Impact assessment

Defra's research privacy notice

Updated 4 December 2024

© Crown copyright 2024

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: [email protected].

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/request-for-information-on-substances-proposed-as-persistent-organic-pollutants-pops-2024/defras-research-privacy-notice

This privacy notice covers most of the social and user research that Defra carries out.

Defra may sometimes carry out social and user research not fully covered by this privacy notice. When this happens, Defra will provide details of how this research differs when it invites you to take part in the research.

1. Who collects your personal data

Department for Environment, Food and Rural Affairs (Defra) is the controller for the personal data we collect:

Department for Environment, Food and Rural Affairs
Seacole Building
2 Marsham Street
London
SW1P 4DF

If you need further information about how Defra uses your personal data and your associated rights you can contact the Defra data protection manager. Email [email protected].

The data protection officer for Defra is responsible for checking that Defra complies with legislation. You can contact them by email at [email protected].

2. What personal data we collect and how it is used

Defra collects your:

  • name and contact details
  • views and experiences of a topic
  • internet protocol (IP) address, if recorded
  • kind of device used

We may sometimes ask for more sensitive personal data such as your:

  • age
  • education or skills
  • health or disability
  • level of income
  • location
  • observed behaviour
  • race and ethnicity

Your personal data may be used as part of the social and user research that Defra carries out. For example, Defra may use personal data to understand how people’s attitudes and behaviours can differ depending on demographic factors.

Defra will give details of what personal data is collected and how it is used when it invites you to take part in the research.

The legal basis for processing your personal data is:

  • your consent
  • a task carried out in the public interest. This is to allow Defra to carry out its work as a government department. This may be applicable at a point during the processing, when consent in is no longer the legal basis for processing, for example when your personal data has been incorporated into its analysis and can no longer be identified

The legal basis for processing your special category personal data is your explicit consent.

Where the processing of your personal data is based on consent, you can normally withdraw your consent, and have personal data removed. You can do this using the contact details provided by Defra when you take part in the research.

However, you may not be able to withdraw your consent once Defra has incorporated it into its analysis. If this is the case, Defra will tell you when you take part in the research.

6. Who we share your personal data with

Defra does not normally share your personal data with third parties. If we need to, we will tell you when we invite you to take part in the research.

7. Information requests

Defra respects your personal privacy when responding to access to information requests.

It will only share information when necessary to meet the statutory requirements of the Environmental Information Regulations 2004 and the Freedom of Information Act 2000.

8. Data that has been made anonymous

Normally, Defra makes any personal data it shares with third parties anonymous. This may involve removing your personal data or combining it with other data.

Your anonymised information may be shared in the form of:

  • academic publications
  • presentations
  • processed data
  • reports
  • video clips

9. How long Defra holds personal data

Defra will keep your personal data for up to 3 years after the end of your research session. Data that has been made anonymous may be kept for longer.

Personal data may be deleted earlier if no longer needed for research purposes. Defra will tell you if this is the case when it invites you to take part in the research.

10. What happens if you do not provide the personal data

Defra will not be able to gather your views and experiences. You will not be able to contribute to the specific goals of the research.

11. Use of automated decision-making or profiling

The personal data you provide is not used for:

  • automated decision making (making a decision by automated means without any human involvement)
  • profiling (automated processing of personal data to evaluate certain things about an individual)

12. Transfer of your personal data outside of the UK

Defra will only transfer your personal data to another country that is deemed adequate for data protection purposes.

13. Your rights

Find out about your individual rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

14. Complaints

You have the right to make a complaint to the Information Commissioner’s Office at any time.

15. Defra’s personal information charter

Defra’s personal information charter explains more about your rights over your personal data.

Back to top