To view our Covid-19 Privacy Notice - click here.

This privacy notice is to make it easier to understand and provide you with more information about how Police Forces may seek to collect and hold additional information about you in relation to the unprecedented challenges we are all facing during the Coronavirus pandemic (COVID-19).

Cumbria Constabulary Privacy Notice​ - click here.

This privacy notice​ explains how and why Cumbria Constabulary process your personal data and the steps we take to keep your information safe. It also describes your rights in regard to your personal information and how to complain to the Information Commissioner if you have concerns as to how we have handled your data

Workforce Privacy Notice​​ - click here.

This privacy notice applies to all Cumbria Constabulary Personnel, comprising Police Officers, Police Staff, and PCSOs. It also includes Volunteers (including Special Officers), Agency Employees (vetted and carrying work on the instruction of Cumbria Constabulary) and Contractors (vetted but tasked with specific tasks, for instance Portable Appliance Testing (PAT) testing).

Sensitive Processing Pledge​ - click here.

Section 35 of the Data Protection Act states that sensitive processing for law enforcement purposes is permitted where there is consent of the data subject or where it is strictly necessary for the law enforcement purposes and it meets one of the Schedule 8 conditions.

Our Sensitive Processing Pledge details how we will meet the Principles for Part 3 Processing.

Special Category Processing​ - click here

Our Safeguard Pledge explains our policies and procedures in relation to the processing of special categories of personal data in reliance on specific conditions in Schedule 1 of the DPA.  This pledge complements our privacy notice and workforce privacy notice

Privacy Notice - How We Use Your Personal Information - Your privacy is important to us!

  1. Introduction

As a result of changes to data protection legislation which took effect on 25th May 2018, our Privacy Notice has been updated to make it easier for you to understand what information we may process information about you. ‘Processing’ includes how we collect personal information, why we collect it, share it, retain it and dispose of it.

Cumbria Constabulary takes your privacy very seriously and our Privacy Notice contains details about how we will comply with the new obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (the Act). This Notice provides information about how Cumbria Constabulary will process your personal data[1], and the steps we take to ensure that it is protected. This Notice also provides details of the rights you have in regard to any personal information we hold about you now and any personal information we might collect about you in the future.

The Chief Constable of Cumbria Constabulary is registered with the Information Commissioner as a ‘data controller’. The registration number is Z7116677.

In accordance with the requirements of the GDPR and the Act, a Data Protection Officer has been designated to help ensure that personal information is processed in accordance with the requirements of the legislation. The Data Protection Officer is also available to provide you with advice and assistance if you have any queries about how we process your personal data. The legislation permits a Data Protection Officer to act for more than one data controller and the Data Protection Officer for the Cumbria Constabulary is also designated to act as the Data Protection Officer for the Police and Crime Commissioner for Cumbria.

Contact details for the Data Protection Officer can be found below:

Data & Information Privacy Manager
Digital, Data & Technology Command
Police Headquarters
Carleton Hall
Penrith
Cumbria
CA10 2AU

Email: DataProtection@cumbria.police.uk
Tel: 101 Option 2 Extension 60025, or
(+44) 0300 124 0111 Option 2 Extension 60025

  1. Why do we handle personal information?

Cumbria Constabulary obtains, holds, uses and discloses personal information for two broad purposes: a) Law Enforcement Purposes and b) to carry out activities to support the Law Enforcement Purposes something we call ‘General Purposes’.

Law Enforcement Purposes include:

  • the prevention, investigation, detection or prosecution of criminal offences
  • the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security

When we process your personal data for Law Enforcement Purposes it could be because you are involved in an incident that has been reported to the police – perhaps as a witness, victim or suspect. It could be because you are involved in a crime that is being investigated or are associated with intelligence that the police have gathered. Other uses include roads policing, accident investigation, surveillance, and public order.

