Aim: Everyone in the police service must maintain high ethical and professional standards and act with the utmost integrity and a robust vetting process is necessary to verify whether or not someone is suitable to serve in, or work alongside, Essex and Kent and Essex Police. To ensure that the risks associated with an individual are managed the vetting process seeks to identify those risks, and where individuals are identified as unsuitable, prevent their employment within the forces.
This Specific Privacy Notice has been created to make it easier for you to understand what personal data Kent and Essex Police processes about you, how and why it will be used in connection with your vetting application. It is a requirement of the General Data Protection Regulation (GDPR).
The high-level Privacy Notice provides you with complete details of the rights you have relating to the personal data we hold about you now and any personal data we might collect about you in the future.
If you require this Specific Privacy Notice in Braille or in another language, please contact the Force’s Data Protection Officer (contact details below).
Who is the Controller (the person who determines the purpose and means by which your personal data is processed) and what are their contact details?
The Controller is:
Chief Constable of Kent and Essex Police Kent and Essex Police HQ Sutton Road Maidstone Kent and Essex ME15 9BZ
Chief Constable of Essex Police Essex Police HQ PO Box 2 Chelmsford CM2 6DA
DPA Article 13(1)(a) and Article 14(1)(a)
What are the contact details of the Data Protection Officers?
Data Protection Officer Information Security and Governance Department Kent and Essex Police Coldharbour London Road Aylesford ME20 7SL Email: [email protected] and essex.police.uk
Data Protection Officer Essex Police HQ PO Box 2 Chelmsford Essex CM2 6DA Email: [email protected]
DPA Article 13(1)(b) Article 14(1)(b)
For what purpose(s) is my personal data intended to be processed by Kent and Essex Police?
To enable vetting to assess your suitability to be employed within the forces. DPA
What personal data of mine will be processed by Kent and Essex Police?
Kent and Essex Police will collect and process the following personal data:
Date and place of birth
Your contact details
Personal details of family members
Any known criminal associates.
In certain circumstances you may be required to provide financial information.
Special Category data:
What is Kent and Essex Police’s legal basis for processing my personal data?
The lawful basis for processing personal data is that it is necessary to comply with a legal obligation (Article 6(c) GDPR) and Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(e) GDPR).
The lawful basis for processing special category personal data is for the purpose of exercising a function conferred by an enactment and is necessary for reasons of substantial public interest (Article 9(2)(g) GDPR) (DPA 2018, Sch.1, Part 2, S.6).
The Statutory basis for this is the College of Policing Vetting Code of Practice (issued October 2017). This was presented to Parliament pursuant to Section 39A (5) of the Police Act 1996, as amended by Section 124 of the Anti-Social Behaviour, Crime and Policing Act 2014.
DPA Article 13(1)(c) and Article 14(1)(c)
How will my personal data be processed?
The information provided will be used as the basis for conducting background checks and enquires against Police databases and information systems. Where applicable, it will also be checked against ‘open source’ internet, the records of Credit Reference Agencies and other third-party records.
Where Credit Reference Agency records are checked, this will be for the vetting subject only and not for any other individuals named on the form.
Any information which is revealed as a result of the vetting process is reviewed by a vetting practitioner. The personal data collected will continue to be held within the records created for that purpose.
If my personal data is obtained by Kent and Essex Police from someone else what are the categories of personal data collected?
See section 4
DPA Article 14(1)(d)
Who will my personal data be disclosed to by Kent and Essex Police?
The information may be shared with other police forces / agencies in the United Kingdom in respect of any recruitment applications you may make. Within the forces the information provided will not be shared with anyone outside the Professional Standards and HR Departments, unless for a legitimate law enforcement purpose.
DPA Article 13(1)(e)
Does Kent and Essex Police intend to transfer my personal data out of the U.K. or to an international organisation?
No, all personal data remains within the UK.
DPA Article 13(1)(f) and Article 14(1)(f)
If Kent and Essex Police intends to transfer my personal data out of the U.K. or to an international organisation what safeguards are there to protect my personal data?
DPA Article 13(1)(f) and Article 14(1)(f)
How long will my personal data be retained by Kent and Essex Police?
We will only keep your information for as long as it is required to be retained. Information provided to facilitate vetting will be retained for the duration of the application or subsequent employment and beyond in accordance with the force retention schedule, after which it will be securely destroyed.
DPA Article 13(2)(a) and Article 14(2)(a)
What are my rights under the GDPR?
You have the following rights under the GDPR:
Right to be informed
Right of access
Right of erasure
Right to restriction of processing
Right to data portability
Right to object
Right not to be subject of automated decision-making
Full details of those rights and how to exercise them can be found in Kent and Essex Police’s high-level Privacy Notice which can be found on the home page of the Kent and Essex Police website. It can also be obtained from:
Public Disclosure Team Kent and Essex Police Coldharbour London Road Aylesford ME20 7SL Email: [email protected]
Information Rights Team Essex Police HQ PO Box 2 Chelmsford CM2 6DA Email: [email protected]
DPA Article 13(2)(b) and Article 14(2)(c)
If Kent and Essex Police relies on my consent to be the legal basis for processing my personal data can I withdraw that consent?
The lawful basis for the processing of personal data in this instance is based on ‘legal obligation’ and ‘public task’ not ‘consent’.
DPA Article 13(2)(c) and Article 14(2)(d)
Who can I lodge a complaint with if I am unhappy about the way my personal data is processed by Kent and Essex Police?
You may lodge a complaint with the Information Commissioner’s Office. Their contact details are:
Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Telephone: 0303 123 1113 Website: www.ico.org.uk
You may wish to initially raise any concerns with the Data Protection Officer.
DPA Article 13(2)(d) and Article 14(2)(e)
If my personal data was obtained by Kent and Essex Police from someone else from who or where was it obtained by Kent and Essex Police?
DPA Article 14(2)(f)
Am I required to provide my personal data under a statutory or contractual requirement, or a requirement necessary to enter into a contract, or am I obliged to provide it?
Whilst you can decline to provide some, or all, of the information required in the vetting forms, it will not be possible to conduct a meaningful risk assessment and clearance cannot be granted. As such you are unlikely to be employed by either force.
DPA Article 13(2)(e)
Will my personal data be used for automated decision-making, including profiling?
DPA Article 13(2)(f) and Article 14(2)(g)
If my personal data will used for automated decision-making, including profiling what logic will be involved and what significance and consequences will there be for me from the automated decision-making?