This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the General Data Protection Regulation (GDPR).
Data Controller: Boundary Commission for Wales
Address: Hastings House, Fitzalan Court, Cardiff, CF24 0BL
Email: enquiries@boundaries.wales
Data Protection Officer: Stephen Jones
Address: Data Protection Officer, Cabinet Office, 70 Whitehall, London, SW1A 2AS
Email: dpo@cabinetoffice.gov.uk
Introduction
The Boundary Commission for Wales (the Commission) is an independent and impartial public body, which reviews all UK Parliament constituency boundaries in Wales according to rules established by the Parliamentary Constituencies Act 1986 (as amended). There are separate Commissions to review UK Parliament constituencies in England, Scotland and Northern Ireland.
Why are you processing my personal information?
The Commission will be processing personal data for the following purposes:
- responding to public correspondence and enquiries, or proactively making data available about the Commission’s activities
- making contact with individuals to seek their views or to procure services
- responding to statutory freedom of information and data subject requests
- publishing information about gifts and hospitality in accordance with transparency duties
- carrying out statutory consultations as part of the Commission’s core duties. The Commission’s Review process is informed by public consultations – this is a statutory requirement under the Parliamentary Voting System and Constituencies Act 2011. The Commission is committed to respecting the personal data that is held as part of the Review process.
- Reviewing electoral registration data for the purposes of the Commission’s statutory purposes
What categories of personal data are you processing?
We will process the following personal data: your name, your address, your phone/fax number, your email address, your job title, your employer, your opinions, details of donors and any gifts or hospitality received, your Country, and your preferred language for communications, English or Welsh.
The Commission does not require or request any of the defined special categories of data defined under GDPR. However, data on political affiliation or religious make up can sometimes be provided in consultation responses or in correspondence. We may also collect health data in relation to events we organise to make reasonable adjustments under the Equality Act 2010.
What is the lawful basis for processing my data?
In relation to responding to carrying out statutory consultations, or responding to freedom of information or data subject requests, it is necessary to comply with a legal obligation placed on us as the data controller.
In relation to all other data, processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case that is the Commission’s public tasks of operating the boundary review process, meeting obligations around propriety and accountability in exercising our public functions, the development of policy or the management of the organisation.
Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. Where individuals volunteer sensitive personal data, our legal basis for processing it is:
- It is necessary for the purposes of performing or exercising our obligations or rights as the controller, or your obligations or rights as the data subject, under employment law.
- it is necessary for reasons of substantial public interest for the exercise of a function of function conferred on a person by an enactment.
Where do you get my personal data from?
The Commission holds personal data collected through the following:
i. Through responses to its public consultations (including applications to attend, and oral representations made, at public hearings);
ii. Through personal correspondence sent to the Commission;
iii. Through requests to be included on Commission mailing lists; and
iv. In relation to Commissioners and the Secretariat team.
Where we receive electoral roll data we specifically request that it does not contain any personal information. If a local authority did send us those details they would immediately be deleted.
Recipients
As your personal data will be stored on our IT infrastructure it will also be shared with our data processors who provide email, and document management and storage services.
Do you share my personal data with anyone else?
The Commission will not share your personal data with other organisations. However, the Commission will publish consultation responses in hard copy and in electronic format on the Commission’s website with all personal information redacted apart from the name of the respondent and their locale.
Do you transfer my personal data to other countries?
We will not share your personal data with other countries. However, the Commission will publish consultation responses in hard copy and in electronic format on the Commission’s website with all personal information redacted apart from the name of the respondent and their locale. The Commission’s website is accessible in other countries.
How long do you keep my personal data?
Personal data is held for the duration of the Review. Once ended, all files relating to the Review will be subject to scrutiny by the Cabinet Office in line with requirements placed on government bodies and their agencies under the Public Records Act 1958.
Personal information is held for the purposes of contacting individuals in particular roles, and once they leave those roles the information will be updated and or deleted. This should take place at least once a year.
Personal information in correspondence, freedom of Information requests, or data subject request will usually be deleted 3 calendar years after the correspondence or case is closed or concluded. Public correspondence may however be kept if it is sufficiently significant that it should be retained for the historical record, or for other legitimate business reasons.
Gift and hospitality data will be retained for 20 years.
The Commission do not undertake any automated decision making or profiling using your personal data.
What rights do I have?
You have the right to obtain confirmation that your data is being processed, and access to your personal data. You may request a copy of any personal data the Commission hold on you, at any time, by contacting the Commission as set out above. The Commission will aim to respond to your request within 20 working days.
You are entitled to have personal data rectified if it is inaccurate or incomplete.
You have a right to have personal data erased and to prevent processing, in specific circumstances.
You have the right to ‘block’ or suppress processing of personal data, in specific circumstances.
You have the right to data portability, in specific circumstance.
You have the right to object to the processing, in specific circumstance.
You have rights in relation to automated decision making and profiling.
How do I complain if I am not happy?
If you are unhappy with how any aspect of this privacy notice, or how your personal information is being processed, please contact the Boundary Commission at the details above.
You may also contact the Commission’s Data Protection Officer at the details above. The Data Protection Officer provides independent advice and monitoring of the Commission’s use of personal information.
If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Email: casework@ico.org.uk
https://ico.org.uk/global/contact-us/