General Purposes include:

  • the policing purpose, which falls outside of the statutory definition of law enforcement processing
  • Provision of victims details to Victims Support
  • Staff/pension administration, occupational health and welfare.
  • Management of public relations, journalism, advertising and media.
  • Management of finance, payroll, benefits, accounts, audit, internal review.
  • Internal review, accounting and auditing;
  • Training;
  • Property management;
  • Insurance management;
  • Vehicle and transport management;
  • Payroll and benefits management;
  • Management of complaints;
  • Vetting;
  • Management of information technology systems;
  • Legal services;
  • Information provision;
  • Licensing and registration;
  • Pensioner administration;
  • Research including surveys
  • Performance management;
  • Sports and recreation;
  • Procurement;
  • Planning;
  • System testing and fault resolution;
  • Security;
  • Health and safety management.

Where we process your personal data for Law Enforcement Purposes we are obliged to comply with the DPA, but not the GDPR.

When we process your personal data for General Purposes, we have to comply with the GDPR and various parts of the DPA.

Although the rules for both purposes are similar they are not identical – for example you have fewer rights when we process your personal data for Law Enforcement Purposes.

  1. Whose personal data do we handle?

In order to carry out the purposes described under why we handle personal data Cumbria Constabulary may obtain, use, disclose, handle etc. personal data relating to a wide variety of individuals including the following:

  • Staff including volunteers, agents, temporary and casual workers;
  • Suppliers;
  • Complainants, correspondents and enquirers;
  • Relatives, guardians and associates of the individual concerned;
  • Advisers, consultants and other professional experts;
  • Offenders and suspected offenders;
  • Witnesses;
  • Victims;
  • Former and potential members of staff, pensioners and beneficiaries;
  • Other individuals necessarily identified in the course of police enquiries and activity.

Cumbria Constabulary will only use appropriate personal information necessary to fulfil a particular purpose or purposes. Personal information could be information which is held on a computer, in a paper record such as a file, as images, but it can also include other types of electronically held information such as CCTV images.

  1. What types of personal data do we handle?

In order to carry out the purposes described above, Cumbria Constabulary may obtain, use, disclose, handle etc. personal data relating to or consisting of the following:

  • Personal details such as name, address and biographical details;
  • Family, lifestyle and social circumstances;
  • Education and training details;
  • Employment details;
  • Financial details;
  • Goods or services provided;
  • Racial or ethnic origin;
  • Political opinions;
  • Religious or other beliefs of a similar nature;
  • Trade union membership;
  • Physical or mental health or condition;
  • Sexual life;
  • Offences (including alleged offences);
  • Criminal proceedings, outcomes and sentences;
  • Physical identifiers including DNA, fingerprints and other genetic samples;
  • Sound and visual images;
  • Licenses or permits held;
  • Criminal Intelligence;
  • References to manual records or files;
  • Information relating to health and safety;
  • Complaint, incident and accident details

Cumbria Constabulary will only use appropriate personal information necessary to fulfil a particular purpose or purposes. Personal information could be information which is held on a computer, in a paper record such as a file, as images, but it can also include other types of electronically held information such as CCTV images.

  1. Where do we obtain personal data from?
  • In order to carry out the purposes described under why we handle personal data above, Cumbria Constabulary may obtain personal data from a wide variety of sources, including the following:
  • Other law enforcement agencies.
  • HM Revenue and Customs.
  • International law enforcement agencies and bodies.
  • Licensing authorities.
  • Legal representatives.
  • Prosecuting authorities.
  • Defence solicitors.
  • Courts
  • Prisons
  • Security companies.
  • Partner agencies involved in crime and disorder strategies.
  • Private sector organisations working with the police in anti-crime strategies.
  • Voluntary sector organisations.
  • Approved organisations and people working with the police;
  • Independent Office for Police Conduct
  • Her Majesty’s Inspectorate of Constabulary;
  • Auditors;
  • Police Authority;
  • Central government, governmental agencies and departments;
  • Emergency services;
  • Individuals themselves;
  • Relatives, guardians or other persons associated with the individual;
  • Current, past or prospective employers of the individual;
  • Healthcare, social and welfare advisers or practitioners;
  • Education, training establishments and examining bodies;
  • Business associates and other professional advisors;
  • Employees and agents of Cumbria Constabulary;
  • Suppliers, providers of goods or services;
  • Persons making an enquiry or complaint;
  • Financial organisations and advisors;
  • Credit reference agencies;
  • Survey and research organisations;
  • Trade, employer associations and professional bodies;
  • Local government;
  • Voluntary and charitable organisations;
  • Ombudsmen and regulatory authorities;
  • The media;
  • Data Processors working on behalf of Cumbria Constabulary.

