Personal information charter

Our personal information charter contains the standards you can expect when we ask for, hold or share, your personal information.

What to expect

We will ensure that we will treat all personal information in accordance with data protection legislation, including the General Data Protection Regulation and Data Protection Act 2018.

When we, or our agencies, collect, hold, use or process in any way your personal data, you are entitled to be told:

  • the purpose for which the data is being used, and our lawful basis for processing it
  • how long we will keep your data, who we will share it with
  • whether it will be transferred or accessed outside the UK or EU, and what legal safeguards are in place to protect it
  • about any rights you may have, including the right to access your information, or to object to its being used
  • about your right to complain to the Information Commissioner if you feel that your personal information has been mishandled
  • about the identity of our Data Protection Officer (an independent advisor on data protection matters)
  • expect us to only ask for what we need, and not to collect too much or irrelevant information

You are also entitled to have your personal information:

  • protected and kept secure
  • kept accurate and up to date
  • not used for purposes which are incompatible with those for which it was collected
  • kept only for as long as it is needed for the purpose for which it was collected (unless it must be kept as part of the historic record)

What we expect

We need to handle personal information about you, (whether you are a member of the serving member of the armed forces, a veteran, a current or past civil servant, or potential recruit) and your family, so that we can provide services for you and exercise our own and associated public functions.

In return, we ask you to:

  • give us accurate information
  • tell us as soon as possible if there are any changes, such as a new address

This helps us to keep your information reliable and up to date.

Ministry of Defence Data Protection Officer

The contact details for the Data Protection Officer for the Ministry of Defence is:

MOD Data Protection Officer
Ground floor, zone D
Main Building
Whitehall
London
SW1A 2HB

Email address: cio-dpa@mod.gov.uk

Personal information that we collect and process

We collect and process personal information for the exercise of our own and associated public functions.

These include to:

  • establish entitlements to benefits and services that we provide
  • enable us to deliver our military and defence functions
  • discharge our legal obligations as an employer
  • investigate an offence, the prevent and detect crime or prosecute a crime
  • provide and administer security and intelligence matters
  • maintain and administer His Majesty’s Armed Forces
  • administer and manage courts of law or tribunals and discharge of court business
  • promote and advertise our services

We may also use information we hold about you to:

  • undertake statistical analysis to monitor performance and improve our services
  • assist in verifying your identity
  • fulfil other legal requirements

We may ask you for different types of personal data, including biometric data (such as facial images, fingerprints, and/or DNA).

How to find out what personal information we hold about you

You have the right to be informed that we are processing your personal information. In most circumstances, we will let you know at the time the information is collected. However, in certain circumstances, for example where the information is not obtained directly from you but from a third party, we will inform you of this complying with the requirement under the Data Protection legislation.

However, if you want to find out if we or any of our agencies hold any personal information about you, or want to make any corrections, you can make a ‘subject access request’ (SAR) under the Data Protection Act 2018 (DPA 18). If we do hold information about you, we will:

  • give you a description of it
  • tell you why we are holding it
  • tell you to whom it has, or will be disclosed, in particular if it has been disclosed to international organisations
  • let you have a copy of the information in a form that is as clear and understandable as possible Please be as specific as you can about the information you want, and, if it isn’t obvious, explain why you expect us to hold your personal information.

For information about how to make a SAR application see our guide on obtain information about yourself held by MOD.

Retention of personal data

We will keep your data for as long as is needed to provide you with a service or in the exercise of our own and associated public functions. Wherever possible, you will be informed of the retention period at the time the data is collected. We may keep some data for longer in order to meet other legal requirements, including to answer requests for information from ongoing or impending public inquiries. After the retention period, has elapsed all data will be destroyed securely in line with MOD data destruction policy. Our defence records management policy and procedures JSP 441 is available online.

For further information please email cio-dpa@mod.gov.uk

When we share information

We may share personal information within our organisation or with other bodies if it would be compatible with the purpose for which we collected it, and/or where we need to, or are permitted to do so by law. This may include sharing your personal information with:

  • other government departments and agencies
  • police and other law enforcement agencies
  • courts and other judicial bodies
  • foreign governments and other authorities
  • foreign law enforcement and judicial bodies
  • MOD service providers

The training and guidance we give to our staff

All our staff are trained in the importance of protecting personal and other sensitive information. Anyone working with large volumes of personal information, receives more in-depth training and takes refresher training each year. Managers who have formal responsibilities for large data sets receive additional training.

Your Rights

Under Data Protection legislation you have the following rights with regards to your personal information:

  • the right to be informed about the collection and use of your personal data
  • the right of access your personal data and supplementary information
  • the right to have inaccurate personal data rectified, or completed if it is incomplete
  • the right to erasure (to be forgotten) in certain circumstances
  • the right to restrict processing in certain circumstances
  • the right to data portability, which allows you to obtain and reuse your personal data for your own purposes across different services.
  • the right to object to processing in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to withdraw consent at any time (where relevant)
  • the right to complain to the Information Commissioner

For information about how to make an application see our guide on Data Protection: rights for data subject.

Further information can be found at: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

Requests under the Data Protection legislation

As stated above, if we hold any data about you, you have the right to ask for a copy of it through a subject access request (SAR).

There are a small number of cases where we do not have to give you the information you have asked for. For example, if we are using data for the purposes of investigating, preventing or detecting crime, or apprehending or prosecuting offenders where to do so would be likely to prejudice those purposes. In cases where it is known the police are investigating, or prosecuting offences, we will ask for their view on whether providing you with the information would prejudice their activities.

Guidance is also available on how to Obtain information about yourself held by MOD.

If you wish to exercise any of your other rights with regards to your personal information, please see our guide on Data Protection: rights for data subject or contact:

MOD Information Rights Team
Ground floor, Zone D
Main Building
Whitehall
London SW1A 2HB SW1A 2HB

Email: ISS-DataSubjectRights@mod.gov.uk

How to make a complaint to MOD

If you are dissatisfied with the way we have handled your personal information and want to make a complaint, please write to:

MOD Information Rights Team
Ground floor, Zone D
Main Building
Whitehall
London SW1A 2HB
Email: cio-dpa@mod.uk

We will acknowledge your complaint within 5 working days and send you a full response within 20 working days. If we can’t respond fully in this time, we will write and let you know why and tell you when you should get a full response.

The role of the Information Commissioner

For independent advice about data protection, privacy and data-sharing issues, you can contact the Information Commissioner at:

Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF
Tel: 08456 30 60 60 or 01625 54 57 45
Fax: 01625 524510

Website: http://ico.org.uk

Contents