Horizon Convictions Redress Scheme (HCRS): privacy notice
Updated 20 January 2025
© Crown copyright 2025
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/horizon-convictions-redress-scheme-hcrs-privacy-notice/horizon-convictions-redress-scheme-hcrs-privacy-notice
This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the General Data Protection Regulation (UK GDPR).
Purpose
The Department for Business and Trade (DBT) will process your personal data to administrate and oversee the Horizon Convictions Redress Scheme (HCRS).
This scheme offers financial compensation to individuals who were wrongfully convicted of offences related to the Horizon system, whose convictions were subsequently overturned under the Post Office (Horizon System) Offences Act 2024 or the Post Office (Horizon System) Offences (Scotland) Act 2024.
DBT is the data controller for personal information provided by applicants for the purposes of the redress scheme. Third parties as detailed in this document are independent controllers in some instances for some of the personal information processed to facilitate the purpose.
For more information, see:
Your data
To facilitate the purpose as detailed, the following personal details will be processed:
- full name (including any previous names)
- date of birth
- address
- email address
- telephone number
If you are registering on behalf of someone else, we will also process the registrant’s full name, address, email address, and telephone number.
Additionally, the name and company contact details of any legal representative appointed by someone registering for the scheme will be processed.
DBT also processes sensitive information from eligible applicants. This includes:
- bank details and identity documents for identity verification checks and necessary payments
- where relevant, information provided regarding bankruptcy or individual voluntary arrangements.
- information from Post Office Limited (POL) to support eligible applicants in making their application. These documents will also include personal data, such as:
- job titles
- details about contracts held (or that were held) with POL
- financial information about shortfalls and other losses
- details about actions taken in relation to shortfalls and other losses
- details relating to claims and payments made within other redress schemes
We may also process personal information known as ‘special category’ data where an applicant submits it to support their application, including information about:
- health, including any medical conditions, health, and sickness records
- criminal convictions and offences
Lawful basis
DBT will process your special category personal information under article 9(2)(g) of the GDPR, for substantial public interest based on Union or Member State law, and article 6(1)(e) for tasks in the public interest or official authority.
For the Horizon Convictions Redress Scheme, processing personal data is vital to provide financial redress to individuals whose convictions have been quashed. Managed by DBT, this scheme involves collaboration with third parties as detailed in this privacy notice.
The statutory function is established under the Post Office (Horizon System) Offences Act 2024.
How we share your personal data
To ensure efficient management of the scheme, DBT may exchange supporting documentation with the following entities. Not every applicant’s personal data will be processed/shared between DBT and the third parties listed. Sharing depends on the individual claim, safeguards have been implemented to mitigate any known risk when sharing personal information.
- Ministry of Justice, Justice Directorate Scotland or Department of Justice Northern Ireland (as appropriate)
- Addleshaw Goddard
- Experian (as appropriate)
- UK Shared Business Services Ltd (UKSBS)
- HM Treasury
- HM Courts and Tribunals Service (HMCTS), Scottish Courts and Tribunals Service (SCTS) or Northern Ireland Courts and Tribunals Service (NICTS) (as appropriate)
- The Insolvency Service, The Insolvency Service Northern Ireland, The Accountant in Bankruptcy or any other relevant Trustee (as applicable)
- Dentons and the independent panel which act as an alternative dispute resolution provider (as applicable)
- some significant correspondence may be kept for historical records and may be transferred to The National Archives in due course
- relevant information may be provided for the Post Office Horizon IT Inquiry or POL, if related applications arise
DBT may also share application documentation with the Government Internal Audit Agency (GIAA) as part of the scheme’s assurance process if required. Names and addresses will be redacted from documentation before being sent to GIAA, but in some cases, it may nonetheless be possible to identify individuals.
DBT takes the security of your personal data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused, or disclosed, and that it is not accessed by anyone except our employees or entities mentioned above in the proper performance of their duties.
Retention of personal data
Personal data will be processed and retained for no longer than the purpose requires, taking account of legal requirements.
The personal data of eligible applicants’ will be retained for 7 to 25 years after the settlement of your application, to meet legal requirements.
Personal information of ineligible applicants will be retained for 3 years after the date of registration to enable action, should information be submitted that enables a claim to be processed. The personal data will also be retained for this period to evidence the basis for ineligibility. Data will be securely deleted after this period.
Your data protection rights
Your personal information is being processed under the lawful basis of public task, as such, you are afforded the following rights:
- Right to be informed: Individuals have the right to be informed about the collection and use of their personal data. This includes details about the purposes for processing, the retention periods, and who it will be shared with.
- Right of access: Individuals have the right to access and receive a copy of their personal data, and other supplementary information. This allows them to be aware of and verify the lawfulness of the processing.
- Right to rectification: Individuals have the right to have inaccurate personal data rectified or completed if it is incomplete.
- Right to restrict processing: Individuals have the right to request the restriction or suppression of their personal data under certain circumstances.
- Right to data portability: This right allows individuals to obtain and reuse their personal data for their own purposes across different services. It applies to data provided by the data subject, where the processing is based on consent or for the performance of a contract, and the processing is carried out by automated means.
- Right to object: Individuals have the right to object to the processing of their personal data in certain circumstances. This includes the right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling), direct marketing, and processing for purposes of scientific/historical research and statistics.
- Rights related to automated decision making and profiling: Individuals have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
Contact details
The data controller for your personal data is the Department for Business and Trade . You can contact the Department’s Data Protection Officer at:
Data Protection Officer
Department for Business and Trade
Old Admiralty Building
Admiralty Place
London
SW1A 2DY
Complaints
If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Monday to Friday 9am to 4:30pm
Any complaint to the Information Commissioner is without prejudice to your rights to seek redress in the courts.