Guidance

Practitioner and Interim Manager privacy notice

Updated 27 April 2023

Applies to England and Wales

The Charity Commission for England and Wales collects and processes personal information for the exercise of our public functions.

We are registered as a data controller with the Information Commissioner’s Office under registration number Z5640596.

Why we appoint interim managers

We have the power to appoint an Interim Manager (‘IM’) to act as receiver and manager in respect of the property and affairs of a charity, under section 76(3)(g) of the Charities Act 2011 (‘the Act’). An IM has the same duties and responsibilities as a trustee in relation to the management and administration of a charity. We can use this temporary protective power only after opening a statutory inquiry under section 46 of the Act if we are satisfied either that there is or has been misconduct and/or mismanagement in the administration of a charity, or that it is necessary or desirable to protect the charity’s property.

This Privacy Notice explains how we process your personal data:

• when you apply to join our list of practitioners approved to be appointed as an IM (‘the approved list’)
• when you join the approved list
• when you, as an approved practitioner, are appointed as an IM

It also sets out some of your rights and entitlements in respect of that personal data.

Why we process your personal data

We process personal data in order to carry out our function as the independent regulator of Charities for England and Wales. Our objectives, functions and duties are set out in sections 14 to 16 of the Act.

If you apply to join the approved list, we require your personal data to assess your suitability to act as an IM. If you do not provide us with this personal data, we will not be able to process your application.

For approved practitioners, we may collect your personal data in the form of your:

• identity details: your name, job title, professional qualification, date of birth and this may also include your gender
• contact details: your firm’s address, email, and telephone numbers
• relevant experience and qualifications in the form of a biography, including a CV
• references from existing or former clients

For points of contact, we only require your name and contact details: your firm’s address, email, and telephone numbers.

Applying on behalf of another individual

We require the above information for all applicants (a minimum of two and a maximum of four per firm) and for each firm’s point of contact. We accept a single application from a firm but the individual submitting it must ensure that they have the authority to provide any third-party personal data and that the point of contact and all the applicants have read this Privacy Notice.

The lawful basis for processing your personal data

We collect your personal data so we can make a reasoned assessment of your suitability to act as an IM under section 76(3)(g) of the Act and can manage the list of approved practitioners.

The Commission relies on GDPR Article 6.1 (e) as the lawful basis for processing your personal data: ‘processing is necessary for the performance of a task carried out in public interest or in the exercise of official authority invested in the controller.’

Who we share your personal data with

We will share your personal data only if you are accepted on the approved list and if you are appointed as an IM for a specific charity. This will be kept to a minimum, but for the purposes of transparency and the public interest we may share your contact information with:

• the charity to which you have been appointed as an IM - this may include current trustees and beneficiaries
• other government departments, public authorities and regulators, particularly if we rely on your findings as the basis for taking regulatory action
• the charity’s bank(s)
• the general public via:
  • the charity’s entry on the Commission’s public Register of Charities
• the Commission’s website through:
  • press announcements on individual appointments
  • inquiry reports that name the IM and their firm and the cost of the appointment. These may also refer to the IM’s findings during the inquiry

We will share your personal data with your firm as part of our day to day management of the approved list. If you leave the approved list or if you are removed from the approved list by us we will notify your firm but we will not disclose the reason for your removal.

How long we will hold your personal data

We will keep your personal data for as long as you are a point of contact or remain on the approved list. If you are appointed as an IM, we will hold your contact information on the charity’s case file in accordance with our retention policy.

We will delete your data without undue delay:

• if you are no longer a point of contact
• if you leave the approved list
• if you withdraw your application before joining the approved list

We will delete all personal data in or connected to unsuccessful applications to join the approved list within six months.

Accuracy of your personal data

If you are a point of contact or on the approved list, you should inform us immediately if your contact information changes. We will also ask you annually to check the accuracy your personal data and to inform us of any updates required.

Data Subject Rights and Data Protection Officer

If you want to exercise any of your rights as a data subject, including your rights of access and / or to rectification, objection, or to restrict processing, please contact our Data Protection Officer using the following details:

Email: DPO@charitycommission.gov.uk

The UK supervisory authority for data protection is the Information Commissioner’s Office (‘the ICO’). You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), and more information can be found on the ICO website.

If you want to know more about how the Commission processes personal data, please read our Personal Information Charter.