Privacy Notice
1|Page
Contents 1
Loughs Agency Privacy Notice……………………………….……….3
2
Information Processed by Loughs Agency…………….…….….……3
3
Legal and Regulatory Obligations……………………………….....…4
4
Loughs Agency Gathered Information…………………..……………5
5
Your Data Protection Rights………………….…………………….….6
6
Visitors to Loughs Agency…...…………….…….…………….……...8
7
Investigations for Law Enforcement Purposes……………..…….…8
8
Accessing and Updating Personal Data……………………....…….10
9
Making a Complaint……………….……………………………..……10
10
Data Protection Officer……………….……………………………....11
11
Updates to Loughs Agency Privacy Notice…...…………………….12
12
Document Review and Amendment ………………………….….....12
2|Page
1. Loughs Agency Privacy Notice Loughs Agency is committed to protecting your privacy. This Privacy Notice explains how the Loughs Agency uses information about you and the ways in which we will protect your privacy. Loughs Agency recognises its responsibility in managing Personal Data, and is committed to protecting and respecting your privacy through compliance with the Data Protection Act and the General Data Protection Regulation (GDPR). Loughs Agency will only use your personal information for the purposes for which you provide it, or in accordance with the law, or for the prevention and detection of crime. Loughs Agency will only hold your personal information for as long as necessary for these purposes and will not pass it to any other parties unless this is made clear to you. 2. Information Processed by Loughs Agency This includes: personal details including names, addresses, email, phone, gender, date of birth etc.; financial details; licence details – including supplementary information to support licence applications; education and training details; employment, absence and leave details; criminal offence details. Special Category Data (sensitive personal information) also relates to an identifiable living person, but specifically addresses:
Race or ethnicity; Political opinions; Religious or similar beliefs or other beliefs; Physical or mental health; Sexual orientation; Trade Union Membership; Biometrics (where used ID purposes).
3|Page
3. Legal and Regulatory Obligations To use your personal information lawfully, Loughs Agency relies on one or more of the following legal bases:
Performance of a contract; Legal obligation; Protecting the vital interests of you or others; Public interest; Our legitimate interests; Your consent.
To meet its regulatory and legal obligations, Loughs Agency collects some of your personal information, verifies it, keeps it up to date through regular checking and deletes it once the Agency no longer has to keep it. The Agency may also gather information about you from third parties to help meet its obligations. Loughs Agency collects and processes personal information in order to comply with its legal obligations under a range of employment, statutory equality, health and safety, and criminal legislation, as well as other legislation where the Agency is required to gather and/or process personal information. The Agency also collects and processes personal information for the performance of tasks carried out in the public interest or in the exercise of official authority. On some occasions, such as your participation in voluntary schemes, the Agency relies on your consent to process your personal information. The Agency collects and processes personal information to enable it to:
support and manage Loughs Agency staff; pay current staff and administer pensions; ensure it is suitably trained, skilled and resourced; enable it to make reasonable adjustments in order to comply with its responsibilities under the Disability Discrimination legislation; provide information for departmental reports; recruit and employ staff; comply with statutory obligations under Fair Employment legislation; investigate criminal and civil offences with the remit of Fishery Law; enable it to communicate with necessary persons; provide support in managing the personal information of data subjects and allowing access to their data protection rights; 4|Page
manage and support activities to promote and develop the Foyle and Carlingford area in line with organisational goals The Agency may also process personal information for the purposes of detection and investigation of suspected or actual fraud, loss or crime, data matching under the National Fraud Initiative, staff monitoring and as required by other legislation. The Agency will only collect and hold the minimum amount of personal data necessary in order to provide and manage its services. 4. Loughs Agency Gathered Information Most of the personal information processed is provided directly by you for one of the following reasons: You have applied for a licence or permit provided by Loughs Agency; You have made a complaint or enquiry to Loughs Agency; You have made an information request to Loughs Agency; You wish to attend, or have attended, an event or programme; You subscribe to our e-newsletter; You have been investigated for offences under Fisheries Law; You have applied for a job or placement with Loughs Agency; or You have completed or tendered for work for Loughs Agency. The Agency also receives personal information indirectly, in the following scenarios: The Agency has contacted an organisation about a complaint you have made and it provides your personal information in its response; A complainant refers to you in their complaint correspondence; From other regulators or law enforcement bodies; An employee of Loughs Agency gives your contact details as an emergency contact or a referee. If it is not disproportionate or prejudicial, Loughs Agency will contact you to let you know it is processing your personal information.
