Purpose

To proceed with delivery of the Scheme to ensure support this winter to around 10% of eligible households that will not receive £200 automatically from an electricity supplier through the main AFP scheme. This includes monitoring the reach of the Scheme across regions and vulnerable groups.

To conduct financial checks on payments including for assurance and the prevention, investigation, detection or prosecution of criminal offences including fraud.

To allow DESNZ to evaluate the scheme to understand its impact and to inform future government policy.

We also collect your personal data to:

• carry out counter fraud checks
• reduce the risk of fraud and payment errors
• verify your identity
• confirm your entitlement to energy bill support
• make and manage your payments
• send notifications about your application
• provide support via our call centre if you encounter any issues with your application

We also collect your personal data to help improve our services so we can:

• analyse uptake of the service
• gather feedback and conduct research to improve the service
• send email alerts if you request them
• monitor use of the site to identify security threats
• identify and troubleshoot issues arising across multiple applications

Legal basis of processing

The legal basis for processing your personal data is processing as necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, such as the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either House of Parliament; or the administration of justice. In particular, this Processing is necessary for the administration, delivery, reporting, monitoring, evaluation of the Scheme, as well as in connection with fraud prevention, and pre- and post- payment assurance and financial management activities to be undertaken in connection with the Scheme.

Special category data

As referenced under sub-section “Your data” above, special category data will not be expressly requested in connection with applications for the scheme, but it is possible that co-incident collection and sharing of special category data could occur as a result of information provided by applicants (or third party individuals acting on their behalf) in connection with the applications, including, but not limited to, information relating to the ethnic origin of applicants or data concerning applicant’s health or age.

To the extent that Special Category Data is collected, it will be processed under Article 9(2)(g) of the UK GDPR – Substantial Public Interest. More particularly in the context of the exercise of governmental functions, preventing or detecting unlawful acts, regulatory requirements relating to unlawful acts and dishonesty, and preventing fraud, as set out in Part 2 of Schedule 1 to the DPA. In particular, this processing is necessary for the administration, delivery, reporting, monitoring, evaluation of the Scheme, as well as in connection with fraud prevention, and pre- and post- payment assurance and financial management activities to be undertaken in connection with the Scheme.

Recipients

We will share the following data with your local authority:

• your name, address, date of birth, postcode and address
• bank account details
• documents you upload as proof of address, and use of alternative fuel type(s)

The purpose of this is to:

• confirm your identity
• facilitate payment
• prevent, detect and investigate fraud and errors

We have a data sharing agreement with local authorities so that we can share your personal data with your local authority to deliver this service. Your local authority will also share your personal data with DESNZ during the processing of your application. The sharing of the data between local authorities and DESNZ is for the purpose of administration, delivery, reporting, monitoring, evaluation and fraud prevention necessary within the scheme. This may also include an assessment of your liability for council tax on the property you have stated as your sole and main residence on the application.

Your personal data will also be shared with our technology supplier Digital Modus and contact centre partner Arvato to process your application and provide call centre support. In some cases it will also be shared with Experian for the purpose of carrying out counter fraud checks.

When you use the call centre assisted service the service will be provided by Arvato. Arvato and local authorities may also exchange information provided on calls and other correspondence with DESNZ when there is a need to clarify missing information to process your application. Calls to the call centre will be recorded and retained for up to 7 years.

We may share your name and address with a contracted provider to contact you in writing to conduct research and evaluation about the service so we can deliver the scheme effectively and analyse the impact of the scheme. Any research is voluntary and will not affect the outcome of your application. You would have the right to withdraw at any time using the contact details provided by the contracted provider at the time of the research request.

We will share your data with other government bodies if we are required to do so by law - for example, by court order, or to prevent fraud or other crime.

Retention

We will only keep your personal data for as long as required to support the delivery, evaluation and scrutiny of the service.

We will store data entered as you complete this application and retain this until 30 June 2023. During this time it wlll be accessible by DESNZ and our technology supplier (Digital Modus) but our contact centre provider (Arvato) may have access to this information for up to 14 days after you enter it to enable provision of telephone support to you if you encounter any issues submitting your application.

If you submit your application, data will be securely deleted no later than 7 years after collection in line with our department policy.

Automated decision making

Your personal data may be subject to automated decision making. Initial eligibility checks will be made for the prevention and detention of fraud for example, to determine whether a payment has already been made under the main EBSS scheme or whether another application is in progress. Bank account verification assurance checks will also take place to ensure payments are made to the correct bank account.

Should your application be turned down following the initial eligibility checks, you will be informed of the reason why your application has been rejected. You will also be informed of how you can ask for a review of the decision which is not solely based on automated processing.

Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.

You have the right to object to the processing of your personal data including the right to object automated processing.

International transfers

We design, build and run our systems to make sure that your data is as safe as possible at all stages, both while it’s processed and when it’s stored.

As your personal data is stored on our IT infrastructure and shared with our data processors Microsoft and Amazon Web Services, it may be transferred and stored securely in the UK and European Economic Area. Where it is the case that your personal data is stored outside the UK and EEA it will be subject to equivalent legal protection through the use of Model Contract Clauses.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Telephone: 0303 123 1113

Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ).

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Email dataprotection@energysecurity.gov.uk

Changes to this policy

We may change this privacy policy. In that case, the ‘last updated’ date at the bottom of this page will also change. Any changes to this privacy policy will apply to you and your data immediately.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated 13 July 2023

Change log:

13 July 2023 – to include reference to Experian carrying out counter fraud checks

19 May 2023 – to clarify steps that may be taken to identify where Energy Bills Support Scheme payments have already been made

5 March 2023 – updated ‘Retention’ segment to reflect retention period for unfinished applications and accessibility to this information for the purposes specified and updated opening segment and ‘Your data’ segment to clarify when data will be collected during submission.