Data Protection Policy
ABOUT THIS PROCEDURE The purpose of this policy is to set out the high level data protection requirements for all processing
activities involving personal data carried out by South Wales Police and Heddlu Gwent Police (“the
forces”). These requirements are legislative obligations and failure to comply with them constitutes
an infringement of the legislation which may result in enforcement action and/or penalties issued by
the Information Commissioner’s Office (ICO) and potential court action brought by individuals who
suffer damage and distress as a result of an infringement
TITLE DP001 - Data Protection Policy
DEPARTMENT RESPONSIBLE Information Management
DATE CREATED 25/11/1997
LAST REVIEWED 30/06/2020
NEXT REVIEW DATE 30/06/2021
VERSION v17
SECURITY CLASSIFICATION OFFICIAL
PUBLICATION SCHEME Yes
COLLEGE OF POLICING APP Management of Police Information
How to navigate this document:
You can either:
Scroll through each page in sequence
Or click on the tabs on the right hand side to go to a specific section
If you have any questions on this procedure, please see the relevant contact in the Further
Reference section or email the Policy Unit.
Data Protection Policy
QUICK REFERENCE
Relevant Definitions (further definitions will be provided in the associated procedural and
guidance documents)
Common Definitions under the General Data Protection Regulation (GDPR) and Data Protection
Act 2018 (DPA) - General Processing and Law Enforcement
“Personal data”– Any information relating to an identified or identifiable natural person; an
identifiable natural person is one who can be identified directly or indirectly, in particular by
reference to an identifier such as a name, an identification number, location data or to one or more
factors specific to the physical or physiological, genetic, mental, economic, or cultural or social
identity of that natural person;
“Data Subject” – the identified or identifiable natural person to whom the personal data relates.
“Biometric data” means personal data resulting from specific technical processing relating to the
physical, physiological or behavioural characteristics of an individual, which allows or confirms the
unique identification of that individual, such as facial images or dactyloscopic data;
“Genetic data” – Personal data relating to the inherited or acquired genetic characteristics of a
natural person which give unique information about the physiology or health of that natural person
which result, in particular from an analysis of a biological sample from the person in question;
“Data concerning health” means personal data relating to the physical or mental health of an
individual, including the provision of health care services, which reveals information about his or her
health status;
“Processing” – any operation or set of operations which is performed on personal data or sets of
personal data, whether or not by automated means e.g. collection, recording, organisation,
structuring, storage, adaptation or alteration, retrieval, consultation, disclosure, alignment,
combination, restriction, erasure or destruction;
“Processor” means any person who processes personal data on behalf of the controller (other than a
person who is an employee of the controller); (A sub-processor is a person who is subcontracted by
the processor).
“Child” – a natural person who is under 13 years old (16 years in Scotland) for the purposes of an
information society service; for all other purposes a person who is under 18 years old;
“Pseudonymisation” processing of data can no longer be attributed to a specific data subject without
the use of additional information i.e. a key which is kept separately and is subject to technical and
organizational measures to ensure that it cannot be linked to the data to make data subjects
identifiable.
“Consent” – any freely given, specific, fully informed and unambiguous indication of the data
subject’s wishes by which he or she, by a statement giving a clear affirmative action, signifies
agreement to the processing of personal data (see ‘DP010 – Consent’ for further information);
Part 2 Definitions – General Processing
Data Protection Policy
“Special Category Data” – Personal data revealing racial or ethnic origin, political opinions, religious
or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric
data for the purpose of uniquely identifying a natural person, data concerning health or data
concerning a natural person’s sex life or sexual orientation.
“Controller” – a natural or legal person, public authority, agency or other body which alone or jointly
with others, determines the purpose and means of the processing, or where it is nominated by UK
law. The Chief Constables are the data controllers for South Wales Police and Gwent Police
respectively.
Part 3 Definitions - Law Enforcement
“Law Enforcement Purposes” - prevention, investigation, detection or prosecution of criminal
offences or the execution of criminal penalties, including the safeguarding against and the
prevention of threats to public security.
“Sensitive processing” – processing of special category data and personal data relating to criminal
convictions and offences or related security measures under Part 3 DPA.
