Welsh Government privacy notice

Where the Welsh Government collects data for a specific purpose we will provide you with a privacy notice to explain why we need that information and how we will use it.

This privacy notice tells you what to expect when you contact the Welsh Government and provide us with your personal information. When you contact us regarding the work we do, we will handle your personal data according to our official authority to undertake the core role and functions of the Welsh Government. If the information you provide us in relation to your enquiry contains special category data, such as health, religious or ethnic information the lawful basis we rely on to process it is explicit consent because you have volunteered this information. However, we will usually confirm consent where information is provided on behalf of a third party.

We will retain your information in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

You should also be aware of our responsibilities under Freedom of Information legislation.

The main Welsh Government web site, GOV.WALES has a privacy policy that explains this more fully. All other Welsh Government websites also have an equivalent privacy policy.

You can contact the Welsh Government via a number of different routes and we will deal with your enquiry in the same way regardless of how you choose to contact us. We welcome receiving correspondence in Welsh. If you indicate a preference to communicate in either Welsh or English we will record that preference and your details (name, address and email) and retain it until you tell us otherwise.

All information relating to correspondence we receive are administered and held on documents within the Welsh Government’s secure records management systems. We will keep the files in line with the review dates in our retention and disposal schedule. Your personal information will be disposed of securely once the retention period has ended.

The Welsh Government has specific procedures for dealing with certain types of enquiry: complaints, Freedom of Information requests, requests in relation to your rights under data protection law, reporting fraud and contacting ministers.

We may need to disclose your information to a third party if their input is required to respond to your enquiry. This is inevitable where, for example, the enquiry is about services delivered by one of our delivery bodies (such as the NHS or a sponsored body). If you don’t want information identifying you to be disclosed, we will try to respect that. However, it may not be possible to handle an enquiry on an anonymous basis.

Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.

If you make an enquiry on behalf of a third party (for example a friend or relative) then we will normally ask for some form of proof that they are aware of the enquiry and are content for you to pass on their details to us. For children we will seek such confirmation for any child aged 13 and over or where the nature of the enquiry involves particularly sensitive information we may seek confirmation for younger children. If you have written to your Assembly Member or Member of Parliament to ask them to raise an issue with the Welsh Government then we would not normally seek any further confirmation from you.

In some cases it is necessary for the Welsh Government to undertake due diligence checks when an enquiry is received. If additional personal data is needed then you will be asked to provide this. If you don’t want to provide the information requested, we will try to respect that. However, it may not be possible to handle your enquiry if you do not provide the information. This could include, but is not limited to, checks to confirm you are who you say you are or, in the case of funding requests, fraud and other financial probity checks.

Case files for enquiries investigated and resolved by the Welsh Government will be retained for up to 3 years after your case has been fully resolved. However, for simple enquiries that can be responded to immediately, we will delete your personal data as soon as the response has been sent to you.

If you contact a minister then we will deal with the correspondence or a meeting invitation in largely the same way as a general enquiry. This includes undertaking due diligence checks as deemed necessary. The differences are:

• We will keep correspondence in an electronic form and any original hard copies of correspondence are destroyed within 3 months of our response being issued.
• We retain your details for up to 7 years from the date of your most recent contact with the Welsh Government.
• Where a meeting with a minister takes place, or the minister attends an engagement, some details of that engagement will be published on the Welsh Government website, retained permanently as a historical record and in some cases transferred to a public archive.

However, if your correspondence is judged to be more properly dealt with under one of the other processes outlined in this privacy notice (for example it contains a freedom of information request) then we will inform you and it will be dealt with under the relevant process below.

There are a number of ways you can make a complaint to us. There may be personal information you provide to us in relation to the complaint but as a minimum we will need to ask for your name and contact details (e.g. postal address, e-mail address, telephone number). The Welsh Government will use the information you provide to process your complaint according to our customer complaints policy.

If you make a complaint on behalf of a third party (for example a friend or relative) then we will normally ask for some form of proof that they are aware of the complaint and are content for you to pass on their details to us. For children we will seek such confirmation for any child aged 13 and over or where the nature of the enquiry involves particularly sensitive information we may seek confirmation for younger children.

We may need to disclose your information to a third party if their input is required to respond to your complaint or where we have a responsibility to do so for them to resolve the concerns you have raised. If you don’t want information identifying you to be disclosed, we will try to respect that. However, in dealing with your complaint it may not always be possible to maintain your anonymity.

Case files for those complaints investigated and resolved by the Welsh Government will be retained for a maximum of 3 years after your case has been fully resolved. Complaints which are investigated by the Public Services Ombudsman for Wales, the Welsh Language Commissioner, the Information Commissioner’s Office or have been the subject of legal proceedings will be retained for a maximum of 10 years after your case has been fully resolved. If we need to retain information for longer periods for any reason we will inform you.

If the matters you raise are not governed by our customer complaints policy we will pass the details to the appropriate officials within Welsh Government to provide a response.

Should you make a request under the Freedom of Information Act 2000, we will require your name and contact details in order to meet our legal obligations under the act to provide you with a response. We will only use this personal information to deal with your request and any matters which arise as a result of it.

We will keep your personal information, and all other information relating to your request, for 3 years from the date on which we responded to your request.

If you wish to contact Welsh Government in relation to your rights under data protection legislation then you can contact the Welsh Government Data Protection Officer:

Data Protection Officer
Welsh Government
Cathays Park
CARDIFF
CF10 3NQ

Email: DataProtectionOfficer@gov.wales 

However, we will deal with a request however you contact us.

Should you make a request under the UK General Data Protection Regulations, we will require your name and contact details in order to meet our legal obligations under the law to provide you with a response. We will only use this personal information to deal with your request and any matters which arise as a result of it.

We will keep your personal information, and all other information relating to your request, for 3 years from the date on which we responded to your request.

You can contact us if you want to report fraud committed against the Welsh Government. If your personal information is then passed to Welsh Government’s Counter Fraud Unit and includes your contact details, you may be contacted in order to further discuss the referral. Welsh Government officials will investigate your referral and this investigation will determine what happens to your personal data:

• If the referral appears actionable, the information you have provided will be securely retained for the length of the investigation including any time taken should the referral proceed to prosecution. Information may be shared with the police and other investigative bodies. Information will be retained for a period of 2 years following completion of the investigation or court proceedings.
• If the referral is actionable but is not within the remit of Welsh Government to investigate, you will be contacted to obtain your consent for your referral to be forwarded to an appropriate organisation. Where we are under legal obligation to share the information, we will not seek your consent, e.g. suspicion of money-laundering or terrorist activity. Your information will be immediately deleted if you do not give your consent or following the transfer to the appropriate organisation.
• If the referral is not actionable, the data will be immediately destroyed.
• