Data Protection Policy

1. Statement of Policy

The Data Protection Policy enables Dyfed-Powys Police to establish good practices around the use and handling of information, promote a culture of awareness and improvement and comply with legislation. Its aim is to provide employees with a framework that outlines the appropriate use of personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act (DPA) 2018 and other related legislation.

This policy is essential in helping Dyfed-Powys Police employees understand how to look after the information they use in order to fulfil their duties and provide the best possible service. It should also assist in promoting a culture of awareness and improvement across the Force surrounding responsibilities and accountability regarding data protection, the data protection principles, data protection breach reporting and data subject rights.

Information is a powerful tool and a vital asset, in regard to both law enforcement processing and the management of services and resources across the Force. It is of paramount importance that employees have access to the information they need to undertake their duties safely and effectively, but also that confidential and sensitive information remains secure. This applies to information relating to the organisation, its employees and the public. It is also vital that appropriate policies, procedures and processes provide a solid foundation for data protection compliance across the entire Force.

Applies (but not limited) to: All categories of Dyfed-Powys Police employees, whether full-time, part-time, permanent, fixed term, temporary (including agency staff, associates and contractors) or seconded staff.   Any employee accessing and using Force assets and property must have due regard to the contents of this policy.

 

2. Policy Scope

Dyfed-Powys Police has a statutory obligation to process personal data in accordance with the provisions of the UK GDPR in respect of non law enforcement processing and the DPA 2018 in respect of law enforcement processing.

Dyfed-Powys Police complies with the College of Policing Authorised Professional Practice (APP) on Information Management.  The APP provides clear standards and guidance in regards to UK data protection legislation. In addition, Dyfed-Powys Police follows any and all relevant guidance provided by the Information Commissioner’s Office (ICO) in regard to data protection matters.

All employees are required to understand their responsibilities under UK data protection legislation. Data protection is the responsibility of ALL employees and this policy must be adhered to at all times. This policy is triggered as soon as an authorised individual comes into contact with personal data processed by, or on behalf of, Dyfed-Powys Police.

There are many potential risks to the Force, if this policy is not adhered to. These include, but are not limited to:

• Inability to secure and maintain individuals’ trust and confidence in the Force
• Damage to the Force reputation
• Failure to comply with relevant legislation
• The potential breach of UK data protection legislation, resulting in potential action being taken against the Force by the ICO, for being unable to meet its information rights obligations
• Inaccurate information being held which could have an impact on operational and business requirements

 

3.  Powers and Policy/Legal Requirements

Dyfed-Powys Police has a legal obligation to comply with UK data protection legislation. Dyfed-Powys Police will also refer to the College of Policing, APP - Information Management – Data Protection. 

Relevant legislation includes:

• The Data Protection Act 2018
• The UK General Data Protection Regulation (UK GDPR)
• Computer Misuse Act 1990
• Freedom of Information Act 2000
• Crime and Disorder Act 1998
• Criminal Justice and Immigration Act 2008
• Human Rights Act 1998
• Regulation of Investigatory Powers Act 2000
• Protection of Freedoms Act 2012

The processing of personal data, by the Force, is governed by the DPA 2018 and the associated UK GDPR. Employees need to be aware that this processing of data can be categorised in two ways:

1. Processing under PART 2 of the DPA 2018 – General processing

Part 2 of the DPA 2018 applies to “general data”, which is personal data that is processed for a reason not involving law enforcement or national security e.g. employment purposes or public relations.

2. Processing under PART 3 of the DPA 2018 – Law enforcement processing

Part 3 of the DPA 2018 applies to “competent authorities” such as Police Forces who process data for law enforcement purposes.

The data protection principles, as defined under the UK GDPR, should sit at the centre of the Force’s approach to processing personal data. Full details are available in the Data Protection Guidance Document.

All employees should also have an understanding of data subject rights, under UK data protection legislation. Full details are available in the Data Protection Guidance Document, with specific guidance surrounding requests for personal data available.