“Competent Authority:
• Any United Kingdom government department other than a non-ministerial government
department, including Scottish, Welsh and Northern Ireland Ministers.
• Chief Officers of Police and other policing bodies
• Authorities with functions relating to offender management
• Other authorities e.g. the Director of Public Prosecutions, the Procurator Fiscal, the
Information Commissioner, a court or tribunal.
“Controller” - means the competent authority which, alone or jointly with others determines the
purposes and means of the processing of personal data or is required to process under an
enactment. The Chief Constable is the data controller for South Wales Police.
“Employee”, in relation to any person, includes an individual who holds a position (whether paid or
unpaid) under the direction and control of that person.
Miscellaneous Terms
“Appropriate Policy Document” – this document explains the controller’s procedures for securing
compliance with the data protection principles in connection with sensitive processing in reliance on
the consent of the data subject or (as the case may be) in reliance on the condition in question, and
explains the controller’s policies as regards the retention and erasure of personal data processed in
reliance on the consent of the data subject or (as the case may be) in reliance on the condition in
question, giving an indication of how long such personal data is likely to be retained
“Information relating to another individual” includes information identifying him/her as the source
of information if they can be identified from that information or from that information and any
other information that the data subject is likely to possess or obtain
Data Protection Policy
“Individual Rights”- these are rights which can be exercised by data subjects in respect of personal
data held about them, unless there are exemptions which enable a data controller to disapply the
right, but only in so far as it is necessary.
Any other terms may be addressed in guidance notes.
Data Protection Policy
ROLES & RESPONSIBILITIES
Data Protection is everyone’s responsibility.
This policy applies to all police officers, staff, volunteers, secondees and contractors who are
processing personal data for or on behalf of the forces.
Processing includes ‘general processing’ under Part 2 of the DPA and processing for ‘law
enforcement purposes’ under Part 3 DPA.
This applies to both manual and automated processing of personal data, whether structured or
unstructured, as South Wales Police and Gwent Police are public authorities under the Freedom of
Information Act 2000. It also applies to any method, channel, system or service used to process
personal data.
The requirements apply notwithstanding other legislative requirements, codes of practice and
standards.
Any individual rights requests or reports of data incidents/personal data breaches must be sent to
the Data Protection Team as soon as possible as there are legal timescales which must be met.
Data Protection Policy
FULL PROCEDURE
Data Protection Principles
The principles are the pillars which govern good data protection practice. Failure to comply with the
principles may lead to enforcement action, financial penalties, reputational damage and potential
legal action by data subjects who have suffered damage or distress as a result of non-compliance.
There are 6 data protection principles which apply to both general processing and processing for law
enforcement purposes:
1. Personal data shall be processed lawfully, fairly and in a transparent manner.
To process personal data lawfully you need to have lawful grounds for processing unless you
can establish that there is an exemption.
Lawful processing
A least one lawful processing must be met. There are different conditions applicable to general
processing purposes and for law enforcement purposes.
Additional conditions must also be met where the processing is sensitive and involves special
category data.
An overview of the lawful conditions is set out in the Further Reference section of this
document.
Fair Processing
The forces will not mislead or deceive data subjects when we collect their information or as
soon as possible following collected. Information should not be processed in a way which
would not reasonably be expected by the data subject. If the processing is likely to result in a
negative impact on the data subject it is unfair if it cannot be justified; this also applies to
handling of individual rights.
Transparency
The forces will be clear and open with data subjects about how personal data concerning them
are collected, used, consulted or otherwise processed. Any information and communication
relating to the processing of personal data must be accessible and easy to understand, and that
clear, plain language be used.
There are minimum pieces of information that must be provided and data subjects should be
made aware of the risks, rules and safeguards, and their rights including how to exercise them.
A full list of transparency information and how it can be communicated is set out in the Further
Reference section of this document.
This information must be easy to read, free from jargon and clearly and prominently displayed
although it can be provided verbally. We will take into consideration whether the audience will
be able to understand it e.g. children.
