Notice

Energy Bills Support Scheme alternative funding for continuous cruisers: privacy notice

Updated 17 August 2023

This notice is provided to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA) to provide transparency in how we process and use personal data collected for the ‘Energy Bills Support Scheme Alternative Funding’ scheme, and your rights. It is made under Articles 13 and 14 of the UK GDPR.

The service is the Energy Bills Support Scheme Alternative Funding for Continuous Cruisers (EBSS AF CC), continuous cruisers that held a Canal & River Trust (the Trust) leisure licence without mooring (6 or 12 month) for a minimum of one day between 27 February 2023 and 31 May 2023. This group did not receive help for their energy bills via the automatic discount through the Energy Bill Support Scheme (EBSS – 1 October 2022 to 31 March 2023) or the Energy Price Guarantee (EPG - 1 October 2022 to 30 June 2023), and also did not have the opportunity to apply for either the EBSS Alternative Funding scheme between 27 February and 31 May 2023 or the Alternative Fuel Payment Alternative Fund (AFP AF) between 6 March and 31 May 2023.

This privacy notice only relates to how the Department for Energy Security and Net Zero (DESNZ) uses your data in connection with the EBSS AF CC scheme.

DESNZ and the Trust are the independent data controllers for your data. This privacy notice does not cover the Trust and how they use your data. You should also read the Trust’s privacy policy and related schedules to understand how they use your data. They are also required to manage your personal data in a way that meets the UK GDPR and DPA.

1. Your data

We will process the following personal data:

• Customer name
• Customer reference number
• Licence ID
• Boat Index
• Type of licence
• Boat mooring type

• Address fields 1 – 4

  • Postcode
  • City

• Licence Length

  • Start Date
  • End Date
• Payment method
• Telephone/Mobile number
• Email address
• Designated representative name (if relevant)

• Designated representative

  • address
  • email address
  • phone number (if relevant)

Special category data will not be expressly requested in connection with the scheme, but it is possible that co-incident collection and sharing of special category data could occur as a result of information collected to deliver the vouchers, including, but not limited to, information relating to the ethnic origin of applicants or data concerning applicant’s health.

These data have been collected by the Trust as part of their licensing process, and are shared with us in order to deliver support payments to licensed continuous cruisers.

2. Purpose

To proceed with delivery of the EBSS AF CC scheme, to ensure support for energy bills to licensed continuous cruisers that did not receive automatic support through EBSS or EPG, nor had the chance to apply for support through EBSS AF or AFP AF. This includes monitoring the reach of the scheme across regions and vulnerable groups.

To conduct financial checks on payments including for assurance and the prevention, investigation, detection or prosecution of criminal offences including fraud.

To allow DESNZ to evaluate the scheme to understand its impact and to inform future government policy.

We also collect your personal data to:

• carry out counter fraud checks
• reduce the risk of fraud and payment errors, including validating where EBSS AF and AFP AF payments have already been made
• verify your identity
• confirm your entitlement to energy bill support
• generate and issue vouchers and monitor redemption
• communicate information about the scheme

We also collect your personal data to help improve our services so we can:

• analyse uptake of the scheme
• gather feedback and conduct research to inform future policy
• identify and troubleshoot issues arising

3. Legal basis of processing

The legal basis for processing your personal data is processing as necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, such as the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either House of Parliament; or the administration of justice. In this case, it is to ensure support for energy costs for licensed continuous cruisers who have otherwise missed out on support for their energy costs.

4. Special category data

As referenced under sub-section ‘Your data’ above, special category data will not be expressly requested in connection with the scheme, but it is possible that co-incident collection and sharing of special category data could occur as a result of information provided by applicants (or third party individuals acting on your behalf) in connection with the applications, including, but not limited to, information relating to the ethnic origin of applicants or data concerning an applicant’s health.

To the extent that special category data is collected, it will be processed under Article 9(2)(g) of the UK GDPR – Substantial Public Interest. More particularly in the context of the exercise of governmental functions, preventing or detecting unlawful acts, regulatory requirements relating to unlawful acts and dishonesty, and preventing fraud, as set out in Part 2 of Schedule 1 to the DPA. In particular, this processing is necessary for the administration, delivery, reporting, monitoring, evaluation of the scheme, as well as in connection with fraud prevention, and pre- and post- payment assurance and financial management activities to be undertaken in connection with the scheme.

5. Recipients

We will share the following data with the voucher delivery partner, PayPoint:

• Customer name
• Customer reference number
• Boat Index
• Address fields 1 – 4; Postcode; City
• Telephone/Mobile number
• Email address
• Designated representative name; address; email address; phone number (if relevant)

The purpose of this is to:

• enable redemption of the voucher
• prevent, detect and investigate fraud and errors

We have a contract with PayPoint so that we can share your personal data with them to deliver this scheme. PayPoint will also share your personal data with DESNZ when reporting on voucher delivery and redemption. The sharing of the data between PayPoint and DESNZ is for the purpose of administration, delivery, reporting, monitoring, evaluation and fraud prevention necessary within the scheme.

We may share your name, address, telephone number and email address with a contracted provider to contact you in writing to conduct research and evaluation about the scheme so we can deliver the scheme effectively and analyse the impact of the scheme. Any research is voluntary and will not affect your support payment. You would have the right to withdraw at any time using the contact details provided by the contracted provider at the time of the research request.

We will also share data we receive from you with the Canal & River Trust where that assists with delivering the vouchers, verifying eligibility for the scheme, or preventing fraud and error to protect public funds.

We will share your data with other government bodies if we are required to do so by law - for example, by court order, or to prevent fraud or other crime.

6. Retention

We will only keep your personal data for as long as required to support the delivery, evaluation and scrutiny of the scheme. All information will be securely deleted, other than to the extent necessary for DESNZ to complete any relevant data processing to facilitate delivery of the scheme, or to comply with obligations imposed on DESNZ under applicable law, in any event not longer than 7 years from collection.

7. International transfers

We design, build and run our systems to make sure that your data is as safe as possible at all stages, both while it’s processed and when it’s stored.

As your personal data is stored on DESNZ IT infrastructure and shared with our data processors Microsoft and Amazon Web Services, it may be transferred and stored securely in the UK and European Economic Area. Where it is the case that your personal data is stored outside the UK and EEA it will be subject to equivalent legal protection through the use of Model Contract Clauses.

8. Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.

You have the right to object to the processing of your personal data including the right to object to automated processing.

You can exercise your rights by contacting the DESNZ data protection officer using the contact details below.

9. Contact details

The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ).

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Email dataprotection@energysecurity.gov.uk

If you are unhappy with the way we have handled your personal data, please write to the Department’s Data Protection Officer in the first instance using the contact details above.

10. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Telephone: 0303 123 1113

Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

11. Changes to this policy

We may change this privacy policy. In that case, the ‘last updated’ date at the bottom of this page will also change. Any changes to this privacy policy will apply to you and your data immediately.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated: 25 August 2023

Change log:

• 25 August 2023: Updated to explain that DESNZ can share updated recipient details with CRT
• 17 August 2023: published on GOV.UK