Privacy notice

Introduction

The use and disclosure of personal data is governed in the United Kingdom by the Data Protection Act 2018 (DPA 2018). Under the Act the Chief Constable of Staffordshire Police is registered as a data controller. In the rest of this privacy notice, the Chief Constable of Staffordshire Police is referred to as we or us.

This privacy notice explains:

• how we collect, store, use, disclose, retain and destroy personal data through the website at https://www.staffordshire.police.uk (those activities are also referred to as processing personal data)
• the steps we take to ensure personal data we process is protected properly
• the rights individuals have when we process their personal data

We will treat information you provide to us in using this website in confidence and we will not disclose it to third parties unless we are required to do so by law, or as explained in this privacy notice.

We gather information about site usage to help the development and improvement of services to the public, and to protect the integrity of our systems from malicious users. We also gather information through the various functions available on the site that allow you to provide us with information (such as online forms and the live-chat function) for the purposes described later in this privacy notice. At the moment this information consists of:

• information obtained by our content management system to examine what people are searching for, what they find, and occasions where no results are returned, and which does not identify individual users; information provided by users through online forms (for purposes including crime reporting, crime reporting advice and information, anti-social behaviour reporting, 'Clare's Law' applications, road traffic incident reporting, and firearms licence applications) and live-chat functionality, which may identify individual users and other individuals depending on what information users enter (it is possible we will be able to access information you enter on an online form even if you do not submit it, because of the way the website is set up to automatically save part-complete forms periodically)
• statistical information obtained using Google Analytics which does not identify individual users (more information about this is in the 'How do we use cookies?' section of this privacy notice);
• your IP address and details of which browser you are using, which we record when you use our online forms
• your IP address, used to identify your location if you use any geo-location features on this website, and which we only use to show you relevant content, and which we do not store or share with third parties

What is personal data?

Personal data is any information we handle that relates to an identified or identifiable natural person. An 'identifiable natural person' is anyone who can be identified, directly or indirectly from information, including by reference to a name, identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Our Contact Details and Data Protection Officer

Different units within our Information Governance and Assurance department manage our data protection compliance, how to contact the relevant department in relation to your rights is covered later in this policy.

We take our data protection responsibilities seriously. We take great care to ensure we process your personal data properly to maintain your trust and confidence. You can contact our Data Protection Officer via email or post if you have any questions or concerns about how we process your personal data.

Post:

The Data Protection Officer
Staffordshire Police Headquarters
Weston Road
Staffordshire
ST18 0YY

Email: [email protected]

Why do we process your personal data?

We have a legal duty to uphold the law, prevent crime, bring offenders to justice, and protect the public. To do this we process your personal information for carrying out a range of activities commonly known as the ‘policing purpose’. These include:

• preventing and detecting crime
• apprehending and prosecuting offenders
• protecting life and property
• preserving order
• maintaining law and order
• assisting the public
• safeguarding national security
• defending civil proceedings
• fulfilling any other police duties or responsibilities arising under common or statute law

We also process personal data for purposes in support of the policing purpose. These include: recruitment; administration of current and former employees, contractors, and volunteers; property and asset management; financial management; media relations management, complaints handling; research, including surveys; and provision of educational programmes and support.

Whose personal data do we process?

We process information relating to a range of individuals, including:

• victims of crime
• witnesses to crime
• people convicted of an offence
• people suspected of committing an offence
• complainants, correspondents and enquirers
• advisors, consultants and other professional experts
• suppliers
• current and former employees, cadets, agents, temporary and casual workers, and volunteers
• representatives of individuals in this list, such as parents, other relatives, guardians, and people with power of attorney
• other individuals necessarily identified in the course of police enquiries and activity

What types of personal data do we process?

For both law enforcement and general purposes, Staffordshire Police may process personal data relating to or consisting of the following (known as ‘categories of personal data’):

• Personal details i.e. name, address and biographical details
• Family, lifestyle and social circumstances
• Education and training details
• Financial details
• Goods or services provided
• Racial or ethnic origin
• Membership of extremist political parties
• Religious or other beliefs of a similar nature
• Trade Union membership
• Physical or mental health or condition
• Sexual orientation
• Offences (including alleged offences)
• Criminal proceedings, outcomes and sentences
• Physical identifiers including DNA, fingerprints and other genetic samples
• Sound and visual images including photographs and video
• Licenses or permits held
• Criminal Intelligence
• References to manual records or files
• Information relating to health and safety
• Complaint, incident and accident details

For General Processing ‘Special Category Data’ is personal data that is regarded as particularly sensitive and includes information relating to:

• Race
• Ethic origin
• Political opinions
• Religious/philosophical beliefs
• Health
• Sex life
• Sexual orientation
• Trade union
• Genetic data i.e. biological sample
• Biometric data i.e. fingerprint, face recognition, DNA, palm print, iris recognition

For General Processing Staffordshire Police will only process Special Category Data where a condition in Article 9 of the UK General Data Protection Regulations (UK GDPR) is met. In addition, for General Processing, Staffordshire Police will only process ‘Criminal Offence Data’ – personal data relating to criminal convictions and offences or related security measures – where a condition in Schedule 1 of the DPA is met.

