Data protection law in the UK and EU changed on the 25th May 2018. This notice sets out your rights as an individual in how the City of London Police process your personal data under the new law.
This notice comes into effect on 25th May 2018 and was last updated in May 2018.
As an EU member state the UK must legislate to meet the EU Regulation 2016/679 (more commonly referred to as the General Data Protection Regulation) as well as the EU Directive 2016/680 (Law Enforcement Directive). The UK government has enshrined both the regulation and the directive into the UK Data Protection Act 2018, which is formed of seven parts, referred to here in the Act.
Under the Act the City of London Police recognises its obligations and responsibilities as defined within Parts 2 (general processing) and 3 (law enforcement processing).
This Privacy Notice explains how and why the City of London Police process your personal data, under Part 2, general data and Part 3 law enforcement data, and the steps we take to keep your information safe. It also describes your rights in regard to your personal information and how to complain to the Information Commissioner if you have concerns as to how we have handled your data.
The City of London Police is the territorial police force responsible for policing the City of London and has the national operational responsibility of operating the National Cyber Crime Reporting Centre, Action Fraud.
The Commissioner of Police for the City of London is the Data Controller and as such has overall responsibility for the lawful processing of all personal data processed by the force. He is assisted by the Data Protection Officer who provides advice and guidance in relation to data protection law.
Our data protection registration number is Z4894582 which is renewed each year.
To ensure that we process your personal information fairly and lawfully, this notice informs you:
Data Controller
The Commissioner of Police for the City of London
City of London Police HQ
PO Box 36451
London, EC2M 4WN
Data Protection Officer
Director of Information
City of London Police IMS
PO Box 36451
London,
EC2M 4WN
The City of London Police recognises the importance of protecting personal and sensitive information in all that we do, and takes care to meet our legal duties. The City of London Police puts in place all reasonable technical, security and procedural controls required to protect your personal information for the whole of its life, in whatever format we hold that information.
Your privacy is protected by law, which says that we can use your personal information only if we have a proper reason to do so. This includes sharing it outside of the City of London Police. The reasons why we may process your personal information are:
In order to carry out the purposes described above the City of London Police may obtain, use and disclose personal information relating to a wide variety of individuals including:
Our staff, officers, volunteers, agents, temporary and casual workers; Suppliers, Complainants, correspondents, litigants and enquirers; Relatives, guardians and associates of the individual concerned; Advisers, consultants and other professional experts; Victims (current, past and potential); Former and potential members of staff, pensioners and beneficiaries.
The type of personal information we hold will vary depending upon the reason you have had contact with us but it may include:
Your name and address; Fingerprints, DNA or photograph; Family, lifestyle and social circumstances; Education and training details; Employment details; Financial details; Goods or services provided; Racial or ethnic origin; Political opinions; Religious or other beliefs of a similar nature; Trade union membership; Physical or mental health or condition; Sexual life; Offences and alleged offences; Criminal proceedings, outcomes and sentences; Sound and visual images; References to manual records or files; Information relating to safety and health; Complaint, incident, civil litigation and accident details
We will use the minimum amount of personal information necessary to fulfil a particular purpose. Your personal information may be held on a computer system, in a paper record such as in a physical file or a photograph.
To carry out the purposes we have described we may obtain personal information from a wide variety of sources, including:
HM Revenue and Customs; Legal representatives; Solicitors; Courts; Voluntary sector organisations; Independent Office for Police Conduct; Her Majesty’s Inspectorate of Constabulary; Auditors; Police and Crime Commissioners; Central government, governmental agencies and departments; Relatives, guardians or other persons associated with an individual; Current, past or prospective employers of the individual; Healthcare, social and welfare advisers or practitioners; Education, training establishments and examining bodies; Business associates and other professional advisors; Employees, officers and agents of The City of London Police; Suppliers, providers of goods or services; Persons making an enquiry or complaint; Financial organisations and advisors; Credit reference agencies; Survey and research organisations; Trade union, staff associations and professional bodies; Local government; Voluntary and charitable organisations; Ombudsmen and regulatory authorities; The media.
To carry out the purposes described the City of London Police may disclose personal information to a wide variety of recipients including those from whom personal data is obtained. This may include, but is not limited to:
Disclosures of personal information are made on a case-by-case basis, only relevant information, specific to the purpose and circumstances, will be disclosed and with necessary controls in place.
The City of London Police will also disclose personal information to other bodies or individuals when required to do so, this could be under an act of legislation, by a rule of law, or by court order. This may include, but is not limited to:
The City of London Police may also disclose personal information on a discretionary basis for the purpose of, and in connection with, any legal proceedings or for obtaining legal advice.
The City of London Police keeps your personal information as long as is necessary for the particular purpose or purposes for which it is held.
Records that contain your personal information processed for “general data” purposes will be managed in accordance with the Forces Retention Schedule.
The processing of data for law enforcement purposes can only be undertaken by an organisation which is considered a competent authority and has to be listed within Schedule 7 of the Act.
Law enforcement purposes are:
“the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
The City of London Police has a statutory duty to uphold the law, prevent crime, bring offenders to justice and protect the public. To do this it is necessary for us to process your personal information under the lawful basis of ‘public task’ and ‘official authority’. This means we process your personal information for carrying out tasks that are laid down in law and collectively described as the administration of justice.
