This notice explains how the College of Policing (‘the College’) obtains, holds, retains, processes and discloses information about people (their personal data), the steps we take to ensure that it is protected, and also describes the rights individuals have in regard to their personal data handled by the College of Policing.
The use and disclosure of personal data is governed in the United Kingdom by the
Data Protection Act 1998 (‘the Act’). The Chief Executive Officer is registered with the
Information Commissioner as a ‘Data Controller’ for the purposes of the Act [registration no: Z3458257]. As such he is obliged to ensure that the College of Policing handles all personal data in accordance with the Act.
The College takes that responsibility very seriously and takes great care to ensure that personal data is handled appropriately in order to secure and maintain individuals’ trust and confidence in the College.
1. Why do we handle personal data?
The College obtains, holds, uses and discloses personal data for three broad purposes:
A. Our Core Purposes – to -
B. The Policing Purpose – which include (but not limited to):
C. The provision of services to support our Core and Policing Purposes – which include (but not limited to):
The College will only use appropriate personal data that is necessary to fulfil a particular purpose or purposes. Personal data could be information which is held on a computer, in a paper record i.e. a file, as images, but it can also include other types of electronically held information i.e. CCTV images.
2. Whose personal data do we handle?
In order to carry out the purposes described under section 1 above the College of Policing may obtain, use and disclose (see section 7 below) personal data relating to a wide variety of individuals including the following:
3. What types of personal data do we handle?
In order to carry out the purposes described under section 1 above, the College of Policing may obtain, use and disclose (see section 7 below) personal data relating to or consisting of the following:
4. Where do we obtain personal data from?
In order to carry out the purposes described under section 1 above the College of Policing may obtain personal data from a wide variety of sources, including the following:
The College of Policing may also obtain personal data from other sources such as its own CCTV systems, training records, or correspondence
5. How do we handle personal data?
In order to achieve the purposes described under section 1 the College of Policing will handle personal data in accordance with the Act. In particular we will ensure that personal data is handled fairly and lawfully with appropriate justification.
We will strive to ensure that any personal data used by us or on our behalf is of the highest quality in terms of accuracy, relevance and adequacy. We will also ensure it is:
We will also respect individuals’ rights under the Act (see section 8 below).
6. How do we ensure the security of personal data?
The College of Policing takes the security of all personal data under our control very seriously. We will comply with the relevant parts of the Act relating to security, and seek to comply with the
National Police Chief’s Council (NPCC) Community Security Policy and relevant parts of the ISO27001 Information Security Standard.
We will ensure that appropriate policy, training, technical and procedural measures are in place, including audit and inspection, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so, and then under strict guidelines as to what use may be made of any personal data contained within them. These procedures are continuously managed and enhanced to ensure up-to-date security.
7. Who do we disclose personal data to?
In order to carry out the purposes described under section 1 above the College of Policing may disclose personal data to a wide variety of recipients in any part of the world, including those from whom personal data is obtained (as listed above). This may include the following:
Disclosures of personal data will be made on a case-by-case basis, using the personal data appropriate to a specific purpose and circumstances, and with necessary controls in place.
Some of the bodies or individuals to which we may disclose personal data are situated outside of the European Union - some of which do not have laws that protect data protection rights as extensively as in the United Kingdom. If we do transfer personal data to such territories, we undertake to ensure that there are appropriate safeguards in place to certify that it is adequately protected as required by the Act.
The College of Policing will also disclose personal data to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and by court order. This may include:
The College of Policing may also disclose personal data on a discretionary basis for the purpose of, and in connection with, any legal proceedings or for obtaining legal advice.
8. What are the rights of the individuals whose personal data is handled by the College?Individuals have various rights enshrined in the Act:
A. Subject Access
The most commonly exercised right is that used by individuals to obtain a copy, subject to exemptions, of their personal data processed by the College of Policing. Details of the application process, known as ‘Subject Access’.
Alternatively individuals may contact the College of Policing Data Protection Officer (see section 10 below).