Similarly, for Law Enforcement Processing Staffordshire Police will only process personal data pertaining to your: racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic or biometric data; health (related); or sex life or sexual orientation, in certain circumstances. This type of processing is called ‘Sensitive Processing’. Staffordshire Police carry out Sensitive Processing where one of the following apply:

• Consent is given
• For statutory purposes
• The administration of justice
• Protecting an individual’s vital interests
• Safeguarding children and individuals at risk
• If the information is already in the public domain
• For legal claims
• Preventing fraud
• Archiving, historical or statistical purposes

Where do we get the personal data we process?

We collect personal data from a variety of sources, including:

• individuals who visit the website and interact with it (including by completing and submitting forms), and their relatives, guardians and other persons associated with them
• businesses (including security companies, and other suppliers of goods and services) and other private sector organisations working with the police in anti-crime strategies
• voluntary sector organisations
• local authorities, national and local government departments and agencies (including the Home Office, HM Revenue and Customs, and private safeguarding agencies)
• other law enforcement agencies and bodies (including international ones)
• partner agencies involved in crime and disorder strategies
• legal representatives, prosecuting authorities, courts, and prisons
• licensing authorities
• approved organisations and people working with the police
• ombudsmen and regulatory bodies (including the Independent Police Complaints Commission (IPCC), Her Majesty’s Inspectorate of Constabulary (HMIC), and The Information Commissioners Officer (ICO))
• auditors
• Police and Crime Commissioners
• emergency services
• current, past or prospective employers of individuals
• healthcare, social and welfare advisers or practitioners
• education, training establishments and examining bodies
• business associates and other professional advisors
• our employees, agents, and other temporary and casual works
• persons making enquiries or complaints
• financial organisations and advisors, and credit reference agencies
• survey and research organisations
• trade, employer associations; and professional bodies
• the media
• our own CCTV systems, body worn cameras and unmanned aerial systems

What is our lawful basis for processing personal data?

Where we process personal data for a policing purpose our legal basis for processing is that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. Our functions and the official authority vested in us are set out, in the main, in the Police and Criminal Evidence Act 1984, the Police Act 1996, and the Police Reform Act 2002.
Where we process personal data relating to criminal convictions and offences, that processing is necessary for reasons of substantial public interest and involves the exercise of a function conferred on us by an enactment or rule of law. We have an appropriate policy document (as required under the Act) for that processing.

Where we process personal data for purposes other than the policing purpose our legal basis for processing will vary depending on the circumstances. Ordinarily, the relevant legal basis is that the processing is:

• Consent – you have provided clear consent to process the personal data for a specific purpose
• Contract – the processing is necessary for a contract (i.e. employment contract)
• Legal obligation – the processing is necessary for Staffordshire Police to comply with the law
• Vital interest – the processing is necessary to protect someone’s life
• Public Task – the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law

How do we process personal data?

For both law enforcement and general purposes, Staffordshire Police will process personal data in accordance with the DPA and the UK GDPR – Data Protection Legislation.

Where Staffordshire Police process personal data for Law Enforcement Purposes, it will be done so in accordance with the DPA data protection principles and where processed for personal data for General Purposes it will be done so in accordance with the UK GDPR data protection principles.

Principles	Data Protection Act (DPA)	UK General Data Protection Regulation (UK GDPR)
Principle (a) – lawfulness, fairness and transparency:	Processed lawfully and fairly	Processed lawfully, fairly, in a transparent manner in relation to individuals
Principle (b) – purpose limitation:	Collected for specified, explicit and legitimate purposes and not processed in a manner incompatible with the purpose for which it was originally collected	Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; though further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes will not be considered to be incompatible with the initial purposes
Principle (c) – data minimisation:	Adequate, relevant and not excessive in relation to the purpose for which it is processed	Adequate, relevant and limited to what is necessary in relation to the purpose for which it is processed
Principle (d) – accuracy:	Accurate and, where necessary, kept up to date, and every reasonable step is taken to ensure that personal data is accurate, having regard to the law enforcement purpose for which it is processed, is erased or rectified without delay	Accurate and, where necessary, kept up to date; every reasonable step will be taken to ensure that personal data that is inaccurate will be erased or rectified without delay where necessary
Principle (e) – storage limitation:	Kept for no longer than is necessary for the purpose for which it is processed.; and appropriate time limits are established for the periodic review of the need for the continued storage of personal data for any of the Law Enforcement Purposes	Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed; however, personal data may be stored for longer periods solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to implementation of the appropriate technical and organisational measures required by the UK GDPR in order to safeguard the rights and freedoms of individuals
Principle (f) – integrity and confidentiality:	Processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage	Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures
Accountability	Staffordshire Police will strive to ensure that all personal data processed, under their controllership, is not excessive, is reviewed appropriately, and is securely destroyed when no longer required. Staffordshire Police respect individuals’ rights and will be able to demonstrate compliance with the DPA and UK GDPR data protection principles

What security measures do we use when processing your personal data?