The Administration of Justice, includes the prevention and detection of crime; apprehension and prosecution of offenders; protecting life and property; preserving order; maintenance of law and order; assisting the public in accordance with force policies and procedures; national security; defending civil proceedings and any duty or responsibility of the police arising from common or statute law.
In order to carry out the purposes described above, The City of London Police may obtain, use and disclose personal information relating to a wide variety of individuals including but not limited to:
In order to carry out our statutory responsibility we will process varying types of personal data, this includes:
Your name and address; Employment details; Financial details; Racial or ethnic origin; Political opinions; Religious or other beliefs of a similar nature; Physical or mental health condition; Sexual life; Offences and alleged offences; Criminal proceedings, Outcomes and sentences; Cautions; Physical identifiers including DNA, fingerprints, and other genetic samples; Photograph, Sound and visual images; Criminal Intelligence; Information relating to safety; Incidents, and Accident details
We will use only the minimum amount of personal information necessary to fulfil a particular purpose or purposes. Personal information can be information that is held on a computer, in a paper record such as a file or images, but it can also include other types of electronically held information such as CCTV images.
The data we process for law enforcement purposes come from a wide variety of sources, including;
Other law enforcement agencies; HM Revenue and Customs; International law enforcement agencies and bodies; Licensing authorities; Legal representatives; Prosecuting authorities; Solicitors; Courts; Prisons and Young Offender Institutions; Security companies; Partner agencies involved in crime and disorder strategies; Private sector organisations working with the police in anti-crime strategies; Voluntary sector organisations; Approved organisations and people working with the police; Independent Office for Police Conduct; Her Majesty’s Inspectorate of Constabulary; Governmental agencies and departments; Emergency services such as the Fire Brigade, National Health Service or Ambulance; Persons arrested; Victims; Witnesses; Relatives, guardians or other persons associated with the individual; The City of London Police CCTV systems; Body worn video and from correspondence sent to us.
There may be times where we obtain personal information from sources such as other police services and our own police systems such as our local information system.
To enable The City of London Police to meet their statutory duty we may be required to share your data with other organisations that process data for a similar reason, in the UK and/or overseas, or in order to keep people safe. These organisations include, but not limited to
Disclosures of personal information is considered on a case-by-case basis, using only the personal information appropriate to a specific purpose and circumstances, and with necessary controls in place.
Some of the bodies or individuals to which we may disclose personal information are situated outside of the European Union - some of which do not have laws that protect data protection rights as extensively as in the United Kingdom. If we do transfer personal data to such territories, we undertake to ensure that there are appropriate safeguards in place to certify that it is adequately protected as required by the legislation.
The City of London Police will also disclose personal information to other bodies or individuals when required to do so, or under an act of legislation, a rule of law, and by court order. This may include, but is not limited to:
The City of London Police keeps your personal information as long as is necessary for the particular purpose or purposes for which it is held. Personal information which is placed on the Police National Computer is retained, reviewed and deleted in accordance with the Retention Guidelines for Nominal Records on the Police National Computer
Other records that contain your personal information and which was processed for law enforcement purposes are retained in accordance with the College of Policing guidance on the Management of Police Information (MoPI), and the City of London Police’s Record Retention Policy.
A key area of change in the new Data Protection Act relates to individuals’ rights, the law refreshers existing rights by clarifying and extending them and introduces new rights.
However your information rights will be dependent on the reason why and howthe data was collected and why it is being used.
In order to exercise your rights under data protection law, we will need toverify your identity for your security.
You can contact us by emailing data.protection@cityoflondon.police.uk, writing to Data Protection Officer, IMS, City of London Police, PO Box 36451, London EC2M 4WN.
This is commonly known as subject access and is the right which allows you access to your personal data and supplementary information. You can make a subject access request by using the contact information above. Once we have received your request we will respond within 1 month.
This places an obligation upon the City of London Police to tell you how we obtain your personal information and describe how we will use, retain, store and who we may share it with.
We have written this Privacy Notice to explain how we will use your personal information and tell you what your rights are under the legislation
You are entitled to have personal data rectified if it is inaccurate or incomplete.
You have the right to request the deletion or removal of your personal data and/or the right to ‘block’ or restrict the processing of your personal data where there is no compelling reason for its continued processing.
If you feel that we should no longer be using your personal information, or that we are illegally using your data, you can request that we erase the personal information we hold on you. When we receive your request, we will confirm whether the personal information has been deleted or tell you the reason why it cannot be deleted. There may be legal reasons why we need to keep your personal information.
If you want to request that we erase your personal information, please contact us using the details above.
Automated individual decision making and profiling is a decision made by automated means without any human involvement.
The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services. You have the right to get copies of your personal information from us in a format that can be easily re-used.
Individuals have the right to object to:
If you are not satisfied with our response or believe that we are not processing your personal information in accordance with the law, you can complain to the Information Commissioner's Office (ICO) by emailing casework@ico.org.uk or telephoning 0303 123 1113. Additional contact methods are detailed on their website: https://ico.org.uk/global/contact-us
We regularly review our privacy notice. We will publish any updates on the City of London Police website. You can request a copy of our privacy notice by using the details above.
If we plan to use your personal information for a new purpose we will update our privacy notice and communicate the changes before we start any new processing.