This notice is to explain your rights, give you the information you are entitled to, and set out the standards you can expect when we ask for, hold or share your personal information in accordance with the applicable Data Protection Legislation including the Data Protection Act 2018 and the UK GDPR. It also covers what we ask of you, to help us keep the information up to date. This privacy notice applies to any personal data processed for the purposes of running the Army Welfare Service.
It explains:
-
The MOD Data Controller and Data Protection Officer
-
Why we are collecting or processing your data
-
The personal data we collect and use
-
The legal basis for processing your personal data
-
Sharing your personal data
-
Data retention
-
What we ask of you
-
Your rights
-
How to find out what information we hold about you
-
The transfer of personal data to other countries
-
Automated decision making
-
How we store personal data
-
How to complain
The Ministry of Defence is acting as the data controller for all personal data held by the Army Welfare Service. The Ministry of Defence Data Protection Officer is located at MOD Main Building and can be contacted via:
MOD Data Protection Officer
Ground Floor, Zone D,
Main Building,
Whitehall,
London,
SW1A 2HB
Your personal data is being collected and processed to enable the AWS to deliver its primary objective of delivering a comprehensive, professional and confidential welfare support service responsive to the needs of individuals, families and the chain of command to maximise the operational effectiveness of service personnel.
The purposes of our processing include to:
-
Maintain up to date records to enable us to deliver our military and defence functions.
-
Discharge our legal obligations as an employer.
-
Investigate an offence, the prevention and detection of crime or prosecuting a crime.
-
Provide and administer security and intelligence matters.
-
Maintain and administer her Majesty’s Armed Forces.
-
Administer and manage courts of law or tribunals and discharge of court business.
-
Promote and advertise our services.
-
Undertake statistical analysis to monitor performance and improve our services.
-
Assist in verifying your identity.
-
Establish entitlements to benefits and services that we provide.
-
Fulfil other legal requirements.
If you choose to give us your personal information to provide you with a welfare service, then this will be held and processed by us in accordance with the applicable Data Protection Legislation . AWS may also need to transfer your personal information to its agents or subcontractors who will process it on the AWS’s behalf.
In order to meet the purposes described at point 2, we need to collect and use “personal data” about you. Examples of personal data are – name, address, date of birth and anything else which could be used to identify you personally. We may ask you for different types of personal data, including biometric data such as facial images, or health data, which are known as “special category data”.
To comply with the applicable Data Protection Legislation, we rely on an appropriate legal basis when processing personal data about you. For the purposes of processing in the AWS, we will rely on one of the following legal bases:
-
Public task - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. For example, we rely on public task for the delivery of a welfare service to our Service Personnel and Service Users, and to deliver events and workshops to our service families and the public.
-
Legal Obligation - processing is necessary where required by legislation i.e. Safeguarding, Child Protection.
-
Vital Interests - the processing is necessary to protect someone’s life. This also covers staff who act in loco parentis. For example, when staff and volunteers run an event or workshop, we rely on the vital interest basis for collecting data to provide to emergency services, and emergency contact information to allow staff to contact someone who can provide care in the event of an incident.
-
Consent - the individual has given clear or explicit consent for us to process their personal data for a specific purpose – for example, we will ask for your consent to take photographs during our events.
We may share personal data within our organisation or with other bodies if it would be compatible with the purpose for which we collected it, and/or where we need to, or are permitted to do so by law. This may include sharing your personal data with:
-
MOD funded organisations
-
Law Enforcement Agencies
-
Courts and Judicial bodies
-
Local authorities
-
Hospitals
-
Other Government Departments
-
Schools
-
Accreditation Providers
We will only keep your data for as long as required to provide you with a service or conduct our business in accordance with our functions in line with MOD Policy. Wherever possible, you will be informed of the retention period at the time the data is collected.
We may keep some data for longer to meet other legislative requirements, or to answer requests for information from ongoing or impending statutory inquiries.
After the retention period has elapsed all data will be destroyed securely in line with MOD data destruction policy.
We ask you to:
-
Give us accurate data
-
Tell us as soon as possible if you no longer wish for us to hold your data
-
Inform us if there are any changes to your personal data, such as name or email address, of if any of the data we hold is incorrect.
This helps us to keep your data reliable and up to date.
Under Data Protection legislation you have the following individual rights with regards to your personal data:
-
The right to be informed about the collection and use of your personal data.
-
The right to access your personal data and supplementary information.
-
The right to have inaccurate personal data rectified, or completed if it is incomplete.
-
The right to erasure (to be forgotten) in certain circumstances.
-
The right to restrict processing in certain circumstances.
-
The right to data portability, which allows you to obtain and reuse your personal data for your own purposes across different services.
-
The right to object to processing in certain circumstances.
-
Rights in relation to automated decision making and profiling.
-
The right to withdraw consent (where relevant).
-
Right to complain to the Information Commissioner.
Further information about your rights can be found on the ICO website.
As set out above, you have the right to be informed that we are processing your personal data. In most circumstances, we will let you know at the time the data is collected. However, in certain circumstances, for example where the data is not obtained directly from you but from a third party, we will inform you of this, complying with the applicable Data Protection Legislation.
However, if you want to find out if we or any of our agencies hold any personal data about you, you can make a ‘Subject Access Request’ (SAR) under the Data Protection Act 2018. If we do hold data about you, we will:
-
Give you a description of it.
-
Tell you why we are holding it.
-
Tell you to whom it has, or will be disclosed; in particular, if it has been disclosed to international organisations.
-
Let you have a copy of the data in a form that is as clear and understandable as possible.
Please be as specific as you can about the data you want, and, if it isn’t obvious, explain why you expect us to hold your personal data. Information about how to make a Subject Access Request (SAR) can be found in the MOD SAR Guidance.
Requests for data held by AWS must be submitted to [email protected] with proof of identity.
There are a small number of cases where we do not have to give you the information you have asked for. For example, if we are using data for the purposes of investigating, preventing or detecting crime, or apprehending or prosecuting offenders where to do so would be likely to prejudice those purposes. In cases where it is known the police are investigating, or prosecuting offences, we will ask for their view on whether providing you with the information would prejudice their activities.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we are allowed under the law to charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we can refuse to comply with the request in such circumstances.
Sometimes it may be necessary to transfer personal information overseas, for example, when we conduct welfare work in overseas territories. When this is needed, information may be transferred to countries or territories around the world. Any transfers made will be in full compliance with all aspects of the applicable Data Protection Legislation.
The AWS do not rely on automated decision making when processing personal data.
Digital data will be held securely on a UK Government IT system; physical hard copy data will be stored in suitable security containers in AWS locations with restricted access, information audit forms will be kept meeting legislation requirements.
Any data shared with the organisations listed in section 5 will be processed on suitably secure IT systems in line with the applicable Data Protection Legislation.
If you are unhappy with any aspect of this privacy notice, or how your personal information is being processed, please contact:
MOD Information Rights Team
Ground Floor, Zone D,
MOD Main Building,
Whitehall,
London SW12 2HB
Email: [email protected]
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Information Commissioner’s Officer
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AL
Tel: 0303 123 1113
Email: [email protected]
https://ico.org.uk/global/contact-us/