Privacy Information Notice – Professional Standards Directorate

Privacy Information Notice – Professional Standards Directorate of West Yorkshire Police

This Privacy Notice explains how and why the Professional Standards Directorate of West Yorkshire Police, process your personal data and the steps we take to keep your information safe. It also describes your rights in regard to your personal information and how to complain to the Information Commissioner if you have concerns as to how we have handled your data.

 

Who we are

West Yorkshire Police is the territorial police force responsible for policing the areas of West Yorkshire in North East England.

 

The Professional Standards Directorate of West Yorkshire Police

The Professional Standards Directorate of West Yorkshire Police encompasses the following departments within West Yorkshire Police – Professional Standards Directorate (Service Recovery Team, PSD Helpdesk, PSD Reactive, PSD Intelligence and Counter Corruption Unit and Force Vetting Unit).

The Chief Constable - John Robins of West Yorkshire Police is the Data Controller of all personal data processed by the Professional Standards Directorate and as such has overall responsibility for the lawful processing of all personal data processed by the Force. He is assisted by the Data Protection Officer - Claire Vickers-Pearson, who provides advice and guidance in relation to data protection law. The Data Protection SPOC for the Professional Standard Directorate is Supt Tanya Wilkins who supports the DPO in providing advice and guidance in relation to data protection law specifically to the Directorate. Our data protection registration number is Z4894366 which is renewed annually.

If you have any questions about how we use your personal information, our DPO can be reached by the Information Management email at [email protected], or by post at Data Protection Officer, PO BOX 9, Laburnum Road, Wakefield, WF1 3QP.

 

Purpose of processing Personal Information, considered as General Data

Most of the personal information we process is provided to us directly by you for one of the following reasons:

  • You have made a complaint
  • You have made an enquiry to us
  • You are representing your organisation
  • To assist us in meeting our “Legal Obligations” as an employer e.g. where the processing is necessary for us to comply with complaint and conduct legislation.
    (Police Reform Act 2002, Police Complaints and Misconduct Regulations 2012, Police Conduct Regulations 2015, Police Conduct, Complaints, Misconduct and Appeal Amendment Regulations 2017 and Police Barred List and Police Advisory List Regulations 2017)
  • To manage “Contracts” with those who are employed by West Yorkshire Police where the processing is necessary for a contract that we have with you or because you have asked us to take specific steps before entering into a contract with you commonly known as Police Vetting.

We also receive personal information indirectly, in the following scenarios:

  • We have contacted an organisation about a complaint you have made and it gives us your personal information in its response
  • A complainant refers to you in their complaint correspondence
  • Whistleblowers include information about you in their reporting to us
  • We have seized personal information as part of an investigation
  • From other regulators or law enforcement bodies

If it is not disproportionate or prejudicial, we’ll contact you to let you know we are processing your personal information. ​

 

Purpose of processing Personal Information, considered as Law Enforcement Data

We may process personal information provided to us directly by you and personal information provided to us indirectly about you for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.


What type of Personal Information do we process?

The type of personal information we hold will vary depending upon the reason you have had contact with us but it may include:
 
Your name and address; date of birth; Email address, telephone number; religious or other beliefs of a similar nature; ethnicity data, criminal offence and conviction data.
 
We will use the minimum amount of personal information necessary to fulfil a particular purpose. Your personal information may be held on a computer system or in a paper record such as in a physical file.

 

Where do we get the Personal Information from?

To carry out the purposes we have described we may obtain personal information from a wide variety of sources, including:
 
Individuals themselves; Current, past or prospective employers of the individual; Other Districts or Directorates within West Yorkshire Police; Persons making an enquiry or complaint. Legal representatives; Solicitors; Courts; Independent Office for Police Conduct; Police and Crime Commissioners; Relatives, Healthcare, social and welfare advisers or practitioners; Employees, officers and agents of West Yorkshire Police; Financial organisations and advisors; Trade union, staff associations and professional bodies; Ombudsmen and regulatory authorities.

 
How do we handle your Personal Information?

We handle personal information according to the requirements of Part 3 and Part 2 of the UK Data Protection Act 2018, which applies the EU’s General Data Protection Regulation, GDPR, standards for the processing of data for the “Law Enforcement Purpose” and  “General Purposes”. Your personal information, held on our systems and in our files, is secure and is accessed by our staff and police officers.
 

How do we keep your Personal Information safe?

The Professional Standards Directorate of West Yorkshire Police takes the security of all personal information under our control very seriously. We will comply with the relevant parts of the legislation relating to security, and seek to comply with the College of Policing Information Assurance authorised practice, and relevant parts of the ISO27001 Information Security Standard.
 
We will ensure that appropriate policy, training, technical and procedural measures are in place. These will include, but are not limited to, ensuring our buildings and manual filings systems are secure and protected by adequate physical means. The areas restricted to our police officers, staff and partner agencies staff is only accessible by those holding the appropriate identification, and have legitimate reasons for entry. We carry out audits of our buildings security to ensure they are secure.
 
