UK GDPR privacy notices - Electoral Services Privacy Notice

Introduction

Electoral Services have provided this privacy notice to help you understand how we collect, use and protect your information whilst we register your right to vote.

The document below will describe how we may collect and process your personal information.

The purpose of this document is to clearly acknowledge the council’s responsibilities in relation to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Definitions

Personal data means any information related to an identified or identifiable natural (living) person (‘data subject’) i.e. a person that can be directly or indirectly identified by reference to a name, ID reference number, email address, location data, or physical, physiological, genetic, mental, economic, cultural or societal identifier.

Special personal data, previously known as ‘sensitive personal data’, relates to race, ethnic origin, politics, religion, trade union membership, genetic data, biometric data, health, sex life or sexual orientation. Records of criminal personal data must also be treated in a similar way.

Data Controller determines the purposes and means of processing personal data.

Data Processor is responsible for any operation which is performed on personal data on behalf of the controller, e.g. collection, recording, organisation, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or making available, alignment or combination, restriction, erasure or destruction.

Third Party is someone/somebody who is not the Data Controller, the Data Processor or the Data Subject.

Who we are

To be eligible to vote in any election or referendum your name must appear on the register of electors. We have a duty to maintain a complete and accurate register throughout the year and will only collect the personal data we need from you in order to do this.

The Electoral Registration Officer is a data controller and collects the personal data you provide for the purpose of registering your right to vote. This means we are responsible for deciding how we can use your information, however, the Electoral Registration Officer has to comply with strict legislation (Electoral Registration and Administration Act 2013, Representation of the People Regulations 2001 and Electoral Registration (Disclosure of Electoral Registers) Regulations 2013) which dictates how we use your information. If you want more information regarding the services delivered, please go to our website.

The council regards lawful and correct treatment of personal information as critical to their successful operations, maintaining confidence between the council and those with whom they carry out business. The council will ensure that they treat personal information correctly in accordance with the law.

The council is required to keep a record of your personal data in order to comply with the Electoral Registration and Administration Act 2013, Representation of the People Regulations 2001 and Electoral Registration (Disclosure of Electoral Registers) Regulations 2013. The Data Protection Officer for ESC is Siobhan Martin, Head of Internal Audit, and can be contacted at dataprotection@eastsuffolk.gov.uk

The Data Protection Officer for ESC is Siobhan Martin, Head of Internal Audit, and can be contacted at dataprotection@eastsuffolk.gov.uk.

How the law protects you

UK GDPR says that we are allowed to use personal information only if we have a proper reason to do so. More information on how the law protects you can be found on the East Suffolk website.

Our responsibilities

UK GDPR provides us with main responsibilities for processing personal data. All personal information provided by you is held securely and in confidence by us in our computerised and other records. When we process your personal information, we do so in compliance with UK GDPR. For further information on our responsibilities, please see our website.

Your rights

The UK GDPR and DPA 2018 provide you with the following rights:

• The right to be informed: You have the right to be informed about the collection and use of your personal data, and this is outlined in this privacy notice.
• The right of access: You have the right to request access to the personal data we may hold about you. This is undertaken using a Subject Access Request.
• The right to rectification: You have the right to request that inaccurate personal data we hold is rectified.
• The right to erasure: In certain circumstances, you have ‘the right to be forgotten’ and have your personal data erased.
• The right to restrict processing: In certain circumstances, you have the right to request the restriction or suppression of your personal data.
• The right to data portability: In certain circumstances, you have the right to request to obtain your own personal data for your own use or to give to other organisations.
• The right to object: In certain circumstances, you have the right to object to your personal data being collated, stored and processed.
• Rights in relation to automated decision making and profiling: You have the right to request that we do not make our decisions based on solely an automated process, and you can object to an automated decision and ask that a person reviews it in certain circumstances.
• The right to withdraw consent: In our discretionary service provisions, you have the right to withdraw your consent at any time.
• The right to complain: You have the right to complain through our complaints procedure, and then to the Information Commissioner. Any requests in relation to your rights with regard to the personal data we hold should be made verbally or in writing to the Data Protection Officer. For further information on your rights, please see the ICO website.

Your responsibilities

You are responsible for making sure you give us accurate and up to date information, and to let us know if any personal information we hold is incorrect.

