Guidance

Information rights privacy information notice

Updated 5 January 2022

The Information Rights Privacy Notice explains how we will process personal data when responding to an information request under the Freedom of Information Act 2000 (FOIA), an information request under the Environmental Information Regulations 2004 (EIR) or a data subject access request (SAR).

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

Purpose

The purposes for which we process personal data in relation to FOIA, EIR or SAR requests are to:

• register and process a request made under the FOIA
• register and process a request made under the EIRs
• register and process a SAR (this includes the registering and processing of requests for all the individual rights under UK GDPR which are listed under the ‘Your Rights’ section
• check your identity, if you make a request under data protection legislation

The data

In relation to FOIA, EIR or SAR information requests, we will process the following personal data:

• your name
• your address
• your email address
• information requested by us as proof of identity (in relation to SARs)
• your request
• other personal data if you volunteer it

In responding to SARs, we may process any data on you held by the department.

Legal basis of processing

• In relation to responding to FOIA, EIR and SARs, the legal basis for processing your personal data is that it is necessary to comply with a legal obligation placed on us as the data controller.

• In the course of responding to a request we may require cross government advice or support. The legal basis for processing your personal data regarding this task is that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case the task is receiving advice or support in responding to the request.

• Sensitive personal data are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. Although we do not ask that you provide sensitive personal data when submitting a request, we may process this in responding to a FOIA, EIR or SAR if you volunteer such information, or in the course of responding to a SAR. We may also process data about criminal convictions in responding to a SAR. The legal basis for processing sensitive personal data, or data about criminal convictions, is that processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department. The function is meeting our legal obligations to answer FOIA, EIR and SARs.

Recipients

In relation to FOIA, EIR and SARs, we treat all information we hold about you as private and confidential. We will not reveal any personal details or details concerning you to anyone outside the Home Office, unless:

• you ask us to disclose the information, or we have your permission to do so
• we are required or permitted to do so by law
• we may share information with other government departments and some public bodies in order that we can receive cross-government advice and support
• as your personal data will be stored on our IT infrastructure it will also be shared with our data processors who provide email, and document management and storage services

Retention

The retention period is set out in the Home Office retention schedule on GOV.UK.

Communicating with you

It’s important that you let us know if there are any changes to your contact or personal details whilst a request is still outstanding. This is so that we can communicate with you safely and quickly. Please let us know straight away if any of the following change:

• your name
• the address to which you want us to reply to any request under the FOIA, EIR or SAR

We will contact you using the email or postal address from which your request was sent, unless you ask us to use a different address.

Your rights

You have the right to:

• request information about how your personal data are processed, and to request a copy of that personal data
• request that any inaccuracies in your personal data are rectified without delay
• request that any incomplete personal data are completed, including by means of a supplementary statement
• request that your personal data are erased if there is no longer a justification for them to be processed
• in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted
• object to the processing of your personal data

Contact details

If you would like more information you can email the Information Rights Team.

or

Information Rights Team
Home Office
Lower Ground Floor, Seacole Building
2 Marsham Street
London
SW1P 4DF

The Home Office has a Data Protection Officer who can be contacted:

Office of the DPO
Home Office
Peel Building
2 Marsham Street
London
SW1P 4DF

or

Email: dpo@homeoffice.gov.uk

The Home Office also has a Personal Information Charter on GOV.UK.

Complaints

If you consider that your personal data have been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.

The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

or

Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.