Office of Vicky Ford MP
1) Data Protection Policy
This document outlines how the Office of Vicky Ford MP processes and manages personal data. It:
- identifies our data controller;
- provides our lawful basis for processing personal data;
- outlines the scope of personal data we hold and process;
- outlines the scope of the special category personal data we hold and process;
- describes and justifies our data retention policy;
- shows how we intend to respond to Subject Access Requests; and
- contains a copy of our privacy notice.
The policies outlined within this document come into full effect on Friday 25th May 2018.
2) Data Controller
The Data Controller is Vicky Ford MP, Member of Parliament for Chelmsford.
Lawful basis for processing
- Casework is processed primarily under the lawful basis of public task, with exceptional cases processed under the lawful basis of consent.
- We undertake to always act within the reasonable expectations of our constituents and any other individuals about whom we hold personal data.
3) Data we hold
We operate a paperless office in parallel with written correspondence which is scanned and saved. Hard documents are stored in secure filing. Personal data is stored electronically and securely on our computer systems. Our systems are in offices which are locked when unattended. We are committed to ensuring that the information we collect and use is appropriate for this purpose, and do not constitute an invasion of an individual’s, group’s or organisation’s privacy.
The Office uses the Cross Reference software to help with the management of constituent casework records. This information predominantly includes but is not limited to:
- Names, addresses and email addresses.
- Telephone numbers.
- National Insurance Numbers, Passport Numbers.
- Special category data, outlined in point 4.
4) Special category data we hold
The office may also hold special category data for a smaller number of data subjects. This data will be processed under the lawful basis indicated in point two, as is permitted in clauses 23 and 24 of schedule 1 of the Data Protection Act. The data may include:
- Political opinions
- Religious beliefs
- Trade union activities
- Sexual orientation
- Race and ethnic origin
- Details of criminal offenses
- Physical and mental health
5) Data retention policy
Our office will hold personal data so long as Vicky Ford MP remains as a Member of Parliament. Casework and policy queries are often revisited to provide the best service and representation for constituents, from whom we may continue to receive correspondence. Therefore, we feel it is reasonable for an elected representative to hold personal data for the duration of parliamentary representation. This will be reviewed at the next election.
6) Subject Access Requests
We will comply with Subject Access Requests in line with the guidance given by the Information Commissioners Office (ICO).
- We will respond as quickly as possible, within 30 calendar days.
- We will request verification of the identity of any individual making a request, and ask for further clarification and details if needed.
- Data subjects have the right to the following:
To be told whether any personal data is being processed
To be given a description of the personal data, the reasons it is being processed and whether it will be given to another organisations or people.
To be given a copy of the information comprising the data, and given details of the source of the data where this is available.
This privacy notice relates to the personal data processed by the Office of Vicky Ford MP, Member of Parliament for Chelmsford, in relation to casework and policy queries.
What does the Office do?
The office discharges the duties and functions of an elected Member of Parliament. As part of this work, we conduct constituency casework and respond to policy queries, for which we must process personal data of our constituents.
How do we process data?
This office processes constituents’ data under the lawful basis of public task. In instances where this lawful basis is not sufficient and explicit consent is required, a member of the office will contact the person to establish consent. We feel it is reasonable for an elected representative to hold personal data for as long as they are in office.
Will we share your data with anyone else?
If a person has contacted Vicky Ford MP about a personal or policy issue, we may pass this personal data on to a third-party in the course of dealing with it, such as local authorities, government agencies, public bodies, health trusts, regulators, and so on. Any third parties that we may share data with are obliged to keep these details securely, and to use them only for the basis upon which they were originally intended. When they no longer need personal data to fulfil this service, they will dispose of the details in line with our procedures.
In any case, we will not use personal data in a way that goes beyond any reasonable expectations in contacting us.
For how long will we keep personal data?
We will hold personal data for as long as I remain a Member of Parliament.
Casework and policy queries are often revisited to provide the best service and representation for constituents, from whom we may continue to receive correspondence. Therefore, we feel it is reasonable for an elected representative to hold personal data.
Following the cessation of being an MP, we will retain personal data for a further three months, during which time constituents can contact us to ask that we retain their data for the use of a newly elected member’s casework team, for example.
What rights do I have to my personal data?
At any point while we are in possession of, or processing personal data, the data subject, has the following rights:
- Right of access – the right to request a copy of the information that we hold.
- Right of rectification – a right to correct data that we hold that is inaccurate or incomplete.
- Right to be forgotten – in certain circumstances an individual can ask for the data we hold to be erased from our records.
- Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
- Right of portability – the right to have the data we hold transferred to another organisation.
- Right to object – the right to object to certain types of processing, such as direct marketing.
- Right to object to automated processing, including profiling – the right to be subject to the legal effects of automated processing or profiling.
- Right to judicial review: if our office refuses a request under rights of access, we will provide the reason why.
How can I contact somebody about my privacy?
Individuals can get in touch with my office by letter, email or telephone. Please note that we will ask for identification in connection with exercising any of the above rights in relation to personal data we hold.