1. Who is the Controller (the person who determines the purpose and means by which an individual’s personal data is processed) and what are their contact details?

National Police Chiefs' Council
50 Broadway
London
SW1H 0BL

Email: [email protected]
ICO Registration number: ZA495495

Section 44(1)(a)

Article 13(1)(a)

Article 14(1)(a)

2. What are the contact details of the NPCC’s Data Protection Officer?

Data Protection Officer
NPCC
50 Broadway
London
SW1H 0BL

Email: [email protected]

Section 44(1)(b)

Article 13(1)(b)

Article 14(1)(b)

3. For what purpose(s) is the personal data processed by the NPCC?

To support sign up to and delivery of updates via the Police Science website, the OPCSA maintains a register of individuals and their basic contact details. This information is used to provide relevant communications to the Science and Innovation Community, including innovation news, updates, events and other items of interest. This Privacy Notice explains how this data will be processed.

Section 44(1)(c)

Article 13(1)(c)

4. What types or categories of personal data is processed by the NPCC?

The NPCCwill collect and process the following personal data:

First name, family name and email address.

Article 14(1)(d)

5. How is personal data processed by the NPCC?

The NPCCwill process individual’s personal data in the following ways:

• Registration of Personal Details with OPCSA
• Adding of supplied details to system register
• Acknowledgement of registration
• Subsequent Emailing of materials of interest
• >Annual review of persons continued interest
• Deregistration

6. What is the NPCC’s legal basis for processing the personal data?

The NPCC’s legal basis for processing personal data is based on its Common Law Policing Purpose of protecting life and property, preserving order, preventing the commission of offences, bringing offenders to justice, and any duty or responsibility of the police arising from common or statute law.

In terms of Section 35(2) of the DPA the processing is necessary for the performance of a task carried out for a Law Enforcement Purpose by the NPCC or another competent authority.

With regards to Data Protection legislation the relevant processing condition from UK GDPR Article 6(1) is:

1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes

2. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Section 44(2)(a)

Section 35(2)

Article 13(1)(c)

Article 14(1)(c)

7. Who could the personal data be disclosed to by the NPCC?

N/A

Section 44(2)(c)

Article 13(1)(e)

8. Does the NPCC intend to transfer the personal data out of the U.K. or to an international organisation?

No

Article 13(1)(f)

Article 14(1)(f)

9. If the NPCC intends to transfer the personal data out of the U.K. or to an international organisation what safeguards are there to protect the personal data?

N/A

Section 44(2)(b)

Article 13(1)(f)

Article 14(1)(f)

10. How long will the personal data be retained by the NPCC?

Personal data will be retained for the duration that updates are requested from OPCSA. Personal data will be deleted following un-subscription from OPCSA.

Article 13(2)(a)

Article 14(2)(a)

11. What are individuals’ rights under the DPA and UK GDPR?

Individuals have the following rights under the DPA:

Right of access to their personal data

Right of rectification of their personal data

Right of erasure of their personal data or the restriction of its processing

Right to lodge a complaint with the Information Commissioner

Full details of those rights and how to exercise them can be found in the NPCC’s high-level Privacy Notice which can be found on the NPCC website. It can also be obtained from the NPCC’s Data Protection Officer

Section 44(1)(d)(i)

Section 44(2)(d)

Section 44(3)(a)

Section 45

Section 44(1)(d)(ii)

Section 46

Section 44(1)(d)(iii)

Section 47

Section 44(1)(e)

Section 51

Individuals have the following rights under the UK GDPR:

• Right to be informed
• Right of access
• Right of erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right not to be subject of automated decision-making

Full details of those rights and how to exercise them can be found in the NPCC’s high-level Privacy Notice which can be found on the NPCC website. It can also be obtained from the NPCC’s Data Protection Officer.

Article 13(2)(b)

Article 14(2)(c)

12. If the NPCC relies on individuals’ consent to be the legal basis for processing the personal data can they withdraw that consent?

Yes, individuals may withdraw their consent at any time. However, that withdrawal does not affect the lawfulness of any processing of the personal data before the withdrawal of consent.

Article 13(2)(c)

Article 14(2)(d)

13. Who can an individual lodge a complaint with if they are unhappy about the way their personal data is processed by the NPCC?

They may lodge a complaint with the Information Commissioner’s Office. Their contact details are:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Website: www.ico.org.uk

They may wish to initially raise any concerns with the NPCC Data Protection Officer.

Article 13(2)(d)

Article 14(2)(e)

14. If personal data was obtained by NPCC from someone else from who or where was it obtained by the NPCC?

N/A

Article 14(2)(f)

15. Are individuals required to provide their personal data under a statutory or contractual requirement, or a requirement necessary to enter into a contract, or are they obliged to provide it?

No

Article 13(2)(e)

16. Is an individual’s personal data used for automated decision-making, including profiling? (Automated decision-making is where the NPCC makes a decision about an individual without human intervention that has a legal or similar effect on them.)

No

Article 13(2)(f)

Article 14(2)(g)

18. If an individual’s personal data is used for automated decision-making, including profiling what logic will be involved and what significance and consequences will there be for them from the automated decision-making?

N/A

Article 13(2)(f)

Article 14(2)(g)