Environmental permits privacy notice
How the Environment Agency uses your personal information in services to support environmental permitting.
Applies to England
The Environment Agency runs the following services to support environmental permitting:
- environmental permit pre-application advice
- apply for, change, transfer or cancel an environmental permit
We are the controller for the personal data we process to provide these services. A controller decides how and why personal data is processed.
Our personal information charter explains:
- your rights and how to complain to the Information Commissioner’s Office
- what we do with your personal information (personal data)
- how to contact our Data Protection Officer
Why we are able to process your personal data
We have official authority as the environmental regulator in England under the Environmental Permitting (England and Wales) Regulations 2016.
The law allows us to process your personal data under article 6(1)(e) of the UK General Data Protection Regulation (GDPR). We are allowed to process personal data when we need to carry out tasks in the public interest as a regulator.
If you choose to use our pre-application advice service for environmental permits, the reason we collect your personal data is to give you advice to help you get your permit application right first time. Article 6(1)(a) of the UK GDPR allows us, with your consent, to process your personal data.
You have the right to withdraw consent at any time and ask us to delete the information you have given to us for the pre-application service. We will delete your information within one month. You can ask for this by contacting the person dealing with your application or the Environment Agency’s general enquiries.
What personal data we collect
We collect the personal data asked for during the application process for the service you are applying for.
Our purpose for collecting personal data is to assess and process your application. If you do not give us this information, we cannot give you a permit.
If you’re applying for a permit online, we also collect your internet protocol (IP) address and details of which web browser you use.
When you use the environmental permit application service, we put small files (known as ‘cookies’) onto your computer. The cookies used on this service are not used to identify you personally.
If you’re responsible for billing and invoicing, we collect your payment details.
We may process your personal data in any questions or feedback you send to us, including your email address if you contact us.
Your responsibility with other people’s personal data
If you’ve included personal data about other people on your application, you must tell them. You must provide them with a copy of this privacy notice so that they know how their personal data will be used.
What we do with your personal data
We use your personal data to help us:
- give you pre-application advice
- make a decision on your application
- give you an environmental permit
- contact you about your application or permit
- take payment
- check you are complying with your permit
- carry out potential enforcement action
We may use your email address to contact you for user research to improve our service. You do not have to take part in the research.
When we have all the information we need to start assessing your application, we will tell you that the application is ‘duly made’. We put all the information (except dates of birth) in a duly made application on a public register.
When we consult on your application, we will tell you. And we will publish the information (except dates of birth) online during the consultation period on our consultation website or our environmental permitting applications pages on GOV.UK. These websites are available to everyone, so your information may be seen outside the UK.
The information that you give when you use our pre-application service is not put on the public register.
We use your IP address as part of monitoring use of our website and do not use it to identify you.
We do not use your personal data to make an automated decision or for automated profiling.
Where your personal data is stored, transferred and processed
We store, transfer and process your personal data on our servers in the UK and we:
- transfer data through Amazon Web Services servers in Ireland
- store data on Microsoft Azure servers in Ireland
Your data will not be transferred outside the European Economic Area. We do not store payment details.
How long we keep your personal data
We keep your personal data while your permit is in use and for 6 or 7 years after you cancel (surrender) your permit, depending on your permit. If the permit is for a landfill site, we keep the data for 10 years after surrender.
We delete your IP address from our records after 90 days.
Removing personal data from the public register
We will remove your personal data from the public register if:
- you withdraw your application
- we refuse your application and the time limit for appealing the decision has expired or an appeal is dismissed
- the information is no longer relevant for public participation purposes under the Environmental Permitting Regulations
We update the public register every month.
Removing other information you give us from the public register
Commercial confidentiality
If you can show that any information you send us is commercially or industrially confidential, we’ll consider removing that information from the public register.
National security
If you think that the information you’ll send us may be a threat to national security, you must contact the Secretary of State before you apply. You must still send us that information with your application. We will not include this information on the public register unless the Secretary of State decides it can be included.
See the section of the environmental permitting guidance on national security.