Data Protection Policy
The forces will provide privacy notices for internal and external data subjects and where
necessary will provide additional information where the processing of personal data may not
be reasonably expected by data subjects.
2. Personal Data shall be collected for a specified, explicit and legitimate purposes and not further
processed in a manner incompatible with those purposes
When collecting personal data ensure that there is a specific purpose for which the data will be
processed.
If personal data is to be used for a totally different purpose to that for which it was originally
collected that the data subject has not been informed about you can only so where:
You have their valid consent (this may not be appropriate in the circumstances)
Further processing is required for a task carried out in the public interest
Further processing is archiving purposes in the public interest, scientific or historical
purposes or for statistical purposes
Personal data collected for a law enforcement purpose may be processed for any other law
enforcement purpose (whether by the controller that collected the data or by another
controller) provided that:
It is authorised by law to process the data for the other purpose, and
The processing is necessary and proportionate to that other purpose.
Personal data collected for any of the law enforcement purposes may not be processed for a
purpose that is not a law enforcement purpose unless the processing is authorised by law.
3. Personal data shall be adequate relevant and limited to what is necessary in relation to the
purpose for which is it processed
The forces will process the minimum amount of data to achieve your purpose. Personal data
should not be collected just in case you might need it in the future or it might be useful to you.
Additional personal data may be collected where it is for a foreseeable circumstance even if
that does not materialise.
You should also consider whether you can achieve your objective with anonymised data.
(see DP009 – Data Minimisation, Pseudonymisation and Anonymisation Guidance)
4. Personal data shall be accurate, and where necessary, kept up-to-date
The forces will take every reasonable step to ensure that personal data that is inaccurate,
having regard to the purpose for which it is processed, is erased or rectified without delay.
In order to preserve evidence or the information cannot be rectified a note or marker can be
put with the information to state that it is inaccurate.
Data Protection Policy
5. Personal data shall be kept in a form which permits identification of data subjects for no longer
than necessary for the purposes for which the personal data are processed
Where identifiable personal data is no longer needed it should be anonymised. Anonymised
data can be retained indefinitely as it is no longer personal.
Back-ups of personal data which are no longer needed should be put ‘beyond use’ however if it
is appropriate to delete personal data from a live system it should also be deleted from back-up
systems where possible.
From ICO guidance, they will be satisfied that information has been ‘put beyond use’, if not
actually deleted, provided that the data controller holding it:
is not able, or will not attempt, to use the personal data to inform any decision in respect
of any individual or in a manner that affects the individual in any way;
does not give any other organisation access to the personal data;
surrounds the personal data with appropriate technical and organisational security; and
commits to permanent deletion of the information if, or when, this becomes possible.
Where data is put beyond use, it is not expected that individuals will be granted the right of
access (subject access requests) to the personal data provided that all four safeguards above
are in place.
It is, however, important to note that where data put beyond use is still held it might need to be
provided in response to a court order. Therefore, it is essential that data protection by design
and default be a prime objective in any new process or system, especially in respect to technical
solutions to prevent deletion problems occurring.
Time limits should be set of periodic reviews of personal data to assess whether it still required.
These time limits should be included in the retention schedule.
You can keep personal data for longer periods if it will be processed solely for public interest
archiving, scientific or historical research, or statistical purposes and provided you have
appropriate safeguards in place.
If only some of the data you hold is still necessary, the other data should be deleted.
6. Personal data shall be processed in a manner that ensures appropriate security, including
protection against unauthorised or unlawful processing and against accidental loss, destruction
or damage, using appropriate technical or organisational measures
This applies to all types of personal data and information assets that are used to store and
process data i.e. paper-based or electronic systems. Security must remain relevant and
effective and part of an ongoing process of continuous improvement.
Data Protection Policy
Appropriate security will includes taking into account the state of the art, the costs of
implementation and the nature, scope, context and purposes of the processing as well as the
risk of varying likelihood and severity for the rights and freedoms of individuals.
