Guidance

Extended producer responsibility for packaging: privacy notice

This privacy notice explains what personal data is collected through the extended producer responsibility for packaging service and how that personal data is used.

From:
Department for Environment, Food & Rural Affairs
Published
7 August 2024
Last updated
23 September 2024 — See all updates

Extended Producer Responsibility (EPR) for packaging is a component part of wider Collection and Packaging Reforms (CPR) programme that will require certain producers of packaging to take greater responsibility for its disposal and recycling. This privacy notice explains what personal data is being collected through the services (including ‘report packaging data’) provided under the EPR for packaging and how that personal data is used.

If you have any queries about the content of this privacy notice, email:

[email protected]

Who collects your personal data

The Department for Environment, Food and Rural Affairs (Defra) is controller for the personal data we collect:

Department for Environment, Food and Rural Affairs
Seacole Building
2 Marsham Street
London
SW1P 4DF

If you need further information about how Defra uses your personal data and your associated rights, you can contact the Defra data protection manager at the above postal address or email:

[email protected]

The data protection officer for Defra is responsible for checking that Defra complies with legislation. you can contact the Defra data protection manager at the above postal address or email:

[email protected]

Defra is also acting as the ‘data processor’ for the personal data being collected through some services. As the data processor, we collect and share data on behalf of the following 4 environmental regulatory bodies:

  • Environment Agency (EA)
  • Natural Resources Wales (NRW)
  • Northern Ireland Environment Agency (NIEA)
  • Scottish Environment Protection Agency (SEPA)

 What personal data Defra collects

Depending on the services you use, Defra collects your:

  • name
  • contact details
  • organisation name
  • Internet Protocol (IP) address, and details of which version of web browser you used
  • information on how you use the site, using cookies and page tagging techniques
  • questions, queries, or feedback you leave

How this data will be used

We collect this data for the following purposes.

 How environmental regulators will use your data

The environmental regulators will use your data to undertake their statutory monitoring role for EPR for packaging. This includes:

  • approving or refusing a request to be an ‘approved person’ or someone with ‘delegated authority’
  • tracking who has submitted organisation and packaging data.
  • calculating recycling obligations

How the scheme administrator will use your data

The scheme administrator will use the data to:

  • calculate fees where applicable, for example calculating the disposal cost obligations of producers
  • issue invoices
  • calculate the grants payable to local authorities
  • share data with a third-party organisation contracted to manage the invoicing of organisations for disposal cost obligations
  • prevent and detect crime
  • gather and respond to feedback aimed at improving our services
  • monitor the performance and security of the online services
  • contact you to obtain further information

How Defra will use your data

Defra will use your data:

  • to invite you to join one or more services
  • so that you can set up an account and access those services
  • so the scheme administrator can contact you about those services

Data obtained from third parties

Depending on the services you use, Defra obtains your personal data from:

  • one or more of the environmental regulators
  • your representative
  • a local authority
  • the Ministry of Housing, Communities and Local Government
  • publicly available sources

Lawful basis for processing your personal data

The lawful basis for processing your personal data is that it is necessary to:

  • perform a task in the public interest as part of EPR for packaging
  • do work as a government department under EPR for packaging

Legislation that supports this basis

EPR for packaging was introduced in support of the Government’s 25 Year Environment Plan. This is underpinned by sections 50 and 51 of Part 3 and Schedule 4 and Schedule 5 of the Environment Act 2021.

It is also supported by legislation in each of the four nations:

The processing of your personal data is not based on consent. You cannot withdraw it.

Sharing your personal data

We will share the personal data collected under this privacy notice with the environmental regulators. We do this to deliver services as part of EPR for packaging.

The environmental regulators are controllers in their own right. You can learn more about how your personal data is processed by reading the environmental regulators’ joint privacy notice.

We will publish a public list of large producers (PLLP) in accordance with legislation in each nation and subsequent amendments.

Defra respects your personal privacy when responding to access to information requests. We only share information when necessary to meet the statutory requirements of the Environmental Information Regulations 2004 and the Freedom of Information Act 2000.

How long Defra holds personal data for

We will keep your personal data for 7 years in line with the requirements of the EPR for packaging, except data related to Invoicing activities which will be retained for 11 years.

 What happens if you do not provide the personal data

You will not be able to use EPR for packaging services.

Use of automated decision-making or profiling

The personal data you provide is not used for:

  • automated decision making (making a decision by automated means without any human involvement)
  • profiling (automated processing of personal data to evaluate certain things about an individual)

Transfer of your personal data outside of the UK

Defra will only transfer your personal data to another country that is deemed adequate for data protection purposes.

Your rights

Based on the lawful processing above, your individual rights are:

  • the right to be informed
  • the right of access
  • the right to rectification
  • the right to restrict processing
  • the right to object
  • rights in relation to automated decision making and profiling

Find out more about your individual rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

Complaints

You have the right to make a complaint to the Information Commissioner’s Office at any time.

Defra’s personal information charter

Defra’s personal information charter explains more about your rights over your personal data.

Updates to this page

Published 7 August 2024
Last updated 23 September 2024 + show all updates

  1. This updates the privacy notice to cover aspects of the extended producer responsibility for packaging programme beyond the report packaging data service.

  2. Added translation

Sign up for emails or print this page

Contents

Related content