Guidance

Privacy notice for Cabinet Office digital advertising

Updated 16 May 2022

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the General Data Protection Regulation (GDPR).

1. Your data

1.1 The purpose

If you opt into marketing cookies, we process your personal data in order to deliver relevant digital advertising to you in support of government public communication objectives. Examples of when we do this include campaigns to recruit for the Civil Service Fast Stream programme, campaigns to reduce the extent to which citizens share fake news stories, and to raise awareness of modern slavery and government’s work to end it.

As per the Government Data Ethics Framework, we take a ‘least data by default’ approach. This means we only use the described personal data in order to improve the relevance of our campaigns, and when other contextual methods will significantly impact on citizen experience and/or taxpayers’ value for money.

1.2 The data

The personal data we collect from you on our campaign sites includes:

• the pages you visit
• how long you spend on each page
• how you got to the site
• what you click on while you’re visiting the site

In addition, we use personal data provided by 2nd and 3rd parties, which we do not collect or store, but use in marketing platforms to deliver you campaign messages based on:

• audiences, such as demographics (eg. age, gender, region) and interest groups (eg. job industry), which 3rd parties infer from your internet browsing behaviour, your use of mobile apps, your actual or inferred demographic and location information, collected via their cookies and other similar technologies.
• if deemed vital to the delivery of a campaign, we may also use specialist 3rd party providers to ensure the relevance of the digital advertising you receive. For example, in the case of the public awareness campaign for modern slavery, the 3rd party Blis was used in order to purchase digital advertising close to job centres.

1.3 The processing

If you opt into marketing cookies, we use the personal data collected from activity on our campaign websites to improve your experience, for example:

• to remarket to you, if you have shown interest in our services
• to stop advertising to you if you no longer wish to receive it
• to deliver advertising to people similar to you, if you have found our website useful

Along with 2nd and 3rd party audiences we then use Real Time Bidding (RTB) to deliver advertising we believe may interest you or be important to you. RTB refers to the buying and selling of online ad impressions through real-time auctions that occur in the time it takes a webpage to load. This process allows buyers to review the available profile data on the impression, decide if they want to try and buy that ad space, how much they were willing to pay, and submit that value into a real time auction. Those auctions are often facilitated by ad exchanges or supply-side platforms.

RTB relies on potential advertisers seeing information about website users. That information can be as basic as the type of device you are using or which country you are in. But it can also provide a more detailed picture – which websites you’ve visited, what your interests are, or, for example, what you may have been searching for. Data used within the RTB process can fall into one of the following categories:

• First-party data (i.e. consumer data collected directly with consent) including:
  • Data sourced from website analytics, mobile app analytics, or a Data Management Platform (DMP).
  • Opt-in tracking placed on websites for the purposes of targeting and optimising digital advertising activity (e.g. Demand Side Platform tags).
  • Email or postal address data provided with user consent to facilitate digital ads targeting to those individuals.
• Second-party data, for example a direct data partnership with another company, or where a media agency is buying their data directly.
• Third-party data, which is made available for purchase. For example data from Publishers made available through a data broker, or mobile geo-location data sourced from a network of mobile applications, and made available through a mobile data broker.

RTB enables digital public comms to effectively, and cost efficiently, reach specific audiences in the UK at scale with specific public information or official guidance. This can be awareness driving public information campaigns, behavioural change work (e.g. encouraging people to stop smoking, or to drive more safely) or recruitment (e.g Army, Schools, Hospitals). The common theme is improving outcomes for the citizen, and efficient use of taxpayer money, so the opportunity for Real Time Bidding (RTB) to do this effectively is very important. RTB is used in the delivery of this activity, and is carried out by our media buying agency on behalf of HMG.

1.4 Legal basis of processing

The legal basis for processing your personal data is your opt-in consent (UK GDPR Article 6(a)) for audience targeting (purposes 3 & 4 within the IAB Transparent Consent Framework (TCF)), and ‘Legitimate Interests’ (Article 6(f)) for the purposes of measurement and monitoring brand safety (purpose 7 within the TCF).

Your opt-in consent should be obtained by us if we are collecting your information through our own campaign websites.

If we have obtained your data from a third party publisher, app owner, website owner or service provider, they should have obtained your opt-in consent for your data to be used for advertising. In order to assure this, we have surveyed our most commonly used vendors and ceased to use data from those who do not obtain opt-in consent.

Special category data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. In most cases we do not actively collect special category data, but it may be included in your interests from 2nd and 3rd parties in advertising profiles.

We may use special category data where justified: for example, to use health interests to target help on quitting smoking.

1.5 Recipients

If you opt into marketing cookies, data about your behaviour on the website will be shared by us with our data processors, for example primarily Google and occasionally Adobe in the case of website analytics. Some of this data, such as the actions you may take on the website, could be shared with our media buying agency OmniGOV or 3rd party advertising platforms. This enables us to improve your user experience, for example ensuring you don’t see the same advert for registering to vote, after you have already registered. This linked document provides a breakdown of vendors which the Cabinet Office uses to deliver digital public comms, and who may therefore process data on our behalf.

1.6 Retention

Your personal data will be kept by us for the lifespan of cookies used to identify the browser, and thus the person, that the data concerns. This is determined by the data controller and their agencies. For GCS, cookie lifespan varies depending on the platform used, but is typically set to 90 days. 3rd parties we work with have varying policies, which should be detailed in our campaign website cookie policies. For example, Facebook keeps data from their pixel for 180 days, Xandr for usually 3-60 days, and the Trade Desk for up to 18 months.

2. Your rights

You have the following rights. In order to exercise these rights we may need help, such as additional information about you or your device, to identify you.

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You may have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.

You have the right to withdraw consent to the processing of your personal data at any time.

You have the right to request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format.

3. International transfers

As your data will be shared with our data processors as described above, it may be stored securely outside the United. Where that is the case it will receive equivalent legal protection through Standard Contractual Clauses.

4. Contact details

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are:

Cabinet Office
70 Whitehall, London
SW1A 2AS

Public Enquiries: Online Contact Form

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.

The contact details for the data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk

5. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or 0303 123 1113, or icocasework@ico.org.uk. Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.