We take the security of all personal data under our control seriously. We comply with our legal obligations regarding security, relevant parts of the ISO27001 Information Security Standard, and where appropriate the College of Policing Authorised Professional Practice guidance on Information Assurance.

We ensure that appropriate policy, training, technical and procedural measures are in place, including audit and inspection, to protect our manual and electronic information systems from data loss and misuse. We only permit access when there is a legitimate reason and under strict guidelines on what use may be made of any personal data contained within them. We continuously manage and enhance our compliance with relevant standards and guidance to achieve adequate and up-to-date personal data security.

Personal data processed for dual purposes

There may be circumstances when it will be necessary to process all types of personal data for both law enforcement and non-law enforcement purposes. For example, there may be an investigation into several allegations of misconduct, only some of which are potentially criminal. Personal data which we obtained for a law enforcement purpose may also be used in disciplinary investigations and proceedings and unsatisfactory performance proceedings. These purposes are authorised by the PRA and the associated regulations.

What disclosures do we make of your personal data?

We may disclose personal data to a wide variety of recipients in any part of the world (including outside of the United Kingdom and the European Economic Area), including to those from whom we originally obtain personal data. Recipients may include:

• law enforcement agencies
• businesses (including security companies, and other supplies of goods and services) and other private sector organisations working with the police in anti-crime strategies
• partner agencies working on crime reduction or safeguarding initiatives
• agencies and other third parties concerned with the safeguarding of and investigation relating to international and domestic national security
• local authorities, national and local government departments and agencies (including the Home Office, HM Revenue and Customs, the Serious Fraud Office, the Child Maintenance Service, the National Fraud Initiative, and private safeguarding agencies)
• Police and Crime Commissioners
• legal representatives, prosecuting authorities, courts, prisons, and other partners in the criminal justice arena;
• victim support service providers
• bodies or individuals working on our behalf
• authorities involved in offender management
• ombudsmen, auditors and regulatory authorities
• other bodies or individuals where required under any legislation, rule of law, or court order
• other bodies or individuals where necessary to prevent harm to individuals
• the media.

We decide on disclosure case-by-case, disclosing only the personal information that is necessary and proportionate to a specific purpose and with appropriate controls and safeguards in place.

Because of the way the website is set up, all completed online forms are automatically sent securely to the central police IT team, who in addition to ourselves, are responsible for delivery of the National Police Chiefs' Council Digital Policing Portfolio.

If we make disclosures outside of the United Kingdom and the European Economic Area to locations which do not have as extensive data protection laws we ensure that there are appropriate safeguards in place to certify that the personal data disclosed is adequately protected.

How long do we retain your personal data?

We keep your personal data for as long as necessary for the particular purpose or purposes for which we hold it.

If we place any of your personal data on the Police National Computer it will be retained, reviewed and deleted in accordance with agreed national retention periods, which are subject to periodic change.

We will retain records containing personal data relating to criminal investigations, intelligence, public protection, and custody in accordance with the College of Policing guidance on the Management of Police Information.

Read our retention policy 

What are your rights over your personal data we process, and how can you exercise them?

Under the Data Protection Act 2018 you have a number of rights that you can exercise in relation to personal data we process about you however all of these rights do not apply when it comes to Law Enforcement processing and even then the applicable rights do not apply in all circumstances, there are exemptions and restrictions that can be legitimately applied to prevent individuals from exercising rights. You do not have to pay to exercise your rights (other than a reasonable fee if a request for access is clearly unfounded or excessive but we agree to fulfil it anyway).

We sometimes need to request specific information from you to help us confirm your identity and ensure your authority to exercise the rights.

Right of Access – Previously a Subject Access request: You can request access to the personal data we hold about you free of charge. Normally we will provide it within one calendar month of receipt of your request unless an exemption applies. Details of the application process can be found on the force website's ‘Right of Access’ page.

Alternatively individuals may contact Staffordshire Police in person, via telephone or social media to make the request, however the quickest and easiest method is via the application process.

