OEP Privacy Notice

Introduction

The Office for Environmental Protection (“OEP”) has been established by the Environment Act 2021as a public body, with the principal objective of contributing to environmental protection and improving the natural environment. The OEP has a duty to protect the public funds it administers, and to this end may use the information provided by its customers and suppliers for the prevention and detection of fraud. It may also share this information with other bodies responsible for auditing or administering public funds for these purposes.

One of the functions of the OEP is to replace the former role of the European Commission in receiving complaints where public authorities have not complied with environmental law. We process personal information in relation to this task which is in the public interest. Where this is the case, we do not need your consent.

To help us investigate these complaints, you may need to give us further information about how this has affected you. This may include health information. We ask that you do not provide this type of information if it is not necessary for your complaint to be investigated. Health information is defined by GDPR as “special category personal data” which means personal data relating to, for example, a living person’s racial or ethnic origin, genetic data, biometric data or data concerning health. Special categories of particularly sensitive personal information need more careful handling. We need to have further justification for collecting, storing and using this type of personal information.

The legal basis for processing your sensitive personal data is that it is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either House of Parliament; or the administration of justice; and an appropriate policy document is in place. The OEP considers complaints where damage to the natural environment or to human health may have been caused.

We try to ensure that we only collect the minimum personal data necessary for us to offer this service to you.

The legal basis for collecting Internet Protocol (IP) addresses, and hostnames of website users or any non-essential cookies is your consent.

Purpose of this Privacy Notice

The OEP is committed to protecting the privacy and security of your personal information.

This notice is provided within the context of the changes required by the UK General Data Protection Regulation 2020 and the Data Protection Act 2018. This notice sets out how we will use your personal data as part of our legal obligations with regards to Data Protection.

It may be the case that additional privacy notices are provided on specific occasions that will inform you of how and why we are using such information. Also, this privacy notice will be updated on a regular basis.

The OEP’s Personal Information Charter explains how we deal with your information. It also explains how you can ask to view, change, or remove your information from our databases.

Who is collecting your data?

The OEP is collecting your data. It has been set up to receive complaints about environmental law against public authorities.

This is a specific privacy notice on the processing of your personal data as part of your complaint. It is being processed as necessary for the performance of a task in the public interest. The data will be collected and processed towards the administration of a complaint against a public authority which the complainant believes to be in breach of environmental law. This is being done to ensure appropriate monitoring and collection of data about potential environmental law breaches.
In order to provide these services, we may need to process some personal data, including:

  • your name, postal address(es), email address(es) and telephone number(s)
  • the nature of your complaint
  • details of the public authority you are complaining about
  • general correspondence, questions, queries or feedback
  • telephone messages
  • your Internet Protocol (IP) address, and details of which version of web browser you use
  • information on how you use the site, using cookies and analytics

We are allowed to process your data because we have official authority as part of the UK government department responsible for safeguarding our natural environment. The legal basis for processing the data is to perform a task in the public interest that is being set out in law.

If you do not give us the data, we may not be able to provide a service to you or be able to respond to any complaints or enquiries you may have.

What personal data we collect and how long do we keep it (data retention policy)

What we collect

  • Personal information you supply when submitting a complaint about a potential breach of environmental law by a public authority
  • Any details you supply when you contact us by e-mail, post, telephone or the 'contact us' form on our website
  • IP addresses and hostnames of website users
  • Sensitive personal information including information about your health (special category data)

Why we collect it

  • To contact you to find out more information, and so we can update you about your complaint
  • To respond to your enquiry
  • To maintain statistics on the use of our website
  • We may collect this to help understand the potential health impacts linked to your complaint

Justification

  • It is necessary for us to process your personal data to perform a task in the public interest
  • To perform a task in the public interest
  • The legal basis for processing IP addresses and hostnames of website users or any non-essential cookies is your consent
  • The legal basis for collecting and using the data are Articles 9 (2)(g) of the General Data Protection Regulation 2016 and Schedule 1, Part 2 (6) of the Data Protection Act 2018.

How long do we keep data

  • Potentially for up to 5 years. Also refer to notes below*
  • Contact details will be retained until individuals unsubscribe or object to receiving communications, or until the service is terminated, whichever is sooner
  • If you accept the use of cookies that measure website data, any personal data you give us will be retained for a maximum of 26 months (2 years and 2 months).
  • 5 years after case closure

Sharing your information/Who can see your data

Receiving complaints concerning environmental law is in the public interest, and the OEP is an official authority.

Your information will be shared with the public authority you are complaining about (where it is necessary to determine that your complaint has first been processed through their internal procedure) and may be shared with other public authorities suspected of committing breaches of environmental law linked to the breach you have complained about. Your information may also be shared with our external service providers (where we have outsourced the service). We may share your complaint with Government Ministers and Secretaries of State and their officials for the purpose of identifying systemic issues or to ensure protection of people and the environment in urgent cases.