Our systems meet appropriate industry and government security standards.
 
We carry out regular audits and inspections, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so.
 
Our standard operating procedures and policies contain strict guidelines as to what use may be made of any personal information contained within them. These procedures are reviewed regularly to ensure our security of information is kept up-to-date.

 

Your data protection rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

  • Right to be Informed - This places an obligation upon The Professional Standards Directorate of West Yorkshire Police to tell you how we obtain your personal information and describe how we will use, retain, store and who we may share it with. We have written this Privacy Notice to explain how we will use your personal information and tell you what your rights are under the legislation.
     
  • Right to Request Rectification - You are entitled to have personal data rectified if it is inaccurate or incomplete. This right always applies.
     
  • Right to Erasure - The right to erasure is also known as ‘the right to be forgotten’. This right enables you to request the deletion or removal of personal data where there is no compelling reason for its continued processing. This right only applies in certain circumstances.
     
  • Right to Restrict Processing - Individuals have a right to ‘block’ or suppress processing of personal data. When processing is restricted, organisations are permitted to store the personal data, but not further process it. You have the right to ask us to restrict the processing of your information in certain circumstances.
     
  • Right to Data Portability - The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services. This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated
     
  • Right to Object -You have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests.
     
  • Rights Relating to Automated Decision Making - Automated individual decision making and profiling is a decision made by automated means without any human involvement. West Yorkshire Police Professional Standards Directorate does not process your personal data using automated decision-making, including profiling.
     
  • Right of Access - You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.

 

Children

We do not provide services directly to children or proactively collect their personal information. However, we are sometimes given information about children while handling a complaint or conducting an investigation. The information in the relevant parts of this notice applies to children as well as adults.

 

Single point of contact 

We may provide a single point of contact if you or we (or both) believe it will help to create a better outcome for all concerned, e.g. you have made multiple complaints to us.

The lawful basis we rely on to process your personal data for this purpose is:

  • GDPR 2018 Article 6(1)(e)

 

Restricted contact 

We may impose a restriction on your access to our services if it’s necessary to protect our staff from unacceptable behaviour.

The lawful basis we rely on to process your personal data for this purpose is:

  • GDPR 2018 Article 6(1)(e)

We will explain to you the restriction we have applied and why it is necessary. We will record the restriction for administration purposes, so relevant staff members know the restriction is in place. This will include your name, contact details and a description of why we have imposed a restriction. We will review the restriction periodically.

Where we restrict contact or appoint a SPOC you have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.

 

Contacting us

By telephone

We do not record calls except for calls into the PSD Helpdesk.

 We might make notes to help us answer your query.

Other PSD staff may also listen in during your call for training or quality assurance purposes.

By email

We monitor any emails sent to us, including file attachments, for viruses or malicious software. You must ensure that any email you send is within the bounds of the law.

Visitors to our office

You will be given a visitor badge.

You must wear a pass throughout your visit.

We ask all visitors to sign in and out at reception.

Closed-circuit television (CCTV) operates outside the building for security purposes.

The purpose for processing this information is for security and safety reasons. The legal basis we rely on to process your personal data is article GDPR 2018 Article 6(1)(f), which allows us to process personal data when its necessary for the purposes of our legitimate interests. 

Making an enquiry to PSD

When you contact us to make an enquiry, we collect information, including your personal data, so that we can respond to it.

The legal basis we rely on to process your personal data is:

  • GDPR 2018 Article 6(1)(e) which allows us to process personal data when this is necessary to perform our public tasks.
  • GDPR 2018 Article 9(2)(g) of the GDPR, which also relates to our public task.
  • Schedule 1 part 2(6) of the DPA2018 which relates to statutory and government purposes.

We need enough information from you to answer your enquiry.

If you contact us via email or post, we will need a return address for response.

We will set up a case file on our case management system to record your enquiry and so we can assign the enquiry to be dealt with. We’ll also keep a record of our response. We use the information supplied to us to deal with the enquiry and any subsequent issues that may arise, and to check on the level of service we provide.

You have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.

We do not use data processors.

Making a professional complaint to PSD

Our purpose is to investigate and take action in line with our statutory duties under:

  • Police Reform Act 2002
  • Police Complaints and Misconduct Regulations 2012
  • Police Conduct Regulations 2015
  • Police Conduct, Complaints, Misconduct and Appeal Amendment Regulations 2017
  • Police Barred List and Police Advisory List Regulations 2017

The legal basis we rely on to process your personal data is:

  • article 6(1)(e) of the GDPR, which allows us to process personal data when this is necessary to perform our public tasks.
  • article 9(2)(g) of the GDPR, which also relates to our public task and the safeguarding of your fundamental rights
  • Schedule 1 part 2(6) of the DPA2018 which relates to statutory and government purposes.