This policy should also be read in conjunction with the following related policies, protocols, practices and/or service agreements:

• Data Protection Guidance Document
• Data Protection Breach Policy
• Information Security Policy
• Freedom of Information Policy
• Information Sharing Policy
• Data Protection Impact Assessment (DPIA) Policy
• Records Management Policy
• Data Protection Compliance Audit Policy
• College of Policing Authorised Professional Practice (APP) Information Management Guidance
• College of Policing APP – Compliance Audit
• The National Police Chiefs Council (NPCC) Data Protection Manual of Guidance
• The Information Commissioner’s Office’s Code of Practice and Guidance
• NPCC Senior Information Risk Owner (SIRO) handbook
• NPCC Information Asset Owner (IAO) handbook

 

4.  Options and Contingencies

Roles and Responsibilities within Dyfed-Powys Police

Chief Constable

The Chief Constable of Dyfed-Powys Police is the Data Controller and as such has overall responsibility for the lawful processing of all personal data processed by the Force. They also have overall accountability for procedural documents and have ultimate responsibility for compliance of this policy and data protection across the entire Force. The Data Controller has specific responsibilities under the UK-GDPR and the Data Protection Act 2018.

 

Senior Information Risk Owner (SIRO)

The Deputy Chief Constable (DCC) of Dyfed-Powys Police is the appointed Senior Information Risk Owner (SIRO). They are responsible for:

• Overall accountability for information risk across the Force
• Representing and championing information risk
• Remaining up-to-date on all necessary training in order to remain effective in their role as SIRO
• Understanding the impact of information risks on the Force’s risk register, and how those risks may be minimised and managed, and
• Chairing the Information Assurance Board
• The SIRO has specific responsibilities in relation to information risk as identified within the NPCC SIRO Handbook (2018).

 

Data Protection Officer (DPO)

The Head of Information Management of Dyfed-Powys Police is the appointed Data Protection Officer (DPO). They are responsible for:

• Protecting the confidentiality of personal data across the Force
• Representing and championing data protection issues and requirements
• Ensuring that the Force satisfies the highest practical standards for handling personal data
• Enabling suitable information sharing with other bodies
• Ensuring that data protection issues are appropriately reflected in Force policies, procedures, processes and strategies for employees
• Assisting the Force in demonstrating compliance with UK data protection legislation as part of the enhanced focus on accountability
• Acting as a point of contact for data subjects and the ICO, and
• Informing and advising on data protection obligations Force wide.
• The Data Protection Officer has specific tasks mandated by data protection legislation.

 

Information Asset Owner(s) (IAO)

Information Asset Owners (IAO) are senior employees who are the nominated owners of one or more identified information assets. They are responsible for:

• Monitoring and understanding what information – paper and electronic – is being held and how it is maintained; knowing and approving who has access to it and why.
• Seeking to use information fully within the law
• Identifying and addressing risks to the information, and
• Encouraging a culture that values, protects and uses information for the public good.
• An IAO has a range of responsibilities which are described within the NPCC’s IAO Handbook.

 

Data Protection Advisor

The Data Protection Advisor is responsible for:

• Maintaining awareness of data protection issues across the Force
• Encouraging a culture that values, protects and uses information for the public good
• Reviewing and updating the Data Protection Policy when appropriate, in line with legislation
• Reviewing and updating all procedures and processes relating to this policy where appropriate
• Ensuring all line managers are aware of their responsibilities and accountability regarding data protection and the requirements of this policy
• Ensuring all employees are provided with the appropriate and necessary training to further their understanding of the principles of data protection and their application, and
• Informing and advising on data protection obligations Force wide.

 

Line Managers

All Line Managers are responsible for ensuring that the Data Protection Policy is implemented and adhered to within their department.

 

All Employees

All employees are responsible for adhering to the Data Protection Policy and related documentation. They will receive instruction, direction and updates regarding the policy from:

• Line managers
• Dyfed-Powys Police DPO
• Mandatory data protection e-learning module(s). All employees, throughout the organisation, are required to be up-to-date with data protection training and refresher training commensurate with their role - full details are available in the Data Protection Guidance Document.
• Dyfed-Powys Police Intranet, and
• Policy and procedure manuals and documentation

 

Information Assurance Board

The role of the Information Assurance Board is:

• To maintain strategic oversight, and support the management of, all activities related to the use, processing, retention, and transmission of information or data under the control of Dyfed-Powys Police and the structures, systems and processes used for those purposes in accordance with the College of Policing APP on Information Management
• Provide governance support and direction to the Information Management and Compliance Department in line with the Force vision to ‘Safeguard our Communities Together’, and
• Work in line with the other groups and boards in delivering the mission, vision and values of the Force, the Chief Constable’s vision and the delivery plan in support of the Police and Crime Plan.

