Notice

Office for Artificial Intelligence – information collection and analysis: privacy notice

Published 29 March 2023

Note: Due to the recent Machinery of Government (MoG) changes, the Office for Artificial Intelligence (OAI) is in the process of transitioning from the Department for Digital, Culture, Media & Sport (DCMS) to the Department for Science, Innovation & Technology (DSIT). DCMS remains the data controller and all references in this privacy notice to ‘we’, ‘us’, ‘our’ will refer to DCMS until the transfer of functions from DCMS to DSIT is completed, at which point this notice will be updated.

Purpose of this privacy notice

The purpose of this privacy notice is to explain how the Office for Artificial Intelligence (‘OAI’) collects and processes the personal data we request from you as part of our consultation survey on our proposals for the regulation of artificial intelligence. It is provided to meet our obligations set out in Articles 13 and 14 of the UK General Data Protection Regulation (‘UK GDPR’) and the Data Protection Act 2018 (‘DPA 2018’) to make information publicly available about the way in which we process personal data.

You may also find it helpful to refer to our personal information charter (opens in a new tab), which sets out the standards you can expect when we collect, hold or use your personal information.

Privacy policies of other websites

The OAI uses a website called ‘Qualtrics’ to design and host the survey. You can find the privacy notice for Qualtrics here: www.qualtrics.com/privacy-statement/

Who is responsible for collecting my data?

The OAI is a unit within the Department for Science, Innovation and Technology responsible for overseeing implementation of the National AI Strategy.

DCMS is the controller under UK GDPR for the personal information we process, unless otherwise stated.

What is the purpose for which we collect personal data?

The purpose of the OAI’s work is to oversee the implementation of the National AI Strategy. Its mission is to drive responsible and innovative uptake of AI technologies for the benefit of everyone in the UK. The Office for AI does this by engaging with organisations and securing broad public trust and support, focused on three pillars:

• Investing in and planning for the long term needs of the AI ecosystem to continue our leadership as a science and AI superpower;
• Supporting the transition to an AI-enabled economy, capturing the benefits of innovation in the UK, and ensuring AI benefits all sectors and regions;
• Ensuring the UK gets the national and international governance of AI technologies right to encourage innovation, investment, and protect the public and our fundamental values.

See What is the lawful ground for processing data below for more information.

What personal data do we collect?

The personal information we collect and process is provided by you directly to us. This includes personal identifiers, contacts and characteristics including your name, the name and type of organisation you are responding for (if relevant), the industry sector you work in or represent, and email address (optional).

What is the legal basis for processing my data?

Our lawful ground for processing personal data is set out in Article 6(1)(e) of the UK GDPR as the processing is necessary for us in our work as a public body and in the public interest. In particular, the processing is necessary for the exercise of our function as the government department responsible for addressing disinformation online, as permitted under section 8(d) of the DPA 2018.

The OAI does not seek to collect special categories of personal data, but we may incidentally process such data (for example, where it is included in survey responses). To the extent we do so, our legal reason for processing this information is that the processing is necessary for reasons of substantial public interest for the exercise of a function of a government department (article 9(2)(g) UK GDPR and paragraph 6 to Schedule 1 Part 2 of the DPA 2018).

Who will personal data be shared with?

We may share our summary analysis with other government departments whose work is impacted by AI regulation. Any insights we provide will generally be on an aggregated basis. Where specific content is shared, personal identifiers will be redacted where possible. If we need to share your personal data any further, we will take appropriate action to notify you.

How long will my data be held for?

We will only retain your personal data for as long as it is needed in accordance with the purposes for which it was collected. This is typically no more than five years from the date the record is closed, in line with DCMS’ retention policy for low sensitivity research data, unless, for example, the law requires us to keep the information for longer, such as for a public inquiry.

Will my data be used for automated decision making or profiling?

No. We do not use your data for automated decision making or profiling.

Will my data be transferred outside the UK and if it is how will it be protected?

We will not send personal data beyond the European Economic Area (where it is protected by equivalent legal safeguards to those in the UK).

How will my data be stored?

Your personal data will be stored in a secure government IT system and the survey company’s secure system. We have set up systems and processes to prevent unauthorised access or disclosure of your data – for example, we protect your data using varying levels of encryption. We also make sure that any third parties that we deal with keep all personal data they process on our behalf secure.

Understanding data protection rights

You have rights in relation to your personal data under the UK GDPR and the DPA 2018. To learn more about your rights and how to exercise them, please refer to our personal information charter and / or the Information Commissioner’s Office (ICO) website. The ICO is the supervisory authority for data protection legislation and maintains a full explanation of these rights on their website

We will ensure that we uphold your rights when processing any of your personal data.

Your data protection rights

The data we are collecting is your personal data, and you have considerable say over what happens to it.

You have the right:

• to see what data we have about you
• to ask us to stop using your data, but keep it on record
• to have all or some of your data deleted or corrected
• to lodge a complaint with the independent Information Commissioner (ICO) if you think we are not handling your data fairly or in accordance with the law. See below: How to contact the ICO.

Our contact details

If you have questions about this privacy notice, or how we are using your data, you can contact us:

By email:

evidence@officeforai.gov.uk

By post:

Data Protection Officer
The Department for Culture, Media & Sport
100 Parliament Street
London
SW1A 2BQ

If you’re unhappy with the way we have handled your personal data and want to make a complaint, please write to the department’s Data Protection Officer or the Data Protection Manager at the relevant agency. You can contact the department’s Data Protection Officer using the details above.

How to contact the Information Commissioner’s Office

If you believe that your personal data has been misused or mishandled, we would always hope that we can resolve the issue with you directly, using our contact information set out above. However, you may make a complaint to the Information Commissioner, who is an independent regulator and can be contacted as follows:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: www.ico.org.uk
Telephone: 0303 123 1113
Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Changes to our privacy notice

We may make changes to this privacy policy. In that case, the ‘last updated’ date at the bottom of this page will also change. Any changes to this privacy policy will apply to you and your data immediately.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

This notice was last updated on 27/03/2023.