Guidance

Privacy Notice for the Joint Intelligence Organisation

Published 1 October 2019

This notice sets out how the Joint Intelligence Organisation (as part of the Cabinet Office) may use personal data for the purpose of producing national security assessments and the development of analytical methodology.

The Joint Intelligence Organisation leads on intelligence assessment and development of the UK intelligence community’s analytical capability, drafting assessments on situations and issues of current concern, providing warnings of threats to British interests and identifying and monitoring countries at risk of instability.

This notice also explains your rights in relation to the data we process. It is made under Articles 13 and/or 14 of the Applied General Data Protection Regulation (GDPR).

1. Your data

1.1 The data

We may process any categories of data (including special categories of personal data).

1.2 Legal basis of processing

The legal basis upon which we may process personal data is that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. The tasks are: * the production of assessments to inform the safeguarding of national security and development of government policy; and * the development of analytical methodology.

Special categories of personal data are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. The legal basis upon which we may process your special category personal data is:

• The processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department (i.e. national security).

Or alternatively:

• The processing relates to personal data which are manifestly made public by the data subject, in the case of personal information obtained through open source research.

The processing by us of personal data relating to criminal convictions and offences or related security measures is: (a) either carried out under official authority, or (b) because the processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department (i.e. national security).

1.3 Recipients

As an organisation engaged in national security assessment, where necessary and proportionate, personal data may be shared with other public authorities (including those overseas). We may also share personal data with organisations for the purpose of developing analytical methodology.

As personal data will be stored on our IT infrastructure it will also be shared with our data processors who provide email, and document management and storage services.

1.4 Retention

We keep personal data only for as long as is necessary for the purpose for which it is being processed. .

Some personal data may be retained indefinitely for the purpose of national archiving.

1.5 Automated decision making

In relation to the use of data covered by this notice, the Cabinet Office does not make decisions which produce legal effects concerning the data subject based on automated processing, including profiling.

1.6 Where personal data have not been obtained from you

Personal data may be obtained by us from a wide range of sources including the intelligence agencies, diplomatic reporting and public sources.

2. Your rights

You may have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You may have the right to request that any inaccuracies in your personal data are rectified without delay.

You may have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You may have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You may have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You may have the right to object to the processing of your personal data.

However, please be advised that the Cabinet Office (as data controller) may not be obliged to comply with a request if an exemption applies. For example, this might be required to safeguard the interests of national security.

3. International transfers

As personal data is stored on our IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside the European Union. Where that is the case it will be subject to equivalent legal protection through the use of Model Contract Clauses.

We may occasionally transfer personal data outside the European Union to a country without an adequacy decision where this is necessary for important reasons of public interest (e.g. national security).

4. Contact details

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are:

Cabinet Office
70 Whitehall
London
SW1A 2AS

Public Enquiries: Online Contact Form

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.

The contact details for the data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk

5. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.

The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
0303 123 1113
casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.