Cumbria Constabulary may also obtain personal data from other sources, such as its own CCTV systems, or correspondence.

  1. How do we handle personal data?

In order to achieve the purposes described under section 2 Cumbria Constabulary will handle personal information in accordance with the UK GDPR and Data Protection Act 2018.

In particular we will ensure that personal information is handled in accordance with the Principles which are set out in the UK GDPR and Data Protection Act. These Principles include the requirement for personal information to be handled fairly and lawfully and in a transparent manner. We will strive to ensure that the personal information we use, or that is used on our behalf, is accurate, relevant, adequate and not excessive for the purposes we use it for and that it is kept up to date, is adequately protected and is securely destroyed when no longer required.

  1. How do we collect personal data?

Cumbria Constabulary collects personal data either from the individual concerned or from other sources, dependant on circumstances.

The following are examples of how we obtain personal data direct from the individual concerned:

  • From conversations with those individuals (in person or via telephone);
  • From written communications from those individuals (e.g. letters, emails, social media);
  • From website interactions with those individuals
  • From forms completed by those individuals (e.g. job applications).

The following are examples of how we obtain personal data about individuals from other sources:

  • From conversations with other individuals (in person or via telephone);
  • From written communications from other individuals (e.g. letters, emails, social media);
  • From observation or monitoring;
  • From Body Worn Video;
  • From CCTV and audio systems;
  • From forms completed by other individuals.
  1. Which lawful basis do we use to process this information?

Cumbria Constabulary must have a valid lawful basis in order to process your personal data.

When we process your personal data for Law Enforcement Purposes, we do so under our Common Law Policing Powers and where we either have your consent to do so or the processing is necessary for the performance of a task carried out by us for Law Enforcement Purposes.

When we process your personal data for General Purposes there are six lawful bases available and which base is most appropriate to use will depend on our purpose for processing the personal data and our relationship with you:

  • Consent: We have been given clear consent to process the personal data for an individual
  • Contract: The processing is necessary for a contract that we have with an individual
  • Legal obligation: the processing is necessary for us to comply with the law
  • Vital interest: the processing is necessary to protect someone’s life
  • Public Task: the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law.
  • Legitimate interests (this is only available to public authorities in limited circumstances)

Special Category Data is personal data that is regarded as particularly sensitive and includes information relating to your:

  • Race
  • Ethic origin
  • Political opinions
  • Religious/philosophical beliefs
  • Health
  • Sex life
  • Sexual orientation
  • Trade union
  • Genetic data - Biological sample
  • Biometric data - Fingerprint, face recognition, DNA, palm print, iris recognition.

For General Processing we will only process Special Category Data where we meet a special condition under Article 9 of the GDPR. In addition, for General Processing we will only process ‘Criminal Offence Data’ - personal data relating to criminal convictions and offences or related security measures8 - where a lawful authority has been established and a relevant condition under Article 6, and where necessary Article 9, has been identified.

Similarly for Law Enforcement Processing we will only process personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic or biometric data; health related; concerning sex life or sexual orientation in certain circumstances. This type of processing is called ‘Sensitive Processing’9. We carry out sensitive processing where one of the following apply: we have your consent, we need to do so for statutory purposes, the administration of justice, protecting an individual’s vital

interests, safeguarding children and individuals at risk, if the information is already in the public domain, for legal claims, preventing fraud, and archiving, historical or statistical purposes.

