Impact assessment

POPs review privacy notice

Published 18 July 2022

Notice of request for comments on review of statutory exemptions for: Decabromodiphenyl ether (decaBDE); Perfluorooctanoic acid (PFOA), its salts and PFOA-related compounds; Perfluorooctane sulfonic acid, its salts and its derivatives, (PFOS); and Short chain chlorinated paraffins (SCCPs)

1. Who collects your data

The data controller is the Department for Environment, Food and Rural Affairs (Defra). If you have any questions about how Defra uses your data or your associated rights, email Defra’s Data Protection Manager data.protection@Defra.gov.uk

The Data Protection Officer responsible for monitoring that Defra is meeting the requirements of the legislation can be contacted by email at: DefraGroupDataProtectionOfficer@Defra.gov.uk

2. How your data has been obtained

We have collected your data either from the Downstream User Import Notification (DUIN) collected by REACH, or because your company has previously been contacted by a Defra stakeholders’ forum, such as the Chemical Stakeholders’ Forum.

3. What personal data is collected, and how it is used

The personal data that we currently process is your name and contact details (if available from DUIN). If you complete the survey, we will be collecting data on:

• Name of chemicals or technical manager, or other appropriate contact
• Their email address and phone number (if provided)
• The name of the organisation they are representing
• Information on whether or not certain derogations and exemptions are being used by that organisation.

Defra will use personal data that you provide to update you on the progress of the exemption review and make contact to clarify any necessary information in the return you provide. Defra may also use the personal data to contact you regarding future exemption reviews or to ask for feedback on the exemption review process.

4. The legal basis for processing your data

There are two legal bases in data protection law that apply to Defra’s use of your personal data for the review of statutory exemptions:

• your consent
• processing is necessary for a task carried out in the public interest

These exemptions are found in Article 6(1)(a), consent, and (e) public interest task, of the UK General Data Protection Regulation (GDPR).

This exemption review is being carried out to fulfil commitments and obligations made by the UK as a Party to the Stockholm Convention. The Stockholm Convention on Persistent Organic Pollutants is an international environmental treaty that aims to eliminate or restrict the production and use of persistent organic pollutants.

Persistent Organic Pollutants are substances that persist in the environment, accumulate in living organisms and pose a risk to our health and the environment. It is therefore in the public interest that the targets that Defra has committed to on the reduction of these harmful chemicals are met, so that the risk to human and environmental health can be reduced.

In the UK’s National Implementation Plan, which sets out how the UK will implement the actions agreed by the Convention, a commitment is made to carry out a POPs exemption review. A further specific commitment was made to review the use of exemptions for decabromodiphenyl ether (DecaBDE) and short-chain chlorinated paraffins (SCCPs) during COP10 (face-to-face) meeting.

The UK’s legal obligations under the Stockholm Convention are implemented, managed and enforced by Regulation (EU) 2019/1021 of the European Parliament and of the Council of 20 June 2019 on persistent organic pollutants (recast).

If Defra discloses personal data when replying to a request under freedom of information laws, the legal basis is that Defra’s use of your personal data is necessary for the performance of a task carried out in the public interest. The relevant task in the public interest is that Defra must comply with its obligations under the freedom of information laws.

5. Consent to process your data

You can withdraw your consent by emailing POPs@defra.gov.uk

If you withdraw your consent, Defra may be able to continue to use any personal data it has already received up to that time for the purpose of the survey you have replied to, particularly if your reply has already been included in the review of the statutory exemptions.

6. Outcomes if you do not provide the necessary data

Your participation in this survey is voluntary and there will be no repercussions for you if you choose not to reply to the survey or if you withdraw your reply at any time. However, if responses are not received Defra will assume that the exemptions are not being used and are not needed.

7. Who Defra will share your data with

Your responses to the specific questions will be passed on to the Stockholm Convention in order for the UK to meet its commitment to report on the use of the exemptions in the UK. However, no personal data collected (names, contact information, organisation name) will be passed on to anyone outside of Defra, including the Stockholm Convention.

We will not:

• sell or rent your data to third parties
• share your data with third parties for marketing purposes

We will not share your data with any other third parties, except where we are required to do so by law or court order, to detect or prevent crime, or to apprehend or prosecute offenders.

8. How long Defra hold your personal data

Defra will keep the responses you provide, but your response will be anonymised after one year. Names and contact details will be kept separately on a stakeholder database on an on-going basis and used to provide updates and seek opinions on relevant issues when appropriate, unless you choose to opt out (by email to POPs@defra.gov.uk

9. Your rights

Find out about your rights under the GDPR and the Data Protection Act 2018.

You also have the right to make a complaint about the use of your data at any time. Make a complaint with the Information Commissioner’s Office (ICO – the data protection supervisory authority).

10. Defra’s Personal Information Charter

Defra’s Personal Information Charter explains more about your rights over your data. This Charter broadly sets out Defra’s standards for requesting or storing personal information.