B. Right to prevent processing likely to cause damage or distress
Section 10 of the Act an individual is entitled, in limited circumstances, to write to the College of Policing requiring that we do not handle their personal data in a manner that was causing or would be likely to cause unwarranted substantial damage or substantial distress to themselves or another person.
Requests under Section 10 must describe the personal data involved; describe the handling to which the individual objects; state that the handling was causing or would be likely to cause substantial damage or substantial distress to him/her or another; describe the damage or distress; state that the damage or distress was/would unwarranted; and give reasons why the handling was causing/would cause such distress and was/would be unwarranted.
All requests of this nature may be sent in writing to the College of Policing Data Protection Officer (see section 11 below). It is worth noting that the Act includes certain provisions which may mean in a particular case College of Policing can continue to handle the personal data as intended despite the objection.
C. Right to Prevent Processing for the Purposes of Direct Marketing
Section 11 of the Act and subject to certain exemptions, an individual has the right to request in writing, or via their marketing preference on their online membership profile, that the College stops within a reasonable time, or does not start, using their personal data for direct marketing purposes. This includes the communication by any means (e.g. mail, email, telephone, door-to-door canvassing) of any advertising or marketing material directed at particular individuals.
Any requests under Section 11 may be sent to the College of Policing Data Protection Officer (see section 10 below).D. Rights in relation to automated decision-taking
Although the College of Policing is unlikely to carry out any automated decision-taking that does not involve some human element, under
Section 12 of the Act and subject to certain exemptions, an individual has the right to require that the College of Policing ensures that no decision that would significantly affect them is taken by the College of Policing or on its behalf purely using automated decision-making software. The right has to be exercised in writing. If there is a human element involved in the decision-making the right does not apply.
Requests under Section 12 may be sent to the College of Policing Data Protection Officer (see section 11 below).
E. Right to take action for compensation if the individual suffers damage by any contravention of the Act by data controllers
Section 13 of the Act any individual who believes they have suffered damage and/or distress as a result of any contravention of the requirements of the Act may be entitled to compensation from the College of Policing where the force is unable to prove that it had taken such care as was reasonable in all the circumstances to comply with the relevant requirement.
Any claim for compensation arising from this provision may be sent to the College of Policing Data Protection Officer (see section 11 below).
F. Right to take action to rectify, block, erase or destroy inaccurate data
Section 14 of the Act an individual has the right to seek a court order for the rectification, blocking, erasure or destruction of their inaccurate personal data handled by the College. The right cannot be exercised directly to the College.
G. Right to request the Information Commissioner to assess a data controller’s processing
Section 42 of the Act any person can request the Information Commissioner to make an assessment if they believe that they are/have been adversely affected by the handling of personal data by the College of Policing. Such requests should be made direct to the Information Commissioner whose contact details can be found below.
Generally if individuals have any concerns regarding the way their personal data is handled by the College of Policing or the quality (accuracy, relevance, non-excessiveness etc.) of their personal data they are encouraged to raise them with the College of Policing Data Protection Officer (see section 11 below).
The Information Commissioner is the independent regulator responsible for enforcing the Act and can provide useful information about the Act’s requirements. The Information Commissioner’s Office may be contacted using the following:
The Information Commissioner’s Office,Wycliffe House,Wilmslow,Cheshire,SK9 5AFTelephone: 01625 545700Website:
9. How long does the College retain personal data?
The College keeps personal data as long as is necessary for the particular purpose or purposes for which it is held. Our information is held in accordance with our Retention, Review and Disposal schedule.
The College may monitor or record and retain telephone calls, texts, emails and other electronic communications to and from the College in order to deter, prevent and detect inappropriate or criminal activity, to ensure security, and to assist the purposes described under section 1 above.
11. Contact Us
Any individual with concerns over the way the College handles their personal data may contact our Data Protection Officer as below:
Mail: Data Protection Officer,
Central House Beckwith KnowleOtley Road HarrogateHG3 1UF website:
Requesting information under Data Protection