  1. How do we ensure the security of personal data?

Cumbria Constabulary takes the security of all personal information under our control very seriously. We will comply with the relevant parts of the Act relating to security, and seek to comply with the National Police Chiefs’ Council’ Community Security Policy and relevant parts of the ISO27001 Information Security Standard.

We will ensure that appropriate policy, training, technical and procedural measures are in place, including audit and inspection, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so, and then under strict guidelines as to what use may be made of any personal data contained within them. These procedures are continuously managed and enhanced to ensure up-to-date security.

We use Microsoft products including Office 365 to assist us in our daily business. Microsoft’s Office 365 includes numerous security features to ensure compliance with the most up to date security standards. The Microsoft privacy notice can be seen using the following link https://privacy.microsoft.com/en-gb/privacystatement.

  1. Who do we disclose personal data to?

In order to carry out the purposes described under section 2, Cumbria Constabulary may disclose personal information to a wide variety of recipients in any part of the world, including those from whom personal information is obtained (as listed above). This may include:-

  • Disclosures to other law enforcement agencies,
  • partner agencies working on crime reduction initiatives,
  • partners in the Criminal Justice arena,
  • Parole Board
  • Victim Support,
  • Office of the Police and Crime Commissioner for Cumbria
  • Independent Office for Police Conduct
  • and to bodies or individuals working on our behalf such as IT contractors or survey organisations.
  • We may also disclose to other bodies or individuals where necessary to prevent harm to individuals.

Disclosures of personal information will be made on a case-by-case basis, using the personal information appropriate to a specific purpose and circumstances, and with necessary controls in place.

Some of the bodies or individuals to which we may disclose personal information are situated outside of the European Union - some of which do not have laws that protect data protection rights as extensively as in the United Kingdom. If we do transfer personal information to such territories, we will take proper steps to ensure that it is adequately protected as required by legislation.

Cumbria Constabulary will also disclose personal information to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and by court order. This may include disclosures to the Child Support Agency, the National Fraud Initiative, the Home Office and to the Courts.

Cumbria Constabulary is required to conduct Customer Satisfaction Surveys to evaluate our performance and effectiveness. We may contact individuals, such as victims of crime or those reporting incidents, and ask them to give us their opinion of the service we are providing to the public. We use the information given to improve our service wherever we can. Cumbria Constabulary, like many police forces, may use a private company to undertake such surveys on our behalf with strict controls to protect the personal data of those involved.

Cumbria Constabulary may also disclose personal information on a discretionary basis for the purpose of, and in connection with, any legal proceedings or for obtaining legal advice.

  1. How long does Cumbria Constabulary retain personal data?

Cumbria Constabulary keeps personal data only as long as is necessary for the particular purpose, or purposes for which it is being processed. Personal data which is placed on national police systems namely, the Police National Computer, National DNA Database, or National Fingerprint Database are managed in accordance with 'NPCC Deletion of Records from National Police Systems (PNC/NDNAD/IDENT1)'.

Other records containing personal data relating to crime recording, domestic violence, child abuse investigation, public protection, missing persons, case and custody, incident records, firearms licensing and intelligence will be retained in accordance with the Authorised Professional Practice on the Management of Police Information - This can also be found on the College of Policing’s website https://www.app.college.police.uk/app-content/information-management/management-of-police-information/

In addition to the above, Cumbria Constabulary also has a Force Retention Schedule which details retention periods for records not referred to above.

  1. Monitoring

Cumbria Constabulary may monitor or record and retain telephone calls, text, emails and other electronic communications to and from the force in order to deter, prevent and detect inappropriate or criminal activity, to ensure security, and to assist the purpose described under section 2 above. Cumbria Constabulary does not place a pre-recorded ‘fair processing notice’ on telephone lines that may receive emergency calls (including misdirected ones) because of the associated risk of harm that may be caused through the delay in response to the call.