 

Code of Ethics principles

The Code of Ethics is a national code of practice, which defines core policing values and the standards of behaviour for everyone who works in policing. In line with these nine principles, the Data Protection Policy seeks to embed the following:

Accountability - You are answerable for your decisions, actions and omissions.

Fairness - You treat people fairly.

Honesty - You are truthful and trustworthy.

Integrity - You always do the right thing.

Leadership - You lead by good example.

Objectivity - You make choices on evidence and your best professional judgement.

Openness - You are open and transparent in your actions and decisions.

Respect - You treat everyone with respect.

Selflessness - You act in the public interest.

This policy places specific emphasis on:

Accountability - Under UK data protection legislation, the accountability principle requires taking responsibility for how personal data is dealt with and proving compliance with the other data protection principles.

Fairness - Under UK data protection legislation, the element of fairness (which forms part of a larger principle) requires the processing of personal data to always be fair as well as lawful. This means not using personal data in ways that could have unjustified adverse effects on data subject.

 

5.   Take action and review

This policy is owned by the Information Management and Compliance Department. The review process will be conducted by the Data Protection Advisor on a biennial basis to ensure the continued effectiveness of the policy, and taking into account any changes to legislation, national guidance, ICO guidance etc.

The effectiveness of the policy will be monitored on a regular basis over and above the two year review period and any major concerns will be escalated as appropriate. 

Effectiveness of the policy will be measured through the Force Data Protection Compliance Audit process. The aim being to check awareness of and compliance with UK data protection legislation in practice. Also, measuring the number of queries directed at the Department in regard to the policy will allow its effectiveness to be measured.

In the case of any queries regarding this policy, it’s content, or associated guidance documentation - individuals should contact:

• Dyfed-Powys Police Data Protection Advisor
• Email: [email protected]
• Post: Data Protection Advisor, Dyfed-Powys Police, PO BOX 99, Llangunnor, Carmarthenshire, SA31 2PF

Appropriate promotion of this policy will take place, which can include awareness raising when training inputs and presentations are provided to employees across the Force. The policy will be made available on the Force intranet and internet sites.  Publication via the internet will ensure that it is available for public view.

Any issues of concern or risk in respect to compliance with UK data protection legislation across the Force will be escalated to the Force Data Protection Officer, Force SIRO and Information Assurance Board, dependent on severity.

Information regarding potential data protection breaches across the Force, will be processed in line with the Force Data Protection Breach Policy. Full details surrounding the process of reporting a personal data breach are available in the Data Protection Guidance Document. Such reporting, and subsequent investigation, may highlight issues with this policy and associated guidance, which could result in a necessary review. If this is the case, relevant action will be taken. The Data Protection Advisor will work closely with representatives from the relevant departments to address the issues and ensure that any lessons learned will be fully reported and cascaded as necessary. Data protection breaches are reported upon to the Information Assurance Board and the Policing Board.

 

CODE OF ETHICS CERTIFICATE OF COMPLIANCE

This policy has been drafted in accordance with the Code of Ethics and has been reviewed on the basis of its content and the supporting evidence and it is deemed compliant with that Code and the principles underpinning it.

 

HUMAN RIGHTS ACT CERTIFICATE OF COMPLIANCE

This policy has been drafted in accordance with the Human Rights Act and has been reviewed on the basis of its content and the supporting evidence and it is deemed compliant with that Act and the principles underpinning it.

 

EQUALITY IMPACT ASSESSMENT

Section 4 of the Equality Act 2010 sets out the protected characteristics that qualify for protection under the Act as follows: Age; Disability; Gender Reassignment; Marriage and Civil Partnership; Pregnancy and Maternity; Race; Religion or Belief; Sex; Sexual Orientation.

The public sector equality duty places a proactive legal requirement on public bodies to have regard, in the exercise of their functions, to the need to:

• eliminate discrimination, harassment, victimisation, and any other conduct that is unlawful under the Act;
• advance equality of opportunity between persons who share a relevant protected characteristic and persons who do not share it;
• foster good relations between persons who share a relevant protected characteristic and persons who do not share it.

The equality duty applies to all protected characteristics with the exception of Marriage and Civil Partnership, to which only the duty to have regard to the need to eliminate discrimination applies.

Carrying out an equality impact assessment involves systematically assessing the likely or actual effects of policies on people in respect of all the protected characteristics set out above. An equality impact assessment should be carried out on any policy that is relevant to the public sector equality duty. 

EQUALITY IMPACT ASSESSMENT COMPLETED: 27/09/2022