Technical measures may include:
pseudonymisation or encryption of the data (see ‘DP009 – Data minimisation,
Pseudonymisation and Anonymisation’ for more information);
the ability to ensure the ongoing confidentiality, availability, integrity and resilience of
systems and services;
the ability to restore the availability and access to personal data in a timely manner in the
event of a physical or technical incident;
a process for regularly testing, assessing and evaluating the effectiveness of technical and
organisational measures.
Organisational measures may include:
Procedural controls – policies, processes and procedures that all users must follow.
Personnel controls – pre-employment checks to verify potential employees or
contractors; criminal records checks and security vetting to ensure staff are safe to
handle potentially sensitive information; security awareness training and internal policy
training to help staff understand how to comply with policies and procedures.
Physical controls - e.g. lockable cabinets; security doors; prevention on unauthorised
personal entering sensitive areas; clear desk policy to ensure sensitive information is not
left on employees’ desks.
Where special category data is processed, or there is sensitive processing, the forces will have
an appropriate policy document in place to explain the procedures in place for complying with
the data protection principles and to explain the controller’s policies for retention and erasure
of personal data processed in reliance on the consent of the data subject or, as the case may be,
in reliance on the condition in question, giving an indication of how long such personal data is
likely to be retained.
Data Controller Obligations
As data controllers the forces will meet their obligations through the implementation of appropriate
organisation and technical controls, including appropriate data protection policies, and be able to
demonstrate compliance of processing activities, including measuring effectiveness taking into
account the nature, scope, context and purposes of the processing and the risks to the rights and
freedoms of natural persons.
The risk to the rights and freedoms of individuals, as a result of processing their personal data, may
include physical, material or non-material damage, in particular:
• Discrimination;
• Identity theft or fraud;
• Financial loss;
• Damage to reputation;
Data Protection Policy
• Loss of confidentiality or personal data protected by professional secrecy;
• Unauthorised reversal of pseudonymisation;
• Any other significant economic or social disadvantage;
• Where data subjects may be deprived of their rights and freedoms or from exercising control
over their personal data
• Where personal data are processed which reveals special categories;
• Where personal data are evaluated e.g. analysing or predicting aspects concerning
performance at work, economic situation, health, personal preferences or interests,
reliability or behaviour, location or movements in order to create personal profiles;
• Where personal data of vulnerable people, in particular children are processed; or
• When processing involves large amount of personal data and affects large amounts of data
subjects.
Data Protection by Design and Default
The forces will, where possible, implement appropriate measures to ensure data protection is built
into processes by design and/or default. This applies to the amount of data collected, the extent of
the processing, the period of storage, appropriate security measures and accessibility.
Where new processes are proposed, changes to existing processes or new, innovative technologies
for processing data are being introduced these should be screened to identify whether a Data
Protection Impact Assessment (DPIA) will be conducted to identify, assess and manage privacy risks
which may arise as a result of the processing.
The DPIA screening and assessment process will be a key governance function in obtaining approvals
for relevant processes and projects which involve processing personal data. Where a full DPIA is
required it should be incorporated into the project cycle as a living document which is regularly
updated.
In limited circumstances, where there is a high level of residual risk the forces via the joint DPO will
consult with the Information Commissioner’s Office prior to processing of the data.
Where a DPIA is required the processing activity will not ‘go live’ until the DPIA has been signed off
by the DPO, the responsible owner and in some circumstances, the Senior Information Risk Owner
(SIRO).
(see ‘DP003 – DPIA’ guidance and templates for more information)
Records of Processing
The forces shall maintain a record of all processing activities involving personal data special category
data and criminal offences and penalties under their responsibility. This applies to personal data in
relation to the public and employees.
Data Protection Policy
(see ‘RM001 – Records Management Policy’ for more information)
Co-operation with the Supervisory Authority
The forces and their processors will co-operate, on request, with the Information Commissioner’s
Office in the performance of its tasks.
The Data Protection Officer will be the primary point of contact for the Information Commissioner’s
Office unless it is agreed otherwise in specified circumstances.
Personal Data Breaches
In the event of a personal data breach, the forces, via the DPO, will without undue delay and where
feasible no later than 72 hours after having become aware of it, notify the personal data breach to
the Information Commissioner’s Office unless it is unlikely to result in a risk to the rights and
freedoms of the data subject.