5|Page
How Long Is Information Stored? Loughs Agency will hold your personal data on its systems in line with the Loughs Agency’s Data Storage and Retention Policy, and for as long afterwards as it is in the Loughs Agency’s legitimate interest to do so, or for as long as is necessary to comply with legal obligations. Your personal data will be reviewed regularly to establish whether the Agency is still entitled to process it. If it is determined that the Agency is not entitled to do so, it will stop processing your personal data, however will retain your personal data in an archived form in order to be able to comply with future legal obligations e.g. compliance with tax requirements and exemptions, and the establishment, exercise or defence of legal claims. The Agency will never sell your personal data or share your personal data with any third parties without your prior consent (which you are free to withhold) except where it is required to do so by law. The Agency may pass your personal data to third parties who are service providers, agents and subcontractors for the purposes of completing tasks and providing services to you on the Agency’s behalf (e.g. to send you mailings or pension services). The Agency does this for the purpose of legitimate interests in operating for performing its contract with you. However, only the necessary personal data is disclosed for the third party to deliver the service and a contract is in place that requires them to keep your information secure and not to use it for their own purposes. It is possible that third parties may themselves engage others (subprocessors) to process your data. Where this is the case third parties will be required to have contractual arrangements with their sub-processor(s) that ensure your information is kept secure and not used for their own purposes. The Agency has implemented generally accepted standards of technology and operational security in order to protect personal data from loss, misuse, or unauthorised alteration or destruction. 5. Your Data Protection Rights Under Data Protection law, you have rights the Agency is required to make you aware of. The rights available to you depend on the reason for processing your information. 6|Page
Your Right of Access You have the right to request copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information that the Agency has processed. Your Right to Rectification You have the right to ask the Agency to rectify information you think is inaccurate. You also have the right to ask the Agency to complete information you think is incomplete. This right always applies. Your Right to Erasure You have the right to ask the Agency to erase your personal information in certain circumstances. Your Right to Restriction of Processing You have the right to ask the Agency to restrict the processing of your information in certain circumstances. Your Right to Object to Processing You have the right to object to processing if the Agency is able to process your information because the process forms part of our public tasks, or is in our legitimate interests. Your Right to Data Portability This only applies to information you have provided to the Agency. You have the right to ask that the Agency transfer the information you provided from one organisation to another, or provide it to you. The right only applies if the Agency is processing information based on your consent or under, or in talks about entering into a contract and the processing is automated. If the Agency is processing your information for criminal law enforcement purposes, your rights are slightly different. Please see the relevant section of the notice.
7|Page
6. Visitors to Loughs Agency Loughs Agency may have visitors to its offices including (but not limited to):
Dignitaries; Anglers; Members of the Public; PSNI / An Garda Síochána; Staff from other Departmental bodies; Non-Governmental Organisations; External Training Providers; Job Applicants; Suppliers and Tradespersons; Stakeholders; School Groups; Community and Outreach Projects/Schemes.
