Guidance

Privacy Notice - Social and Digital Media Analysis

Published 15 July 2024

The Government Communication Service monitors and analyses public social media and search data using third-party tools. This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

Your data

We monitor public social media and digital data. At no point is private information accessed or privacy breached. At all times data is handled with the utmost confidentiality upholding the Civil Service Code at all times.

We review public social media posts relating to government communications and dis- or mis-information. While we do not actively monitor individuals, personal data may be included in social media posts and news articles that we analyse. 

We may collect individual posts receiving high engagement to illustrate particular discussions or narratives that are happening online. These posts will include social media usernames (which may or may not be real names) and opinions. Sometimes the opinions may express political opinions or philosophical beliefs. Sometimes social media users may disclose additional biographical details about themselves in their posts. 

Purpose

The aim of the GCS is to deliver world-class communications that support Ministers’ priorities, improve people’s lives and enable the effective operation of our public service. Social media and search monitoring is carried out to find, assess, and address potentially harmful dis- and mis-information. Social media and search monitoring is also used to measure the effectiveness of government communications and to understand key public narratives and themes related to government priorities. HMG also work with partner governments around the world to share analysis on global collective issues that are priorities for the UK.

Legal basis of processing

The processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case that is social media and search monitoring, carried out to find, assess, and address potentially harmful dis- and mis-information. Social media and search monitoring is also used to measure the effectiveness of government communications, and to identify topics being engaged with online where the government - as an official source - should be providing more information. These are essential functions of an efficient digital team in the government communications profession, as they uphold public safety and ensure effective value for money in our communications.

While we do not actively collect special categories of personal data, or data about criminal convictions, such data may be included in social media posts that we analyse. In such cases the legal bases for processing special categories of personal data are: (1) the processing relates to personal data which are manifestly made public by you, (2) the processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department, and (3) the processing is necessary for the exercise of a protective function (as defined by paragraph 11(2) of Part 2 of Schedule 1 to the Data Protection Act 2018). We have an Appropriate Policy Document in place, as required by Part 4 of Schedule 1.

Recipients

Social media and media analysis is generally shared with other government bodies in aggregate to show key themes or narratives that are relevant to the UK government. Such aggregates do not constitute personal data. 

We also share aggregate social media analysis with partner governments where we are working together on joint priorities. 

We also collect and share with partner governments and UK public bodies published news articles and media stories. These published stories may include personal data (e.g. references to world leaders or government spokespersons), and this personal data is also shared with partner governments and UK public bodies. 

Personal data will be stored on our IT infrastructure and will also be shared with our data processors who provide email, and document management and storage services.

Retention

Information retained by the Cabinet Office will be reviewed on an annual basis and deleted if it is no longer serving the original purpose of collection.

Information forms part of a database to allow for longitudinal analysis. In the majority of cases this information is aggregated trends rather than personally identifiable information.

Where you did not provide your personal data

It was provided by software providers (such as media monitoring companies), or obtained from public sources.

Automated decision-making

No automated decision making that produces significant or legal effects for individuals is undertaken. 

Your rights

• you have the right to object to the processing of your personal data
• you have the right to request information about how your personal data are processed, and to request a copy of that personal data
• you have the right to request that any inaccuracies in your personal data are rectified without delay
• you have the right to request that any incomplete personal data are completed, including by means of a supplementary statement
• you have the right to request that your personal data are erased if there is no longer a justification for them to be processed
• you have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted

International transfers

As data is stored on our IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision, the use of Standard Contractual Clauses, or a UK International Data Transfer Agreement.

Personal data in published media stories and headlines may also be exported internationally to partner governments as part of our work to identify and challenge harmful mis- and dis-information. Where this personal data is exported internationally we rely on the fact that we are doing so for important reasons of public interest (Article 49(1)(d) UK GDPR). 

Contact details

The data controller is the Cabinet Office. The contact details for the data controller are:

Cabinet Office
70 Whitehall
London
SW1A 2AS

0207 276 1234

or Contact the Cabinet Office. 

The contact details for the data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk.

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.

Complaints

If you consider that data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.

The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

0303 123 1113

icocasework@ico.org.uk 

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.