The forces will document all personal data breaches.
Where a personal data breach is likely to result in a high risk to the rights and freedoms of the data
subject the relevant force will communicate it to the data subject without undue delay and provide
recommendations for the data subject so that they can mitigate any further negative effects.
All employees, contractors and processors will report potential incidents, near misses and actual
personal data breaches which may be a risk or have resulted accidental or unlawful destruction,
loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or
otherwise, in in accordance with the Data Incident Management Procedure.
Where a personal data breach has or appears to have occurred all reasonable steps should be taken
to contain any damage arising from the occurrence and measures should be taken to prevent it or
similar breaches from happening again.
Any weaknesses in systems or processes should be recorded on local Uncertainties Register for
consideration by Information Management. Appropriate steps should be taken to mitigate any risks
to individuals.
(see ‘DP005 – Personal Data Breach Reporting’ for more information)
Data Protection Officer
The forces will designate an independent joint data protection officer, who shall be involved in all
issues relating the processing of personal data, enabling them to:
• Inform and advise all employees of the force of their data protection obligations
• Monitor compliance with data protection provisions and internal policies
• Provide advice where requested as regards DPIAs
• To be the point of contact and coo-operate with the ICO.
Data Protection Policy
The DPO will also provide sign off all DPIAs in addition to responsible owners or the SIRO, depending
on the nature of the processing or the residual risk, referring the DPIA to the ICO for consultation
where necessary.
Transfer of Personal Data Overseas
The forces will ensure that there is an adequate level of protection for any transfer of personal data
to a third country or international organisation or that there are appropriate safeguards, enforceable
data rights and effective legal remedies for data subjects.
Rights of Data Subjects
The forces will take appropriate measures to provide any information as required by data protection
law to data subjects in a concise, transparent, intelligible and easily accessible form, using clear,
plain language. (See ‘further reference’ information in this guidance document)
Mechanisms to facilitate the exercise individual rights will be provided free of charge where
applicable, in particular, access to, rectification or erasure of personal data and the exercise of the
right to object. Where possible, the means to make these requests will be electronic unless other
methods of communication are specified.
A response will be provided an individual in response to a request without undue delay and in any
event within one month of receipt of the request. Where a request made under Part 2 is complex or
there are a number of requests an extension of a further 2 months may be applied and the data
subject informed of this and the reason for delay within the first month of receipt. This does not
apply to subject access requests made under Part 3.
If there is a high volume of information meaning it cannot be sent or the information about the
requester cannot be taken off police premises arrangements will be made with the requester to
view the information under supervision at a suitable location at an agreed time and date.
Where the forces determine not to take action in response to a request or consider the request to
be invalid they will inform the data subject of this within 1 month of receipt of the request and
provide an explanation unless by doing so would be prejudicial to an ongoing investigation.
The relevant force will always verify the identity of a data subject making a request and inform them
of their right to lodge a complaint with the ICO if they are not satisfied with the actions taken.
See also:
‘Further reference’ section in this document
‘DP002 – Subject Access Requests’ for the right to access;
‘DP006 – Record Deletion Process’ for the right to erasure;
‘DP007 – Rectification’
Data Protection Policy
Processors
The forces will only use data processors which provide sufficient guarantees about the technical and
organisational measures used to ensure the protection of the personal data and the rights of data
subjects.
Any sub-processors will only be engaged with the prior authorisation of the relevant force.
A written agreement or legally binding contract will be in place throughout the supply chain with the
same data protection obligations on all processors and sub-processor.
The forces will provide documented instructions to processors about the processing of any personal
data on its behalf.
Data Sharing
The forces will ensure that any requests for sharing of personal data in its possession is lawful and
only relevant, adequate and not excessive information will be provided. If personal identifiers are
not required then information should be anonymised or pseudonymised.
Where there is routine sharing or sharing of a number of data sets in one transfer, data sharing
agreements should clearly set out the purpose for sharing, the roles and responsibilities of the
parties, security considerations and the lawful basis under which it is shared. This does not preclude
contractual requirements or the application of other standards or best practice.
