Guidance

Privacy Notice for Research Project on Freedom of Information Requests

Published 1 October 2019

© Crown copyright 2019

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/privacy-notice-for-research-project-on-freedom-of-information-requests/privacy-notice-for-research-project-on-freedom-of-information-requests

This notice sets out how we will use your personal data, and your rights. It is made under Article 14 of the General Data Protection Regulation (GDPR).

1. Your data

1.1 Purpose

The purpose for which we are processing your personal data is to conduct a research exercise using publicly available information with the aim of identifying barriers to government transparency.

We want to see if study of Freedom of Information Act (FoI) requests can be used to indicate consistent issues of public interest, and then explore whether that content can be made proactively transparent by government.

Public data has been scraped from Whatdotheyknow.com website to assess several issues:

  1. Do FOI requesters know where to request content from? (i.e. are there multiple requests of the same/ similar content across multiple departments)
  2. Do FOI requesters make stepped requests to the same department (digging deeper on an issue)
  3. Do multiple FOI requests use the same ‘template’ for their FOI requests?
  4. If a data request is refused – is that data already transparent?
  5. If a data request is refused – is that data due to be published shortly?

1.2 The data

We will process your WhatDoTheyKnow.com username, status, title of request, text of request, and department the data was requested from.

The legal basis for processing your personal data is it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case that is our function to improve government transparency.

Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. We do not intend to collect any sensitive personal data, or data about criminal convictions, but we cannot rule out the possibility that some may be included in public information requests.

Where we do process sensitive personal data or criminal convictions personal data, our lawful bases are:

  • It relates to personal data which are manifestly made public by you
  • processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department

1.4 Recipients

Your personal data will not be shared by us with any third parties.

1.5 Retention

Your personal data will be kept by us until the project is completed, which we expect to be by the end of 2019.

1.6 Automated decision making

Your personal data will be subject to the following automated decision making: automated web scraping to identify it as falling within a particular category or to detect trends and commonalities.

1.7 Where personal data have not been obtained from you

Your personal data were obtained by us from public data on the WhatDoTheyKnow.com website.

2. Your rights

You have the right to object to the processing of your personal data.

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You may have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

3. International transfers

We will not transfer your data outside the UK.

4. Contact details

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are:

Cabinet Office
70 Whitehall
London
SW1A 2AS

Public Enquiries: Online Contact Form

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.

The contact details for the data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk

5. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.

The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
0303 123 1113
casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Back to top