Data Protection Policy
This document outlines how the Office of the Laura Farris MP processes and manages personal data and:
- Identifies the data controller.
- Provides the lawful basis for processing personal data.
- Outlines the scope of personal data held and processed.
- Outlines the scope of the special category personal data held and processed.
- Describes and justifies the data retention policy.
- Outlines the process of Subject Access Requests.
- Contains a copy of the privacy notice.
The policies outlined within this document came into effect on Friday 13th December 2019.
- Data Controller
The Data Controller is Laura Farris MP.
- Lawful basis for processing
Casework is processed primarily under the lawful basis of public task, with exceptional cases processed under the lawful basis of consent. The office undertakes to always act within the reasonable expectations of constituents and any other individuals about whom we hold personal data.
- Data sources
Data held is that provided by constituents when they contact this office and correspondence with third parties in response to cases taken up. We may also use the Register of Electors for the constituency, which councils provide to elected representatives under the Representation of the People Act for electoral purposes only.
- Data held
Personal data is stored electronically and securely on our computer systems. Our systems are in offices which are locked when unattended. No data is transferred outside of the EEA.
The Office uses a CMS (Content Management System) application known as CaseworkerMP, to help with the management of constituent casework records.
This information predominantly includes but is not limited to:
- Names, addresses and email addresses;
- telephone numbers;
- National Insurance numbers and Passport numbers;
- special category data (outlined in section 5).
- Special category data
The office may hold special category data for a smaller number of data subjects. This data will be processed under the lawful basis indicated in section 2, as is permitted in clauses 23 and 24 of schedule 1 of the Data Protection Act. The data may include:
- Political opinions;
- religious beliefs;
- trade union activities;
- sexual orientation;
- race and ethnic origin;
- criminal offences;
- physical and mental health.
- Data retention policy
Personal data may be held for the duration of Laura Farris’s role as Member of Parliament for Newbury. Casework and policy queries are often revisited and therefore, it is reasonable for an elected representative to hold personal data for the duration of office.
- Subject Access Requests
The office will comply with Subject Access Requests in line with the guidance given by the Information Commissioner’s Office (ICO):
- We will respond as quickly as possible, within 30 calendar days.
- We will request verification of the identity of any individual making a request, and ask for further clarification and details if needed.
- Data subjects have the right to the following:
- To be told whether any personal data is being processed
- To be given a description of the personal data, the reasons it is being processed and whether it will be given to another organisations or people.
- To be given a copy of the information comprising the data upon request, and given details of the source of the data where this is available.
- 7. Privacy notice
The office will undertake to ensure constituents sharing their personal data have the opportunity to read the privacy notice.
- The privacy notice will be published on Laura’s website.
- Information on the privacy notice will be given in staff email signatures.
- A link to the privacy notice will be included in Laura Farris’s auto-response.
- A hard copy of the privacy notice can be requested by constituents.
This privacy notice relates to the personal data processed by the Office of the Laura Farris, Member of Parliament for Newbury, in relation to casework and policy queries.
Who is the Data Controller?
The Data Controller is Laura Farris MP, Member of Parliament for Newbury.
What does the office do?
The office discharges the duties and functions of an elected Member of Parliament. As part of this work, the office conducts constituency casework and responds to policy queries, for which personal data of constituents must be processed.
How do we process data?
This office processes constituents’ data under the lawful basis of public task or legitimate interest, depending on the matter raised by the constituent. In instances where this lawful basis is not sufficient and explicit consent is required, a member of the office will contact you to establish your consent.
Will we share your data with anyone else?
If you have contacted Laura about a personal or policy issue, the office may pass your personal data on to a third-party in the course of dealing with your enquiry, such as local authorities, government agencies, public bodies, health trusts, regulators, and so on. Any third parties that we may share your data with are obliged to keep your details securely, and to use them only for the basis upon which they were originally intended.
In any case, we will not use your personal data in a way that goes beyond your reasonable expectations in contacting us.
How long will you keep my personal data?
Unless you requested differently, the office may hold personal data for the duration of Laura Farris’s role as Member of Parliament for Newbury. If required for legal purposes data will continue to be held irrespective of a request to erase.
What rights do I have to my personal data?
At any point while the office is in possession of, or processing personal data, you, the data subject, have the following rights:
- Right of access – you have the right to request a copy of the information that we hold about you.
- Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
- Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
- Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
- Right of portability – you have the right to have the data we hold about you transferred to another organisation.
- Right to object – you have the right to object to certain types of processing, such as direct marketing.
- Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
- Right to judicial review: if our office refuses your request under rights of access, we will provide you with a reason why. You have the right to complain.
How can I contact somebody about my privacy?
You can contact the office by letter (Office of Laura Farris MP, House of Commons, London, SW1A 0AA) or email (firstname.lastname@example.org).
Please note that we will ask for identification should you choose to exercise any of the above rights in relation to personal data we hold.