Where there is large scale sharing of personal data and/or special category data the data sharing
agreement may need to be preceded by a DPIA.
(see ‘DP008 – Information Sharing Agreements’ for more information)
Information Security
(See also ‘Information Security’ Policies for more information)
IT
Any systems, software or hardware must be developed and planned in full consultation with
Information Security. Where the development is intended to facilitate the processing of
personal data Information Management advice should also be sought.
Police Personnel are not to access any police systems, records or information for their own
purposes. Access to all systems are monitored and unauthorised access will be subject to
disciplinary procedures.
The use of personal data for demonstration purposes to non-police personnel is prohibited in
most circumstances. Visitors must not be allowed to view ‘live’ information and no real
transactions should be carried out whilst being observed unless prior authorisation has been
provided by Information Management for a specific purpose. Authorisation should be sought
on each occasion this is required.
Installation of monitors/printers etc. should be under supervision or agreed under contract to
ensure that certain data cannot be viewed by unauthorised persons.
Data Protection Policy
Computer screens must be locked when unattended and passwords should not be shared to
prevent unauthorised access to information or systems.
Paper
The forces operate a clear desk policy. Checks should be conducted at the end of the day to
ensure that no personal information in relation to staff or the public is left on desks, printers,
unsecured bins etc.
No computer printouts or any other paperwork containing personal information should be
accessible by unauthorised persons. Police personnel must exercise due diligence when
handling personal data in transit and at rest, including secure storage and disposal of
information whether it is an official police record or handwritten notes.
Hardcopy information should not be removed from police premises unless absolutely necessary
and where appropriate security measures are in place.
Audio
Personal data which is transmitted via radio, telephone or other communications equipment
should not be disclosed or accessed by unauthorised individuals.
Appropriate and reasonable measures should be taken to prevent such disclosure such a muting
in-car radios when transporting individuals.
Disposal
All printout material, magnetic tape, diskettes, manual files etc. which contain personal data and are
no longer required in line with retention periods will be treated as confidential waste and disposed
of in accordance with the Force Information Security procedures.
(see also the ‘RM001 - Records Management’ Policy, which incorporates the ‘South Wales Police
Retention Schedule’)
Retention
Personal Data should be periodically reviewed and removed where necessary. If possible, personal
identifiers should be removed when no longer required for the purposes for which they were
collected.
When considering whether personal data should be kept in an identifiable form you must take into
account force retention schedules, Management of Police Information (MOPI) guidelines, Criminal
Procedures and Investigations Act 1996 (CPIA) , Police and Criminal Evidence Act 1994 and any
other legislative requirements which may refer to the retention or deletion of information.
(see also the ‘RM001 - Records Management’ Policy, which incorporates the ‘South Wales Police
Retention Schedule’).
Data Protection Policy
Logging
The forces will keep logs for at least the following law enforcement processing operations in
automated processing systems:
• Collection
• Alteration
• Consultation – to establish justification for, and date and time of, consultation and as far as
possible the identity of the person who consulted the data
• Disclosure (including transfers) - to establish justification for, and date and time of,
disclosure and as far as possible the identity of the person who consulted the data and the
identity of any recipients.
• Combination
• Erasure
Logs may only be used for the following purposes:
• Verify lawfulness of processing
• Assist with self-monitoring by the controller (or the processor), including for the conduct of
internal disciplinary proceedings
• Ensure security and integrity of personal data
• The purposes of criminal proceedings
Training and Awareness
The forces will provide a programme of data protection training and awareness from induction
onwards all staff to ensure that they are aware of and are competent in the handling of personal
data.
This will be supplemented by tailored awareness and communication activities, which will be
informed by trends identified through compliance monitoring, demand and national
communications/guidance from the NPCC, the ICO and the European Data Protection Board. These
will be provided via methods that are deemed most appropriate and effective, taking into account
the message to be conveyed and the target audience.
Compliance and Audit
The DPO will monitor compliance through reporting, trend analysis and audit of operational and
corporate areas. The DPO will also have sight of any draft and final audit reports which have
included data protection compliance issues. The DPO will be made aware and have visibility of
second and third tier audits.