Loughs Agency has a Data Protection Compliant sign in book available at the reception desk in Headquarters. If a meeting is scheduled in advance then details of those attending will be left at reception. Details contained in this notice will be disposed of securely immediately following the meeting. Closed-circuit television (CCTV) operates outside Headquarters for security purposes. The purpose for processing this information is for security and safety reasons. The legal basis the Agency relies on to process your personal data is Article 6(1)(f) of the General Data Protection Regulation (GDPR), which allows the Agency to process personal data when it is necessary for the purposes of legitimate interests. 7. Investigations for Law Enforcement Purposes Purpose and Legal Basis for Processing As part of its statutory functions, Loughs Agency investigate and prosecute individuals and organisations for alleged criminal offences committed under legislation (including the Foyle Fisheries Act, 1952 and the Foyle Fisheries Act (Northern Ireland) 1952). Loughs Agency is a competent authority for the purpose of Part 3 of the Data Protection Act
8|Page
2018 which applies to the processing of personal data by such authorities for law enforcement purposes. These purposes are set out at Section 31 Data Protection Act 2018 and are the prevention, investigation, detection or prosecution of criminal offences, or the execution of criminal penalties. Loughs Agency’s processing is carried out because it is necessary for the performance of a task relating to one of these purposes or with the consent of the individual. Processing can also include sensitive processing which means processing special category data for law enforcement purposes. Where this is the case the Agency relies on either the consent of the individual or, provided the processing is strictly necessary for the law enforcement purposes, on a condition set out in Schedule 8 of the Data Protection Act 2018. What Information is Required When the Agency investigates an alleged criminal offence, information and evidence is gathered which may include information regarding victims, suspects, witnesses and other individuals relevant to the circumstances and events. Why the Information is Required In its role as a competent authority, Loughs Agency is required to establish whether offences have been committed so legal action can be taken if appropriate. Therefore information relevant to the investigation will be gathered which may include information about you. What is done with the Information Personal information is used for the purposes of an investigation and for prosecution purposes if appropriate. In some circumstances the Agency may share your personal information with law enforcement and other agencies during an investigation. It may also be shared with others such as expert witnesses. If legal action is being considered, this information will be shared with external legal counsel, the courts and any codefendants and their legal representatives. Court cases are held in public and therefore personal data, including special category data, may be made public during the course of proceedings.
9|Page
Where a successful prosecution is secured the Agency may publish the convicted individual’s identity in its Annual Report, on its website or distribute more widely to the media. How long is the information retained? For information on this please refer to Loughs Agency’s Data Storage and Retention Policy. What are your rights? You have a right to access your personal data held by the Agency. You also have a right to get inaccurate data rectified and incomplete data completed, and for your personal data to be erased in certain circumstances. Loughs Agency will provide further information directly to data subjects in specific cases to enable them to exercise their rights. This may be in cases where the Agency is processing your personal data that was collected without your knowledge. The Agency will not do this where doing so would be prejudicial to an investigation or for other reasons set out in Section 44 (4) of the Data Protection Act 2018. Does Loughs Agency use any Data Processors? Loughs Agency uses a range of external solicitors for the processing of legal actions. 8. Accessing and Updating Personal Data You are entitled to access the personal information held about you. This request known as a Subject Access Request will be processed and information provided to you within one month of receiving your request. If you wish to do this, please contact the Data Protection Officer (details below). 9. Making a Complaint If you have a complaint about the use of your personal information or how it has been processed, you can in the first instance contact Loughs Agency to correct this as quickly as possible. If you wish to make a 10 | P a g e
complaint you may do so in writing and / or by email by contacting the Data Protection Officer. Please be assured that all complaints received will be fully investigated. You should supply as much information as possible to help resolve your complaint as quickly as possible. If you remain dissatisfied then you have the right to apply directly to the Information Commissioner or Data Commissioner for a decision. The Information Commissioner can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF www.ico.org.uk The Data Commissioner can be contacted at: Data Protection Commission 21 Fitzwilliam Square South Dublin 2 D02 RD28 Ireland 10.
Data Protection Officer
The contact details for the designated Data Protection Officer for Loughs Agency are as follows: Data Protection Officer Loughs Agency 22 Victoria Road Derry/Londonderry BT47 2AB DPO@loughs-agency.org
11.
Updates to Loughs Agency Notice 11 | P a g e
Loughs Agency reserves the right to periodically make alterations to this notice without notice. This version was last amended in July 2019. 12.
Document Review and Amendment
This Privacy Notice will be formally reviewed every 12 months (or sooner if work processes change). To ensure that each copy of the Notice contains a record of all changes, a record of the change or amendments will be kept on the amendment list. The amendment list along with any revised or new pages will then be circulated to all staff. Amendment List
Date
Section
July 2019
All
Brief description of change
Introduction of Privacy Notice
Page no.
Version no.
All
1.0
12 | P a g e