Guidance

Privacy Notice – analysis of social media data to tackle disinformation (EU and US partners)

Published 1 October 2019

This privacy notice sets out how UK Civil Servants will use media monitoring tools to identify and analyse disinformation. This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the General Data Protection Regulation (GDPR).

1. Your data

We monitor publicly available media including social media data, using commercially available media monitoring tools. The data we obtain from media monitoring tools is used to create insight reports that are shared with government colleagues within the UK and partner government teams from Europe and the United States. The data gathered through tools may include social media handles and content from posts which are publicly available. Insight reports will be anonymised, and will not include any personal data gathered from media monitoring. The social media data is gathered through publicly available information on platforms such as Twitter and Facebook.

2. Purpose

The aim is to provide evidence-based and coordinated approach to countering harmful disinformation across global partners. Social media and search monitoring is carried out to find, assess, and address disinformation. Social media and search monitoring is also used to measure the effectiveness of government communications.

3. Legal basis of processing

The lawful basis for processing your personal data is it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case that is Cabinet Office’s role in tackling harmful disinformation and monitoring the effectiveness of government communications. Special categories of personal data are data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

We do not actively collect sensitive personal data, but we may process such data in monitoring social media data where such data is included in social media posts. Our lawful basis for processing that sensitive personal data is:

• processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department, and
• the processing relates to personal data which are manifestly made public by the data subject

4. Recipients

Any personal information downloaded from monitoring tools onto our IT systems will be shared with our IT suppliers who provide email, and document management and storage services.

Insight reports will be shared with government colleagues within the UK and partner government teams from Europe and the United States. Insight reports will be anonymised, and will not capture any personal data gathered from media monitoring.

Anonymised reports will be stored on a secure collaborative platform which is owned and managed by the United States Department of State.

5. Retention

Social media personal data: The Cabinet Office will retain identifiable information that is downloaded from search tools in order to compile insight reports. All downloaded identifiable data will be reviewed on an annual basis and deleted if it no longer serves the original purpose of collection. Produced insight reports will not include any personal data.

Data gathered by social media monitoring companies will be stored according to the company’s protocols. We use the following companies: Brandwatch.

Please review the company privacy notices to understand how Brandwatch use your personal data.

Anonymised insight report databases will be reviewed on an annual basis and reports deleted if no longer serving the original purpose of processing.

6. Where you did not provide your personal data

It was provided by social media monitoring providers or obtained from public sources.

7. Automated decision-making

Data may have been subject to automated decision-making to identify it as falling within a particular search description.

8. Your rights

You have the right to object to the processing of your personal data.

You have the right to request information about how your personal data is processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data is completed, including by means of a supplementary statement.

You have the right to request that your personal data is erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.

9. International transfers

Any personal information retrieved from social media monitoring tools and stored on our corporate IT systems may be transferred and stored securely outside the European Union. Where that is the case it will be subject to equivalent legal protection through the use of Model Contract Clauses.

Please review the company privacy notices to understand how these companies use your personal data.

10. Contact details

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are:

Cabinet Office
70 Whitehall
London
SW1A 2AS

Public Enquiries: Online Contact Form

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.

The contact details for the data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk

11. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.

The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
0303 123 1113
casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.