We need information from you to investigate your complaint properly, so our complaint forms are designed to prompt you to give us everything we need to understand what’s happened.

When we receive a complaint from you, we’ll set up a case file. This normally includes your contact details and any other information you have given us about the other parties in your complaint.

We need to know the details of your complaint so we can investigate it and fulfil our public tasks based in law.

We will use your personal information to investigate your complaint and check on our level of service.

No third parties have access to your personal information unless the law allows them to do so.

If you have made a complaint about an organisation, we usually have to disclose your identity to them. This is so we can clearly explain to them what you think has gone wrong and if necessary advise them how to put it right. This also means we may receive information about you from them.

If you don’t want information that identifies you to be shared with the organisation you want to complain about, we’ll try to respect that. However, it is not always possible to handle a complaint on an anonymous basis.

If you are acting on behalf of someone making a complaint, we’ll ask for information to satisfy us of your identity and if relevant, ask for information to show you have authority to act on someone else’s behalf.

You have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.

We do not use data processors.

Investigation for Law Enforcement Purpose

As part of our statutory functions, we investigate and prosecute individuals for alleged criminal offences.

West Yorkshire Police are a competent authority for the purpose of DPA 2018 Part 3 which applies to the processing of personal data by such authorities for the law enforcement purposes.

These purposes are set out at DPA 2018 Section 31 and are the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, which might include the safeguarding against and the prevention of threats to public security. Our processing is done because it is necessary for the performance of a task relating to one of these purposes.

We process personal data for the purposes of law enforcement in the following three areas:

  • Criminal investigations
  • Intelligence


Our processing can also include sensitive processing which means processing special category data for law enforcement purposes. Where this is the case we rely, provided the processing is strictly necessary for the law enforcement purposes, on a condition set out in Schedule 8 of the DPA 2018.

Our Safeguards Policy explains about our processing (including sensitive processing)

When we investigate an alleged criminal offence, we gather information and evidence which might include information about victims, suspects, witnesses and other individuals relevant to the circumstances and events. 

In our role as a Competent Authority, we need to establish whether offences have been committed so that we can take legal action if appropriate. So we’ll gather information relevant to our investigation which might include information about you. 

We use your personal information for the purposes of our investigation and, and for prosecution purposes if appropriate.

In some circumstances we may share your personal information with law enforcement and other agencies during an investigation. We may also share it with others such as expert witnesses.

If we are considering taking legal action, we’ll share this information with our external legal counsel, the courts and any co-defendants and their legal representatives. Court cases are held in public and so personal data, including special category personal data, might be made public during the course of proceedings.

When we successfully prosecute someone, we may publish the convicted individual’s identity our website or distribute more widely to the media.

You have a right to access your personal data held by or for us. You also have a right to get inaccurate data rectified and incomplete data completed, and for your personal data to be erased in certain circumstances.

We will provide further information directly to data subjects in specific cases to enable them to exercise their rights. This might be in cases where we are processing your personal data that was collected without your knowledge.

We will not do this where doing so would be prejudicial to our investigation or for other reasons set out in s.44 (4) Data Protection Act 2018.

We sometimes use external service providers to carry out forensic analysis of evidence in cases which are investigated for law enforcement purposes and disciplinary proceedings.
Any oversees transfers are made in line with our data protection obligations.


 
How long will we keep your Personal Information for?

The Professional Standards Directorate of West Yorkshire Police keeps your personal information for as long as is necessary for the particular purpose or purposes for which it is held. Personal information including that which is held on various information systems owned by the Professional Standards Directorate, is retained, reviewed and deleted in accordance with West Yorkshire Police’s Force Retention Schedule.


 
Who do we share your Personal Information with?

We will not share your information with any third parties for the purposes of direct marketing.

We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct. 

In some circumstances we are legally obliged to share information. For example under a court order. We might also share information with other regulatory bodies in order to further their, or our, objectives. In any scenario, we’ll satisfy ourselves that we have a lawful basis on which to share the information and document our decision making and satisfy ourselves we have a legal basis on which to share the information.

 

How to make a complaint to the Information Commissioner

The Information Commissioner is the independent Authority responsible within the UK for ensuring we comply with data protection legislation. If you have a concern about how we have used your personal information or you believe you have been adversely affected by our handling of your data you may wish to contact them using the information below:
 

Information Commissioner Helpline 0303 123 1113
(Their normal opening hours are Monday to Friday, 9am to 5pm)

Information Commissioner Email [email protected]

Information Commissioners Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

 

 

Changes to our Privacy Notice

We keep our Privacy Notice under regular review. This Privacy Notice was last updated on the 28th November 2023.If we plan to use your personal information for a new purpose we will update our Privacy Notice and communicate the changes before we start any new processing.

Professional Standards Directorate
West Yorkshire Police Data Protection SPOC
Supt Tanya Wilkins