Data Protection & Privacy Policy
Data Controller
The Data Controller is Mr Matthew James McLaren, registered with the Information Commissioner's Office under registration reference: ZA553431.
Contact
If you have any questions about this policy or for more information about how your data is used or would like to exercise any of your rights, please contact Mr McLaren via email at matt@mattjmclaren.com
Lawful Basis for Processing
All processing is carried out by consent or either under the legitimate interest of Mr McLaren, or public interest. These cover processing to conduct casework, campaigning and communication. Where processed under the lawful basis of a task carried out in the public interest, it is to support or promote democratic engagement. This includes fundraising activity in order to support democratic engagement.
Data Sources
Data held is that provided by you when you contact Mr McLaren and correspondence with third parties in response to cases taken up on your behalf. If you do not wish for Mr McLaren to contact you by telephone please do not provide this information. The Register of Electors that councils provide to authorised persons under the Representation of the People Act is also used for electoral purposes.
Data Security
Personal data is stored electronically and securely. Mr McLaren ensures that his service providers comply with the same high standards that he does.
Special Category Data
Special category data will be processed under the lawful basis indicated above (see Lawful Basis for Processing), as is permitted in clauses 22, 23 and 24 of schedule 1 of the Data Protection Act 2018, covering political parties and elected representatives.
Transferring your data outside of the European Economic Area
The EU GDPR adequacy decision means that data can continue to flow between the UK and the European Economic Area (EEA). Some service providers are located outside of the EEA and therefore it may be necessary to transfer your personal data outside of the EEA. Where the transfer of your data outside of the EEA takes place the Data Controller will make sure that it is protected in the same way as if the data was inside the EEA, and it only occurs with your consent.
Mr McLaren will use one of the following safeguards to ensure this:
• Where the European Commission has issued an adequacy decision determining that a non-EEA country or organisation ensures an adequate level of data protection.
• A contract is put in place with the recipient of the data obliging them to protect the data to the same standards as the EEA.
Legally it is not permitted to transfer certain types of data, such as Electoral Register Data, outside of the EEA, and Mr McLaren will comply with this.
Data Retention Policy
Personal data will be held for no longer than necessary. Some types of data may be held for longer than others. Typically the maximum retention is two local election cycles. Review of the data held will occur in each election cycle to determine whether it should be maintained or put beyond use.
Subject Access Requests
Subject Access Requests are dealt with in line with the guidance given by the Information Commissioner’s Office (ICO):
• The Data Controller will request verification of the identity of any individual making a request, and ask for further clarification and details if needed.
• The Data Controller will respond within 28 calendar days once it has been confirmed that it is a legitimate request.
• Data subjects have the right to the following:
o To be told whether any personal data is being processed
o To be given a description of the personal data, the reasons it is being processed and whether it will be given to another organisation(s) or people.
o To be given a copy of the information comprising the data, and given details of the source of the data where this is available.
Will your data be shared with anyone else?
If you have contacted Mr McLaren concerning either his own candidacy for public office as a Liberal Democrat or another Liberal Democrat candidate for public office for whom Mr McLaren is acting as the appointed Election Agent or a Sub-Agent, or where you have requested to be kept informed about Mr McLaren's political campaigns, your data may be shared with the Liberal Democrats. In all such cases the Liberal Democrats will use your contact details to send you information on the topics you have requested. Any data they so gather will be used in accordance with their privacy policy at www.libdems.org.uk/privacy To exercise your legal data rights with respect to the Liberal Democrats, email: data.protection@libdems.org.uk.
If you have contacted Mr McLaren about a personal or policy issue, your data may be passed on to a third-party in the course of dealing with your enquiry, such as local authorities, government agencies, public bodies, health trusts, regulators, and so on.
Any third parties that Mr McLaren may share your data with are obliged to keep your details securely, and to use them only for the basis upon which they were originally intended.
The Data Controller may need to share your data with a third party, such as the police, if required to do so by law.
Unless otherwise specified, data may also be shared with entities of political party associations, federations, branches, groups and affiliates in order to assist you or maintain contact with you in support of democratic engagement.
Your personal data is only used as outlined here and within your reasonable expectations based on the nature of the communication, and recognising the need of politically related engagement in wider support of democratic engagement.
Data Rights
At any point you have the following rights:
• Right of access – you have the right to request a copy of the information held about you.
• Right of rectification – you have a right to correct data held about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data held about you to be erased from the Data Controller’s records.
• Right to object – you have the right to object to certain types of processing, such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
• Right to judicial review: if the Data Controller refuses your request under rights of access, you will be provided with a reason why. You have the right to complain.
Making a Complaint
If you are unhappy with the way that your data has been processed or handled then you have a right to complain to the Information Commissioner’s Office (ICO). The ICO is the supervisory body authorised by the Data Protection Act 2018 to regulate the handling of personal data within the United Kingdom. The contact details for the ICO are:
• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
• Telephone: 0303 123 1113
• Website: ico.org.uk/concerns
If you have any questions about the data held please contact Mr M. J. McLaren via the contact information on this website.
Please note that proof of identity is required should you choose to exercise any of the above rights in relation to personal data.