OEP Privacy Notice

The Office for Environmental Protection (“OEP”) is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you as part of our legal obligations, in accordance with the UK General Data Protection Regulation (UK GDPR).

This Privacy Notice will be updated on a regular basis. It may be the case that additional privacy notices are provided on specific occasions that will inform you of how and why we are using such information. It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using that information and what your rights are under the data protection legislation.

The OEP’s Personal Information Charter sets out the standards you can expect from us when we process your personal information. It also explains how you can ask to view, change, or remove your information from our databases.

Purpose of this privacy notice

This privacy notice explains how we process your personal data when:

You use our website
Submit an enquiry to us
Submit a complaint to us
Engage with stakeholder consultation

Controller

The OEP is the “controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

What data do we collect

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the person's identity has been removed (anonymous data).

There are certain types of more sensitive personal data which require a higher level of protection, such as information about a person's health, sexual orientation or criminal convictions (special category data). Special categories of data need more careful handling, and we need further justification for collecting, sorting and using this type of personal information. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

We may collect, use and store the following categories of personal data about you:

Your name,
Contact details including postal address(es), email address(es), and telephone number(s);
The nature of your complaint, enquiry or consultation response;
Details of the public authority you are complaining about;
General correspondence, questions, queries or feedback;
Telephone messages;
Your Internet Protocol (IP) address and details of which version of web browser you use;
Information on how you use the site, using cookies and analytics;
Sensitive personal information including information about your health (special category data) if you provide that to us as part of an enquiry or complaint.

How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

To contact you to find out more information about your complaint and to update you about your complaint.
To respond to your enquiry.
To maintain statistics on the use of our website.
To help us understand the potential health impacts linked to your complaint.

You use our website

We use your personal data to maintain statistics on the use of our website. Further information about the cookies we use can be found in our cookies policy.

Submit an enquiry to us

We will process your personal data if you provide us with your personal data when submitting an enquiry by whatever means, including via our contact form on our website. We will process your personal data in order to understand your enquiry and respond to you.

Submit a complaint to us

The OEP has been set up to receive complaints about environmental law against public authorities. The data will be collected and processed towards the administration of a complaint against a public authority which the complainant believes to be in breach of environmental law. This is being done to ensure appropriate monitoring and collection of data about potential environmental law breaches. This is a specific privacy notice on the processing of your personal data as part of your complaint.

Engage in a stakeholder consultation

We will process your personal data if you provide us with your personal data when responding to consultations that we carry out. We will process your personal data in order to understand your response as part of views being gathered. We may also use your details to contact you about your response.

If you do not provide personal information

If you do not provide certain information when requested, we may not be able to fully assist you. For example, if we do not have your contact details, we will not be able to respond to your enquiry.

Lawful basis

Under the UK General Data Protection Regulations (GDPR) 2018, we must have a lawful basis for processing our personal data.

For most of our processing the lawful bases we rely on is Article 6(1)(e) of the UK GDPR. This allows OEP to process personal data where it is necessary for the performance of a public task, in our role as a statutory body.

The legal basis for collecting Internet Protocol (IP) addresses, and hostnames of website users or any non-essential cookies is your consent (Article 6(1)(a) of the UK GDPR).

If as part of your enquiry or complaint you provide any special categories of personal data, such as health data then we also process this under Article 9(2)(g) of the UK GDPR where processing is necessary for public interest. We also rely on Schedule 1 Part 2 Paragraph 6 of the Data Protection Act 2018 which allows processing for statutory purposes.

Disclosure of your personal data

If you make a complaint to us, your information will be shared with the public authority you are complaining about (where it is necessary to determine that your complaint has first been processed through their internal procedure).

Your information may also be shared with:

Other public authorities suspected of committing breaches of environmental law linked to the breach you have complained about.)
Other public authorities including the relevant Ombudsman.
Government Ministers, Secretaries of State and their officials for the purpose of identifying systemic issues or to ensure protection of people and the environment in urgent cases.
The National Archives, when cases are closed, and it is appropriate to do so.
External service providers (where we have outsourced the services) who are acting as our processors.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Where are your data transferred and stored

We transfer your data through our secured servers. We do not transfer your personal data outside the UK.

The complaint portal that we use is Jira Service Desk software and for more details on how this software processes data, please see Atlassian Privacy Policy.

Data retention

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. We will only retain your personal data in line with the OEP’s retention policy.

When you submit a complaint about a public authority failing to comply with environmental law, the information you supply to the OEP will be retained for the duration of processing the complaint and any subsequent proceedings arising. Data is retained in line with our Data Retention Policy and for routine complaints, data is held for 7 years after the resolution of the complaint.. Anonymised information relating to the complaint may be retained for a longer period for statistical purposes.

In specific circumstances information may be held for longer periods. Examples include:

To allow auditing of complaint activities.
For legal processes e.g. enforcement, a pending court case.
If it sets a precedent.
For scientific or historical research purposes.
To enable identification of connected, widespread, or systemic breaches of environmental law.
To allow OEP to meet its legal obligations under the Environmental Bill (once enacted).
To meet obligations under the Public Records Act 1958.

Why you need to create a set of sign-in details for submitting complaints

We ask you to create a single set out sign-in details to save you time and to support the administration of the system. You will be able to use them to register with and access the OEP’s online complaints handling system. We will store basic information about you so that you do not need to re-enter the information each time you want our services.

Your information will be shared with all the administrators associated with your account to allow them to manage access.

Your legal rights

Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as a data subject access request). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below). This could prevent us from administering your complaint.
Object to processing of your personal data (using) at any time.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact our Data Protection Officer in writing.

You will not have to pay a fee to access your personal information (or to exert any of the other rights). We have one month to respond to your request.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing, and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Data Protection Officer. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Where you have consented to us contacting you, you always have the right to withdraw your consent. The easiest way to do this is to click the unsubscribe link that is included in communications from us. You can also contact us at any time to ask us not to send you communications.

Links to other websites

Where we provide links to other websites of other organisations, this Privacy Notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices of other websites you visit, links to these can also be found in our cookie policy.

YouTube videos

We use YouTube to provide videos on some pages of the site. YouTube sets cookies when you visit one of these pages.

Contact details

If you have any questions about this privacy policy or our privacy practices, please contact our Data Protection Officer in the following ways:

Full name of legal entity: Office of Environmental Protection

Email address: dataprotection@theoep.org.uk

Postal address:

Data Protection Officer
Office for Environmental Protection
Wildwood
Wildwood Drive
Worcester
WR5 2QT

Your right to complain to the ICO

If you are not satisfied by the result of this process, any individual can complain to the Information Commissioner if they believe the OEP has failed to properly protect their personal information, or to comply with these rights. The Information Commissioner can be contacted as follows:

https://ico.org.uk

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

General complaints

If you have a complaint about the way we operate or the services we provide, or generally are unhappy about any of our processes, we would like to hear from you. In the first instance please contact the OEP team at enquiries@theoep.org.uk.

If you wish to make a formal written complaint, you should send it in writing to our Service Standards Adjudicator by post or email using the contact details below:

Full name of legal entity: Department for Environment, Food & Rural Affairs

Email address: service-standards.adjudicator@defra.gov.uk

Postal address: Department for Environment, Food & Rural Affairs, Area 5B, Nobel House, 17 Smith Square, London, SW1P 3JR.

Please do not forget to include a return contact email or postal address for responses to your complaint.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

Last updated 07 December 2022