In addition, when cases are closed and it is appropriate to do so, information may be sent to The National Archives for storage.

We may have to release information (including personal data and commercial information) where required by law, including under the following legislation:

  • General Data Protection Regulation (UK GDPR)
  • UK Data Protection Act 2018
  • Freedom of Information Act 2000
  • Environmental Information Regulations 2004

We will not allow any unwarranted breach of confidentiality and we will not act in contravention of our obligations under UK data protection legislation.

How long do we keep your information?

All information within the OEP is held in accordance with the OEP’s retention policy. When you submit a complaint about a public authority failing to comply with environmental law, the information you supply to the OEP will be retained for the duration of processing the complaint and any subsequent proceedings arising. This could be for up to approximately *5 years, based on the timings of the prior process administrated by the EU.

Once your complaint and any related complaints are resolved, your personal data will be deleted after the relevant timescales outlined above. Information relating to the complaint will be retained for statistical purposes.

In specific circumstances information may be held for longer periods. Examples include:

  • to allow auditing of complaint activity
  • for legal processes e.g. enforcement, a pending court case
  • if it sets a precedent
  • for scientific or historical research purposes
  • to enable identification of connected, widespread or systemic breaches of environmental law
  • to allow the OEP to meet its legal obligations under the Environment Bill (once enacted)
  • to meet obligations under the Public Records Act 1958

Where are your data processed and stored?

We transfer your data through our secure severs. The data will not be transferred outside the United Kingdom or European Union.

The complaint portal that we use is Jira Service Desk software and for more details on how this software processes your data, please see Atlassian Privacy Policy.

Why you need to create a set of sign-in details

We ask you to create a single set of sign-in details to save you time and to support the administration of the system. You will be able to use them to register with and access The OEP’s online complaints handling system. We will store basic information about you so that you do not have to re-enter the information each time you want our services.

Your information will be shared with all the administrators associated with your account for them to manage access.

Your rights

You have the right to request:

  • information about the processing of your personal data
  • a copy of your personal data
  • that any inaccuracies in your personal data be rectified without delay
  • the completion of any incomplete personal data, including by means of a supplementary statement
  • that your personal data be erased if there is no longer a justification for processing the data
  • in certain circumstances (for example, where accuracy is contested) that the processing of your personal data be restricted.

Where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (such as the exercise of a function of the Crown, a Minister of the Crown, or a government department, the exercise of a function conferred on a person by an enactment, the exercise of a function of either House of Parliament or the administration of justice) you have the right to object to the processing of your personal data.

Your right of access

You have the right to ask us for a copy of the personal information we hold about you. This is known as a subject access request. To make a request please contact our Data Protection Officer, whose details can be found below.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to be forgotten

You have the right to ask us to erase your personal information in certain circumstances. This could prevent us from administering your complaint.

Your right to object to processing

You have the right to object to us processing (using) your information at any time.

Your right to data portability

You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent.

You are not required to pay any charge for exercising your rights. We have one month to respond to you.

Where you have consented to us contacting you, you always have the right to withdraw your consent. The easiest way is to click on the unsubscribe link that is included in all communications, but you can also contact us at any time to ask us not to send you communications.

Links to other websites

Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices of the other websites you visit, links to these can also be found in our cookie policy.

YouTube videos

We use YouTube to provide videos on some pages of the site. YouTube sets cookies when you visit one of these pages.

Contact details for the OEP

The contact details for the data controller's Data Protection Officer (DPO) are:

Data Protection Officer
Office for Environmental Protection
Worcestershire County Hall
Spetchley Road
Worcester
WR5 2NP

Email: enquiries@theoep.org.uk

 

If you are not satisfied by the result of this process, any individual can complain to the Information Commissioner if they believe the OEP has failed to properly protect their personal information, or to comply with these rights. The Information Commissioner can be contacted as follows:

https://ico.org.uk

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

General complaints

If you have a complaint about the way we operate or the services we provide, or generally are unhappy about any of our processes, we would like to hear from you. In the first instance please contact the OEP team.

If you wish to make a formal, written complaint you should send it in writing to our Service Standards Adjudicator by post or email using the contact details below:

Department for Environment, Food & Rural Affairs
Area 5B
Nobel House
17 Smith Square
London
SW1P 3JR

Email: service-standards.adjudicator@defra.gov.uk

You can get further information on Defra’s complaints procedure at: https://www.gov.uk/government/organisations/department-for-environment-food-rural-affairs/about/complaints-procedure

Please do not forget to include a return contact email or postal address for responses to your complaint.

Last updated 17 November 2021

Related content

All content is available under the Open Government Licence v3.0, except where otherwise stated.