Guidance

Capture investigation: DBT privacy notice

Published 14 November 2024

This privacy notice explains how the Department for Business and Trade (DBT), as a ‘data controller’, processes personal data for any communications received or policy decisions made in relation to the Capture investigation which was undertaken by Kroll acting as DBT’s processor.

This notice is supplementary to our main privacy notice which provides further information on how DBT processes personal data, and sets out your rights in respect of that personal data.

Personal data DBT collects

DBT collects information about:

• postmasters (current and former)
• Post Office employees (current and former)
• legal representatives
• journalists
• any member of the public who contacts DBT’s Capture mailbox

DBT collects the following categories of personal data:

• first names
• last name (including any previous names)
• home address (previous and current)
• postcode
• telephone number
• email address
• job titles (previous and current)
• details about contracts held (or that were held) with Post Office Limited
• financial information about shortfalls and other losses
• details about actions taken in relation to shortfalls and other losses
• complaints made by postmasters about Capture
• information relating to any criminal or disciplinary proceedings
• any relevant special category data relating to data subjects
• any other personal data that postmasters or other relevant individuals may wish to disclose in connection with the investigation

Why DBT processes this information

DBT collects this information in order to administer your queries sent to our mailbox and to inform policy decisions in relation to the Capture Investigation.
See the report of the independent investigation into Capture accounting software.

The legal basis for processing your personal data

The table below sets out the primary legal bases we rely on for processing the personal data we collect about you.

In some instances we may process your data further for a compatible purpose and on other legal bases. For example, your data may be used for archiving, research and statistical purposes. These are compatible purposes for further processing in UK GDPR and your data will be subject to appropriate safeguards if used for such purposes.

Legal basis for processing

Personal Data (Article 6(1) UK GDPR)	Special category data and criminal conviction data
Article 6(1)(e) of the UK GDPR and section 8(d) of the Data Protection Act 2018 – processing is necessary for the performance of a task carried out in the public interest, which includes the processing of personal data that is necessary for the exercise of a function of a government department.	For special category personal data: Article 9(2)(g) of the UK GDPR – processing is necessary for reasons of substantial public interest together with Paragraph 6 of Schedule 1 to the DPA 2018, statutory and government purposes, and Paragraph 33 of Schedule 1 to the DPA 2018, legal claims.
Article 6(1)(e) of the UK GDPR and section 8(d) of the Data Protection Act 2018 – processing is necessary for the performance of a task carried out in the public interest, which includes the processing of personal data that is necessary for the exercise of a function of a government department.	For criminal offence data: Schedule 1, Part 3, Paragraph 6 of the DPA 2018 – processing is necessary for the purpose of the exercise of a function conferred on a person by an enactment or rule of law; or the exercise of a function of the Crown, a Minister of the Crown or a government department, together with Paragraph 33 of Schedule 1 to the DPA 2018, legal claims.
Article 6(1)(e) of the UK GDPR and section 8(d) of the Data Protection Act 2018 – processing is necessary for the performance of a task carried out in the public interest, which includes the processing of personal data that is necessary for the exercise of a function of a government department.	For criminal offence data: Schedule 1, Part 3, Paragraph 33 of the DPA 2018 – processing is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings) or for the purpose of obtaining legal advice, or is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

How DBT processes personal data it receives

Once received, your data will be processed as follows:

Data recording and storage

Your personal information, including names, email addresses, key details regarding your enquiry, and any related convictions or prosecutions, will initially be recorded in an Excel spreadsheet. This spreadsheet is securely managed and maintained by the Capture team in DBT and securely stored in the DBT SharePoint site, within a secured, access-controlled folder.

Emails containing relevant information will also be securely stored within the DBT’s mailbox for internal processing purposes.

Secured data storage

All information will be stored on the DBT SharePoint site, specifically within a secured, access-controlled folder. This folder is managed exclusively by the Capture team in DBT to ensure restricted access and data security.

Data de-identification

Once your personal data is no longer required for assessment purposes, any identifying information will be removed. The data will be anonymised to ensure that it can no longer be traced back to you.

A de-identified dataset will remain solely for audit purposes, allowing DBT to maintain accurate records without retaining personal identifiers.

Data access and review

The information collected will be reviewed and assessed in accordance with relevant criteria by authorised personnel.

By implementing these processes, DBT ensures that your data is securely handled, and any identifiable information is removed when it is no longer necessary, preserving your privacy while maintaining audit accuracy.

Third party processors

In May 2024, DBT appointed a third-party supplier, Kroll Associates UK Limited (Kroll), to undertake a forensic investigation of Capture. Kroll was DBT’s ‘data processor’ for the purpose of this investigation.  

The policy phase which has now begun will no longer involve Kroll as processor. This notice will be updated if future processors are appointed during the next phase of the Capture investigation.

Information sharing

We may share personal data you provide:

• with other government departments, public authorities, law enforcement agencies and regulators
• with Post Office Limited where we are seeking information they hold which is relevant to your request
• with other third parties where we consider it necessary in order to further our functions as a government department
• in response to information requests, for example, under Freedom of Information (FOI) law or the Environmental Information Regulations (EIR)
• to a court, tribunal or party where the disclosure is necessary in order to exercise, establish or defend a legal claim
• where we are ordered to do so or where we are otherwise required to do so by law
• with third party data processors as governed by contract

You can find out more detailed information about how we share data and further processing in the main privacy notice.

How long DBT will hold your data for

DBT will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

If we decide that we need to process your personal data for a reason which is incompatible with the purposes for which we collected it for, we will contact you to explain why we are doing this and why it is lawful to do so.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your rights

You have a number of rights available to you under UK data protection legislation, including:

• the right to request copies of the personal data we hold about you
• the right to request that we rectify information about you which you think is inaccurate or incomplete
• the right to request that we restrict your data from further processing (in certain circumstances)
• the right to object to the processing of your data (in certain circumstances)
• the right to data portability (in certain circumstances)
• the right to request that we erasure your data (in certain circumstances)
• the right not to be subject to a decision based on solely automated data processing

You can contact DBT’s Data Protection Officer for further information about how your data has been processed by the department or to make a complaint about how your data has been used. Please contact: data.protection@businessandtrade.gov.uk  

You can also submit a complaint to the Information Commissioner’s Office (ICO) at:

Information Commissioner’s Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email casework@ico.org.uk

Telephone 0303 123 1113

Textphone 01625 545860

Monday to Friday 9am to 4:30pm

You can find out more about your rights as a data subject, and details of how to contact our Data Protection Officer and the ICO in our main privacy notice.