Data protection and the CPS
The Data Protection Act (DPA) 2018 updates data protection laws in the UK.
The UK GDPR is the UK General Data Protection Regulation. It sets out the key principles, rights and obligations for most processing of personal data in the UK, except for law enforcement and intelligence agencies which is covered by the Law Enforcement Directive (LED) Part 3 of the Data Protection Act 2018. This compliments the UK GDPR and sets out requirements for processing personal data for criminal law enforcement purposes.
- The DPA 2018 applies to all personal data held by the CPS; the definition of personal data is broader than in the DPA 1998 and also includes information such as online identifiers and biometric data
- It places a strengthened obligation regarding transparency of data processing
- It extends the rights available to data subjects. These rights are outlined below
- Guidance on how to exercise any of these rights can be found here: Make a request
- Contact details for the CPS Data Protection Officer are as follows:
Crown Prosecution Service
102 Petty France
London SW1H 9AE
The new data protection law strengthens your rights and in specific circumstances, gives you more control over how information that is held about you by the Crown Prosecution Service (CPS) is collected and used.
Under the Data Protection Act 2018 you have the following rights in respect of your personal data handled by the CPS:
You have the right to know how your personal information is collected, why it is collected and how it is used. The new law is specific about what we need to tell you when we collect your information; you do not need to make a request. There are also rules on how we must provide it to you and when we should do so.
- The information that we need to provide you with at the time of collecting personal data is known as ‘privacy information’. This can include the purpose for handling your information, who it will be shared with, transparency of your available rights, our contact details and contact details of the Information Commissioner’s Office (ICO) should you wish to make a complaint.
- Slightly different rules apply depending on whether we collect information from you directly or whether the information was collected from another source. Download a full list of the information we must provide to you in either case (where applicable).
- We strive to provide this information to you in an open and clear way, which is easy to understand and easy to access; taking particular care with regard to vulnerable people and children.
- Privacy information may be provided to you in a variety of ways, for example, by e-mail, letter or by being published on the CPS website. Whichever method we use, we must provide this information free of charge
- When we collect personal information from you we must provide you with privacy information at the time that we obtain your information or if collected from another source; within a reasonable period but at the latest within one month.
- We must ensure our privacy information is updated regularly.
There are some situations when we do not need to tell you why we are handling your personal information or we may not give you all of your privacy information because we believe that doing so for example, will prejudice (harm) the detection, investigation or prosecution of a crime or that providing the information would be impossible or involve disproportionate effort. This is known as an exemption.
Subject to certain exemptions, you have the right to receive a copy of personal information we hold about you free of charge. This is known as a right of access request.
Right of access requests are handled by the Information Access Team. Find out how to make a request for your information.
If you believe that the information we hold about you is inaccurate or incomplete you can ask us to correct this information free of charge. This is known as the right to rectification. Please be clear and exact about what you believe is inaccurate and how we should correct it, including evidence of inaccuracies where possible. If we accept that information needs to be rectified we will write to any recipients we have shared this information with and ask them to correct or complete their data also.
You have the right to request deletion or removal of your personal information where there is no valid reason for its continued handling. This is known as the right to erasure or the right to be forgotten. The CPS will only delete information in certain circumstances, and each request will be considered on a case by case basis.
You have the right in specific circumstances, to ask us to restrict (limit) how we use your personal information. The CPS will only restrict processing in certain circumstances, and each request will be considered on a case by case basis.
Data Portability is the right to move, copy, or transmit personal information easily from one IT source to another. It does not apply to personal information handled for the purposes of law enforcement.
The right to data portability only applies to the following categories of information:
- Information was handled on the basis of consent
- Information was handled on a contract
- Information was handled by purely automated means
You have the right to object - to stop us from handling your personal information in certain circumstances. This right does not apply to information handled for the purposes of law enforcement.
You have the right not to be subject to automated decision-making when we handle your information for law enforcement purposes. It is worth setting out that the CPS does not make prosecutorial decisions based on automated decision making; every charging decision is made by a lawyer acting on behalf of the CPS, based on the information provided by the police or other investigatory body.