Data protection and the CPS
The CPS is committed to maintaining high data protection standards. The Data Protection Compliance Team (DPCT) lead on the organisation’s data protection work, including by delivering annual data protection training to all CPS employees.
The CPS processes data under both the Data Protection Act (DPA) 2018 and the UK General Data Protection Regulation (UK GDPR). We process personal data under Part 3 of the Data Protection Act 2018 when we are processing for law enforcement purposes. Any personal data we process for non-law enforcement purposes, or rather for ‘general processing’, we process under the UK GDPR.
The UK GDPR sets out the key principles, rights and obligations for ‘general processing’ of personal data in the UK. Part 3 of the Data Protection Act 2018 complements the UK GDPR and sets out requirements for processing personal data for criminal law enforcement purposes.
For more information on the personal data we process, please see the CPS Privacy Notice.
The contact details for the CPS Data Protection Officer are as follows:
Jackie Ronchetti
Crown Prosecution Service
102 Petty France
London SW1H 9AE
Email: dataprotectionofficer@cps.gov.uk
The Information Commissioner’s Office (ICO) is the regulatory body in the UK responsible for upholding information rights in the public interest. They are an important stakeholder for the CPS - we liaise with them to ensure we work in line with best practice and respond efficiently to any recommendations. The contact details for the ICO are as follows:
Address:
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline telephone number: 0303 123 1113
Website address: https://ico.org.uk/
Under the Data Protection Act 2018, you have the following rights in respect of your personal data handled by the CPS:
You have the right to know how your personal information is collected, why it is collected and how it is used. The new law is specific about what we need to tell you when we collect your information; you do not need to make a request. There are also rules on how we must provide it to you and when we should do so.
- The information that we need to provide you with at the time of collecting personal data is known as ‘privacy information’. This can include the purpose for handling your information, who it will be shared with, transparency of your available rights, our contact details and contact details of the Information Commissioner’s Office (ICO) should you wish to make a complaint.
- Slightly different rules apply depending on whether we collect information from you directly or whether the information was collected from another source. Download a full list of the information we must provide to you in either case (where applicable).
- We strive to provide this information to you in an open and clear way, which is easy to understand and easy to access; taking particular care with regard to vulnerable people and children.
- Privacy information may be provided to you in a variety of ways, for example, by e-mail, letter or by being published on the CPS website. Whichever method we use, we must provide this information free of charge
- When we collect personal information from you we must provide you with privacy information at the time that we obtain your information or if collected from another source; within a reasonable period but at the latest within one month.
- We must ensure our privacy information is updated regularly.
There are some situations when we do not need to tell you why we are handling your personal information or we may not give you all of your privacy information because we believe that doing so for example, will prejudice (harm) the detection, investigation or prosecution of a crime or that providing the information would be impossible or involve disproportionate effort. This is known as an exemption.
Subject to certain exemptions, you have the right to receive a copy of personal information we hold about you free of charge. This is known as a right of access request.
Right of access requests are handled by the Information Access Team. Find out how to make a request for your information.
If you believe that the information we hold about you is inaccurate or incomplete you can ask us to correct this information free of charge. This is known as the right to rectification. Please be clear and exact about what you believe is inaccurate and how we should correct it, including evidence of inaccuracies where possible. If we accept that information needs to be rectified we will write to any recipients we have shared this information with and ask them to correct or complete their data also.
You have the right to request deletion or removal of your personal information where there is no valid reason for its continued handling. This is known as the right to erasure or the right to be forgotten. The CPS will only delete information in certain circumstances, and each request will be considered on a case by case basis.
You have the right in specific circumstances, to ask us to restrict (limit) how we use your personal information. The CPS will only restrict processing in certain circumstances, and each request will be considered on a case by case basis.
Data Portability is the right to move, copy, or transmit personal information easily from one IT source to another. It does not apply to personal information handled for the purposes of law enforcement.
The right to data portability only applies to the following categories of information:
- Information was handled on the basis of consent
- Information was handled on a contract
- Information was handled by purely automated means
You have the right to object - to stop us from handling your personal information in certain circumstances. This right does not apply to information handled for the purposes of law enforcement.
You have the right not to be subject to automated decision-making when we handle your information for law enforcement purposes. It is worth setting out that the CPS does not make prosecutorial decisions based on automated decision making; every charging decision is made by a lawyer acting on behalf of the CPS, based on the information provided by the police or other investigatory body.