With regard to the General Data Protection Regulation (GDPR) (EU) 2016/679, this privacy notice relates to the personal data processed by Robert Halfon, MP for Harlow.
Who is the Data Controller?
The Data Controller is the Rt Hon Robert Halfon MP
What does the office do?
The office discharges the duties and functions of Robert as an elected Member of Parliament. Staff conduct constituency casework and respond to policy queries. This requires the processing of personal data of Robert’s constituents. A small, non-political mailing list is also managed for the purpose of sending a weekly update email about Robert’s activities in Parliament.
Your personal information – sent by email, by post or given over the phone – will be stored in a database or in his email archive and will only be accessed by Robert or the staff members he has authorised.
Why and how does the office process data?
To exercise the function of the House of Commons, Robert has lawful basis to store and process personal data of constituents. It is necessary for the “public interest or exercise of authority”.
In some cases, it is in the “legitimate interests of the data controller” to process the data. This is most likely to relate to casework where data processing may “help the constituent” or “help Robert to help the constituent in the future”.
In exceptional cases, casework may be processed under the lawful basis of consent.
How will your data be shared?
Robert will only ever use the information you send him if it will help progress your case, if it will help him get the answers he needs to help you or if it’s necessary for his work as Harlow’s elected Member of Parliament. Third parties are obliged to keep your data securely and to use it for the intended purpose only.
Data will only be shared with a third party, for example, a Government Department or local authority, when absolutely necessary and when Robert has the legal basis to do so.
For how long will data be stored?
Information will be stored for a maximum of six years. This equates to one five-year Parliamentary term, plus a window of roughly one year following the election to allow for follow-up of cases. It is considered reasonable for an elected representative to hold data for this length of term as cases can span many years and queries will need to be revisited for Robert to provide the best assistance to his constituents.
What rights do I have to my personal data?
As it’s your data, you have the right to:
- Access – you have the right to request a copy of the information that we hold about you.
- Rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
- Be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
- Restriction of processing – where certain conditions apply to have a right to restrict the processing.
- Portability – you have the right to have the data we hold about you transferred to another organisation.
- Object – you have the right to object to certain types of processing, such as direct marketing.
- Object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
- Judicial review: if our office refuses your request under rights of access, we will provide you with a reason why. You have the right to complain.
How do I request access to my data or for it to be erased?
Requests can be made in writing – by post or via email. As per guidance provided by the Information Commissioners Office (ICO):
- We will respond as quickly as possible, within 30 calendar days.
- We will request verification of the identity of any individual making a request, and ask for further clarification and details if needed.