Guidance

Freedom of Information/Environmental Information Regulations request privacy notice

Published 9 August 2018

Personal information we collect when you submit a request

When you submit a request to us we ask for:

• identity details
• contact details

Why we need the information and what happens if you do not provide it

We need your name and contact details because:

• we need to contact you about your request if we require any clarification or further information pursuant to your request, to update you on the progress of your request, and to respond fully to your request and any subsequent complaint into the handling of the request or the decision reached

• Section 8 of the Freedom of Information Act 2000 states that a request should contain the name of the applicant and an address for correspondence.

If you do not provide the contact information we need, we will not be able to process your request.

How we will process your personal data

FOI/EIR Requests received by the Commission will be logged and stored in our case management system whilst they are progressed. They will be initially triaged by the Records, Information Governance and Assurance (RIGA) team and may be passed to different areas of the business (depending upon the subject matter of the request) who will respond directly to you.

How long we will hold your personal data for

Information is held in line with the Charity Commission’s Retention Schedule. For information connected with a Freedom of Information request (such as disclosed information, details of any exemptions applied and the request itself), the retention period is set at 3 years from the date of the last record.

We retain details of requests in order to compile statistical reports for Cabinet Office reports on performance, and to serve as useful case studies for staff handling requests. We may also need to get in touch with you in connection with your request; for example, to obtain clarification or to correspond with you on a query or complaint.

Sharing of personal data

We may share your personal data:

• with the Information Commissioner’s Office (ICO) as the regulator for the Freedom of Information Act and Environmental Information Regulations

• to a court, tribunal, party or prospective party where the disclosure is necessary in order to exercise, establish or defend a legal claim

• where we are ordered to by a court or tribunal or where we are otherwise required to do so by law

You can find out more information about data sharing and further processing in our main privacy notice.

The legal basis for processing your information

The table sets out the legal basis on which we process this information when we receive a request.

We may further process your data for a compatible purpose, and more information is available in our general privacy notice.

	Legal basis for processing
Categories of Personal Data	Personal Data (Article 6(1) GDPR	Sensitive Personal Data/Criminal Data
Identity Details Contact Details	(c) Processing is necessary for compliance with a legal obligation to which the controller is subject (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

Your Rights

You have a number of rights under the GDPR, the right to restrict or object to further processing, including the right to access your data, and the right to complain to the ICO. More information is contained within the Commission’s general privacy notice.