Rights of Access do not apply to the processing of ‘relevant personal data’, i.e. we can limit confirmation that we are processing data and access to personal data if it is necessary and proportionate in order to:

• Avoid obstruction of an official or legal inquiry, investigation or procedure;
• Avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
• Protect public security;
• Protect national security; or
• Protect the rights and freedoms of others.

Where a limitation is in place the individual must be given an explanation of the reasons, unless providing this information undermines the purpose of imposing the restriction.

Right to be Informed: You are entitled to be told how we obtain your personal information and how we use, retain, and store it, and who we share it with. This privacy notice gives you that information, as well as telling you what your rights are under the relevant laws.

Right to Rectification: If we hold personal data about you that is inaccurate or incomplete you have the right to ask us to correct it. Staffordshire Police can refuse this request where it is necessary and proportionate or relates to ‘relevant personal data’, i.e. to avoid obstructing an official or legal inquiry, investigation or procedure, or to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, as detailed above.

You can ask us to correct your personal data by emailing [email protected]

We will reply to you within one calendar month unless the request is complex.

Right to Request Erasure: Under certain circumstances you have the right to ask us to delete your personal data to prevent its continued processing where there is no justification for us to retain it. The circumstances most likely to apply are:

• where holding your personal data is no longer necessary in relation to the purpose for which we originally collected and processed it;
• where you withdraw your consent to us holding your personal data if we are relying on your consent to hold it.

The right of erasure does not apply if we are processing your personal data for the following reasons:

• to comply with a legal obligation
• for the performance of a task carried out in the public interest or in the exercise of official authority
• for the establishment, exercise or defence of legal claims
• to exercise the right of freedom of expression and information
• for archiving purposes in the public interest, scientific research, historical research or statistical purposes where erasure is likely to make it impossible to carry out or seriously impair that processing.
• if you want to ask us to delete your personal data you can do so by contacting the Data Protection Officer [email protected]. We will respond to you within one calendar month unless the request is complex.

The erasure of personal data relating to criminal offences cannot be considered until its full period of retention has been reached (as detailed in the National Retention and Disposal Schedule which has been adopted by Staffordshire Police).

Right to Restrict Processing: Under certain circumstances you have the right to ask us to restrict the processing of your personal data. This may be in cases where:

• you are contesting the accuracy your personal data while we are verifying the accuracy
• your information has been unlawfully processed and you oppose its erasure and have requested a restriction instead
• where we no longer require your personal data but you need it to establish, exercise or defend a legal claim and do not want us to delete it.

You can ask us to restrict processing of your personal data by contacting the Data Protection Officer [email protected].

Right to Object: You have the right to object to:

• processing based on legitimate interests or performance of a task in the public interest and or exercise of official authority
• processing of your information for scientific and historical research and statistics
• direct marketing.

Any objection must be on grounds relating to your particular situation. If you want to exercise your right to object you can do so by contacting the Data Protection Officer [email protected]

Rights related to automated decision making and profiling: You have the right not to be subject to a decision when it is based on solely automated processing (including profiling) and which produces a legal effect or similar significant effect on you. This right does not apply if the decision is authorised by law, is necessary for entering into or performance of a contract, or is based on your consent. We are unlikely to carry out automated decision making because our processes involve some type of human interaction and decision-making. Profiling is any form of automated processing of personal data intended to evaluate certain personal aspects about you to predict things about you such as your behaviour, interests, movements or performance at work. We do not currently carry out automated profiling. If you have any questions about automated decision-making or automated profiling you can raise them by contacting the Data Protection Officer [email protected].

An individual has the right to withdraw their consent – This does not apply to offenders or suspected offenders as the processing is necessary to perform a task within the public interest without their consent being given.  This does apply to victims who have consented to their personal data being processed i.e. victim services, this consent can be withdrawn at any time by contacting the Staffordshire Victim Gateway:

          [email protected]

          Telephone: 0330 0881 1339

Monitoring

Staffordshire Police may monitor or record and retain telephone calls, texts, emails and other electronic communications to and from the force in order to deter, prevent and detect inappropriate or criminal activity, to ensure security, and to assist the purposes described under section 1 above.  Staffordshire Police does not place a pre-recorded ‘fair processing notice’ on telephone lines that may receive emergency calls (including misdirected ones) because of the associated risk of harm that may be caused through the delay in response to the call.

How do we use cookies?

Cookies are used on this website to improve user experience and for essential functionality; they are not used for identification purposes.

Learn more about how we manage cookies.

How you can complain

The Information Commissioner's Office (ICO) regulates the processing of personal data. You can complain to the ICO if you are unhappy with how we have processed your personal data.

Information Commissioner's Office website 

Date of last update and changes

We last updated this privacy notice on 07/06/2024. We keep this privacy policy under regular review and update it if any of the information in it changes.