Fire and rescue service incidents: privacy notice

Data on incidents attended by the Fire and Rescue Services (FRS) in England, Scotland and Wales are recorded and uploaded to the Home Office owned Incident Recording System (IRS). Data are then transferred to Welsh Government (WG) by the Home Office on an annual basis. However in-year monitoring reports are also obtained by WG directly from IRS.

This notice is to inform those whose personal data will have been recorded by the FRS in Wales during attendance at fires, non-fire incidents or false alarms and its processing by WG.

This data includes some information on casualties, rescues and property owners associated with these incidents. This data enables WG to carry out research and statistical analysis in order to monitor trends and improve the service provided to people in Wales.

A complete list of the data items collected by the Incident Recording System and made available to the WG can be found on the Home Office website.

This includes details of all incidents (fires, special service incidents and false alarms) attended by  the Fire and Rescue Service in Wales. Within this dataset some data regarding individuals are recorded, mainly in relation to those casualties or rescued involved.

These are:

• personal information of casualties and those rescued such as name, date of birth and gender
• special categories of personal information such as ethnic group
• other circumstances of fire casualties (e.g. bedridden)
• household occupancy type for dwelling fires (e.g. lone person over pensionable age, lone
• parent with dependent children etc.)
• human factors contributing to the cause of the dwelling fires (e.g. disabled)
• Vehicle Registration Mark
• address and grid reference of property

The fire incident datasets will be used by government as follows:

• to monitor progress towards national outcomes including the publication of official statistics
• to monitor FRS performance
• to develop and evaluate policy
• to identify and assist development of good practice
• to support research relating to fire and rescue incidents

The personal data contained within these datasets are required to ensure we understand the relationship between fire incidence and personal characteristics, analyse potential inequalities or understand the geographical nature of fire incidence.

This may include linking data to other datasets already held by government (for example health outcomes) to better understand the interaction between fire incidence and individual circumstances, in order to develop better policy outcomes. Any such linking would be undertaken through techniques that allow only anonymised linked data to be accessed.

WG will only use the identifiable aspects of the data to support the statistical and research processes required for any of the uses set out above, but will neither use the identifiable aspects of the data nor process the data in such a way as to:

• take action or support measures or decisions with respect to individuals
• cause any damage or distress to individuals
• identify any individuals in any reports.

Results from analyses carried out using the data will be made available in statistical or research publications released via the WG website and also via data placed on the StatsWales website.

External users such as local authorities, other FRSs and the wider public will be able to use this published information for their own purposes, such as performance measurement and management; to improve practice and to hold government to account.

WG share some or all of the data provided to them with other public sector organisations, non-government agencies and approved  researchers, but only for statistical or research purposes. In every case any such disclosures will be scrutinised by the Welsh Government’s Chief Statistician and, if approved, controlled by an appropriate WG data access agreement which will:

• ensure secure transfer, storage and eventual destruction of the data
• only include personal information if there is a clear requirement
• limit the use to the specific requirement identified, ensuring that no individual can be identified in any publish
• only allow the data to be stored for the duration of the research project, requiring the data to be destroyed after that period

Data are recorded by the FRSs and uploaded to the Incident Recording System. The Home Office provide the WG with a dataset of all available data for Wales which are subsequently analysed and hence WG is a data controller. The 3 Welsh FRSs and the Home Office are also data controllers of this data.

The Fire and Rescue Services Act 2004 (“the 2004 Act”), which devolved the FRSs in Wales to the National Assembly for Wales, was brought into effect in late 2004.

The 2004 Act makes provision about FRSs and their functions in England and Wales.

Section 26 of the 2004 Act indicates that FRAs must supply to the Welsh Ministers any reports and returns and any information with respect to their functions as the Welsh Ministers may require. This section, in conjunction with Section 58A and Section 60 of the Government of Wales Act 2006, gives the Welsh Ministers the powers to collect and process data on incidents attended by the Fire and Rescue Services in Wales.

The General Data Protection Regulation (GDPR) requires a lawful basis for processing personal data and in this case, Article 6(1)(e) applies: “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The processing of the data allows WG to monitor and develop fire related policies and strategies by having a detailed understanding of the causes and impacts of fires for particular geographical locations or groups of people.

Article 9(2)(j) in GDPR states we are able to process and collect special category data if it "is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject". Processing special category data can help to identify whether strategies or campaigns should be targeted at particular groups who may be more at risk.

The GDPR lists certain rights which apply to individuals in the context of storing and using their personal data. The rights extended to the individuals under both the articles quoted above are as follows:

• the right to be informed (this notice)
• the right of access
• right to rectification (i.e. for any errors in an individual’s data to be corrected)
• right to restrict processing (in certain circumstances, the use of an individual’s data may be restricted)
• right to object (in certain circumstances, an individual may object to the use of their data)

More guidance on these rights can be found on the Information Commissioner’s Office website.

The fire incident datasets will only be transferred through methods requiring appropriate authentication, with access limited to securely approved locations. No data will be shared via a standard open email connection or by standard postal methods.

WG become responsible for this data once it has been transferred to them, although the Home Office and the FRSs will retain responsibility for any data they continue to hold on their own systems. The transferred data are stored in a secure network with access limited to approved WG users and locations.

Data will be retained by WG for as long as it remains useful for research purposes, and because historical data can be very useful in this context, this is likely to be a considerable number of years.

Data that are shared with third parties for research purposes will only allow the data to be shared for the duration of the project, and will require the data to be destroyed after that period.

Questions about either this notice or individuals’ rights should be directed to WG in writing to the address below. Complaints should also be directed to this address in the first instance, although you can also complain directly to the Information Commissioner’s Office.

Education and Public Services Statistics
Knowledge and Analytical Services
Welsh Government
Floor 4 South
Cathays Park
Cardiff
CF10 3NQ
Email: statsinclusion@gov.wales

Information Commissioner’s Office (Wales)
Churchill House
17 Churchill Way
Cardiff
CF10 2HH
Tel: 029 2067 8400 or 0303 123 1113
Email: casework@ico.org.uk
Website: Information Commissioner’s Office

The Welsh Government’s Data Protection Officer can be contacted at:
Data Protection Officer
Welsh Government
Cathays Park
Cardiff
CF10 3NQ
Email: dataprotectionofficer@gov.wales