  1. Rights of Individuals whose personal data we process

Under the DPA, GDPR, Environmental Information Regulations 2004 and the Freedom of Information Act 2000, you have a number of information rights.

Under the provisions contained within the UK GDPR, you have the following rights:

The right to be informed – this is covered by this Privacy Notice and in other specific Notices we may provide at the time we collect information.

The right of access (Subject Access Request) - You can request access to a copy of personal information that we hold about you (subject to exemptions), along with certain supplementary information that we are required to provide to you.

Right to request rectification – You are entitled to have personal data we hold rectified if it is inaccurate or incomplete.

Right to erasure – This right enables you to request the deletion or removal of personal information where there is no compelling reason for it to continue to be processed.

Right to restrict processing – Individuals have a right to ‘block’ or restrict the processing of personal data. When processing is restricted, organisations are permitted to store the personal data but not to further process it.

Right to data portability – The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services.

Right to object – Individuals have a right to object to the processing of their personal data in certain circumstances.

Rights related to automated decision making – This relates to where automated individual decision-making occurs (making a decision solely by automated means without any human involvement); and profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.

Under the provisions contained within Part 3 of the Data Protection Act 2018 (Law Enforcement Processing), you have the following rights:

The right to be informed – this is covered by this Privacy Notice and in other specific Notices we may provide at the time we collect information.

The right of access (Subject Access Request) - You can request access to a copy of personal information that we hold about you (subject to exemptions), along with certain supplementary information that we are required to provide to you. This is commonly known as subject access and is the right which allows you to access your personal data and supplementary information; however it is subject to certain restrictions.

The right may be exercised verbally or in writing. Where your right of access application is made electronically Cumbria Constabulary must respond electronically in a commonly used form unless you require otherwise. We may charge a fee for additional copies of information disclosed to you under this right based on administrative costs.

Right to request rectification – You are entitled to have personal data we hold rectified if it is inaccurate or incomplete.

Right to erasure and the right to restriction – This right enables you to request the deletion or removal of personal information where there is no compelling reason for it to continue to be processed. Individuals have a right to ‘block’ or restrict the processing of personal data. When processing is restricted, organisations are permitted to store the personal data but not to further process it.

Rights related to automated decision makingIndividuals have the right not to be subject to a decision when:

  • it is based on automated processing; and
  • it produces an adverse legal effect or a significantly affects the individual.

Consent - In addition to the above rights, under GDPR and the Data Protection Act 2018, where you have previously provided your consent for us to use your personal data, you have a right to withdraw that consent. Please note, however, we won’t always require consent to process your personal information – for example - if we need the data to meet regulatory requirements, perform a contract with you, or if it is held for Law Enforcement purposes.

  1. Complaints

If at any point you wish to make a complaint about how we have used your personal information to us, please contact the Data Protection Officer using the details provided on page 1 of this Notice.

The Information Commissioner is the independent supervisory authority with responsibility for overseeing compliance with the UK GDPR and Data Protection Act 2018. If you have a concern about how we have used your personal information, you may also wish to contact the Commissioner using the details provided below

https://ico.org.uk/concerns/

Tel: 0303 123 1113

  1. Privacy Notice Review

We will review this Privacy Notice regularly. This Notice was last updated on 30th March 2022


[1] ‘Personal Data’ is defined in Article 4 of the General Data Protection Regulation (GDPR). In practical terms, it means any information handled by Cumbria Constabulary that relates to an identified or identifiable living individual, directly or indirectly. In particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

[2] Cumbria Constabulary is required to conduct Customer Satisfaction Surveys to evaluate our performance and effectiveness. We may contact individuals, such as victims of crime or those reporting incidents, and ask them to give us their opinion of the service we are providing to the public. We use the information given to improve our service wherever we can. Cumbria Constabulary, like many police forces uses a private company to undertake such surveys on our behalf with strict controls to protect the personal data of those involved.