22 June 2021

Version 1.3

Specific Privacy Notice

Vetting

Aim: Everyone in the police service must maintain high ethical and professional standards and act with the utmost integrity and a robust vetting process is necessary to verify whether or not someone is suitable to serve in, or work alongside, Essex and Kent and Essex Police. To ensure that the risks associated with an individual are managed the vetting process seeks to identify those risks, and where individuals are identified as unsuitable, prevent their employment within the forces.

Introduction

This Specific Privacy Notice has been created to make it easier for you to understand what personal data Kent and Essex Police processes about you, how and why it will be used in connection with your vetting application. It is a requirement of the General Data Protection Regulation (GDPR).

It is subordinate to, and should be read in conjunction with, the force’s high-level Privacy Notice.

The high-level Privacy Notice provides you with complete details of the rights you have relating to the personal data we hold about you now and any personal data we might collect about you in the future.

If you require this Specific Privacy Notice in Braille or in another language, please contact the Force’s Data Protection Officer (contact details below).

Privacy Information

Who is the Controller (the person who determines the purpose and means by which your personal data is processed) and what are their contact details?

The Controller is:

Chief Constable of Kent and Essex Police
Kent and Essex Police HQ
Sutton Road
Maidstone
Kent and Essex
ME15 9BZ

Chief Constable of Essex Police
Essex Police HQ
PO Box 2
Chelmsford
CM2 6DA

DPA Article 13(1)(a) and Article 14(1)(a)

What are the contact details of the Data Protection Officers?

Data Protection Officer
Information Security and Governance Department
Kent and Essex Police
Coldharbour
London Road
Aylesford
ME20 7SL
Email: [email protected] and essex.police.uk

Data Protection Officer
Essex Police
HQ
PO Box 2
Chelmsford
Essex
CM2 6DA
Email: [email protected]

DPA Article 13(1)(b)
Article 14(1)(b)

For what purpose(s) is my personal data intended to be processed by Kent and Essex Police?

To enable vetting to assess your suitability to be employed within the forces.
DPA

Article 13(1)(c)

What personal data of mine will be processed by Kent and Essex Police?

Kent and Essex Police will collect and process the following personal data:

  • Your name
  • Address
  • Date and place of birth
  • Employment history
  • Your contact details
  • Personal details of family members
  • Co-residents
  • Any known criminal associates.

In certain circumstances you may be required to provide financial information.

Special Category data:

  • Race
  • Ethnic origin
  • Religion
  • Biometric data
  • Sexual orientation

What is Kent and Essex Police’s legal basis for processing my personal data?

The lawful basis for processing personal data is that it is necessary to comply with a legal obligation (Article 6(c) GDPR) and Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(e) GDPR).

The lawful basis for processing special category personal data is for the purpose of exercising a function conferred by an enactment and is necessary for reasons of substantial public interest (Article 9(2)(g) GDPR) (DPA 2018, Sch.1, Part 2, S.6).

The Statutory basis for this is the College of Policing Vetting Code of Practice (issued October 2017). This was presented to Parliament pursuant to Section 39A (5) of the Police Act 1996, as amended by Section 124 of the Anti-Social Behaviour, Crime and Policing Act 2014.

DPA Article 13(1)(c) and Article 14(1)(c)

How will my personal data be processed?

The information provided will be used as the basis for conducting background checks and enquires against Police databases and information systems. Where applicable, it will also be checked against ‘open source’ internet, the records of Credit Reference Agencies and other third-party records.

Where Credit Reference Agency records are checked, this will be for the vetting subject only and not for any other individuals named on the form.

Any information which is revealed as a result of the vetting process is reviewed by a vetting practitioner. The personal data collected will continue to be held within the records created for that purpose.

If my personal data is obtained by Kent and Essex Police from someone else what are the categories of personal data collected?

See section 4

DPA Article 14(1)(d)

Who will my personal data be disclosed to by Kent and Essex Police?

The information may be shared with other police forces / agencies in the United Kingdom in respect of any recruitment applications you may make. Within the forces the information provided will not be shared with anyone outside the Professional Standards and HR Departments, unless for a legitimate law enforcement purpose.

DPA Article 13(1)(e)

Does Kent and Essex Police intend to transfer my personal data out of the U.K. or to an international organisation?

No, all personal data remains within the UK.

DPA Article 13(1)(f) and Article 14(1)(f)

If Kent and Essex Police intends to transfer my personal data out of the U.K. or to an international organisation what safeguards are there to protect my personal data?

N/A

DPA Article 13(1)(f) and Article 14(1)(f)

How long will my personal data be retained by Kent and Essex Police?

We will only keep your information for as long as it is required to be retained. Information provided to facilitate vetting will be retained for the duration of the application or subsequent employment and beyond in accordance with the force retention schedule, after which it will be securely destroyed.

DPA Article 13(2)(a) and Article 14(2)(a)

What are my rights under the GDPR?

You have the following rights under the GDPR:

  • Right to be informed
  • Right of access
  • Right of erasure
  • Right to restriction of processing
  • Right to data portability
  • Right to object
  • Right not to be subject of automated decision-making

Full details of those rights and how to exercise them can be found in Kent and Essex Police’s high-level Privacy Notice which can be found on the home page of the Kent and Essex Police website. It can also be obtained from:

Public Disclosure Team
Kent and Essex Police
Coldharbour
London Road
Aylesford
ME20 7SL
Email: [email protected]

Information Rights Team
Essex Police HQ
PO Box 2
Chelmsford
CM2 6DA
Email: [email protected]

DPA Article 13(2)(b) and Article 14(2)(c)

If Kent and Essex Police relies on my consent to be the legal basis for processing my personal data can I withdraw that consent?

The lawful basis for the processing of personal data in this instance is based on ‘legal obligation’ and ‘public task’ not ‘consent’.

DPA Article 13(2)(c) and Article 14(2)(d)

Who can I lodge a complaint with if I am unhappy about the way my personal data is processed by Kent and Essex Police?

You may lodge a complaint with the Information Commissioner’s Office. Their contact details are:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

You may wish to initially raise any concerns with the Data Protection Officer.

DPA Article 13(2)(d) and Article 14(2)(e)

If my personal data was obtained by Kent and Essex Police from someone else from who or where was it obtained by Kent and Essex Police?

N/A

DPA Article 14(2)(f)

Am I required to provide my personal data under a statutory or contractual requirement, or a requirement necessary to enter into a contract, or am I obliged to provide it?

Whilst you can decline to provide some, or all, of the information required in the vetting forms, it will not be possible to conduct a meaningful risk assessment and clearance cannot be granted. As such you are unlikely to be employed by either force.

DPA Article 13(2)(e)

Will my personal data be used for automated decision-making, including profiling?

No

DPA Article 13(2)(f) and Article 14(2)(g)

If my personal data will used for automated decision-making, including profiling what logic will be involved and what significance and consequences will there be for me from the automated decision-making?

N/A

DPA Article 13(2)(f) and Article 14(2)(g)