When do we collect information about you?

Personal details are supplied directly by you when making your application to be added to the electoral register. These details are provided by law for electoral registration purposes.

Details are also gathered from other council departments to identify potential electors. This includes (but is not limited to) Council Tax and Housing.

What information do we maintain?

The information about you which we will maintain will include:

• Your name, address, date of birth and nationality
• Unique identifiers such as your National Insurance number
• Your Signature for the purposes of verifying your absent vote if you have one in place
• Your previous address or details of your redirected address if provided
• The other occupants at your property
• Scanned application forms and any documentary evidence provided
• Dates and copies of any letters of correspondence
• Your age category - If you are 16 or 17 years old or over 76
• Whether you have chosen to opt out of the open version of the register
• Notes about any relevant circumstances that you have told us
• If provided, your email address and contact telephone number(s)

How do we use your information?

We do this as a legal obligation to comply with the Electoral Registration and Administration Act 2013 and Representation of the People Regulations 2001. This ensures you are registered to vote in any election or referendum for which you are eligible. The law makes it compulsory to provide information to an Electoral Registration Officer for inclusion in the full register.

We keep records about potential and actual electors, voters, citizens, candidates and their agents, and staff employed to deliver elections. This data may be kept electronically or in some instances a hard copy may be retained.

We will not use your personal data for other purposes other than for what it was collated unless we have obtained your consent or for other lawful purposes (e.g. detection and prevention of fraud). We do not use automated decision making.

How long do we keep your information?

We will retain any documents that contain your personal information for only as long as it takes for your registration application to be determined following which we securely dispose of the documents.

We will hold your electronic information in accordance with our legal obligations Page | 4 and in line with our statutory retention periods.

Data sharing

The information you provide is held in electoral registers which are managed by electoral registration officers who, using information received, maintain two registers:

• The Full Electoral Register
• The Open (Edited) Register

The full register is published once a year and is updated every month and can only be supplied to the following people and organisations:

• British Library
• UK Statistics Authority
• Electoral Commission
• Boundary Commission for England
• Jury Summoning Bureau
• Elected representatives (MP, MEPS, Local Councillors)
• Police and Crime Commissioner
• Candidates standing for elections
• Local and National Political Parties
• The council
• Parish and community councils
• Police Forces, National Crime Agency
• Public Library or local authority archive services
• Government departments or bodies
• Credit Reference Agencies
• National Fraud Initiative
• Electoral Registration and Returning Officers

We also have to disclose (share) your information with our Software providers and contracted printers. It is a crime for anyone who has a copy of the full register to pass information from this register on to others, if they do not have a lawful reason to see it.

Anyone can inspect the full electoral register:

• Inspection of the register is by appointment and under supervision
• You can take extracts from the register, but only by hand written notes
• Information taken must not be used for direct marketing purposes, in accordance with data protection legislation, unless it has been published in the open version of the register
• Anyone who fails to observe these conditions is committing a criminal offence and will be charged a penalty of up to £5,000

The open register is not used for elections or referendums. It is updated and published every month and can be sold to any person, organisation or company for a wide range of purposes. It is used by businesses and charities for checking names and address details; users of the register include direct marketing firms and also online directory firms.

You can choose whether or not to have your personal details included in the open version of the register; however, they will be included unless you ask for them to be removed. Removing your details from the open register does not affect your right to vote.

• To verify your identity, the data you provide us will be processed by the Individual Electoral Registration Digital Service managed by the Cabinet Office. As part of this process your data will be shared with the Department of Work and Pensions and the Cabinet Office suppliers that are data processors for the Individual Electoral Registration Digital Service. You can find more information about this here: https://www.registertovote.service.gov.uk/register-to-vote/privacy

To ensure we delivery our statutory obligations, we will share information, where applicable, with the Suffolk Office of Data & Analytics for analytical purposes to support us in meeting our statutory functions.

Transferring your information overseas

Currently, we do not transfer any personal information outside of the European Economic Area (EEA).

National Fraud Initiative (NFI)

We may share information provided to us with other bodies responsible for auditing, or administering public funds, or where undertaking a public function, in order to prevent and detect fraud. For further information, see the East Suffolk website.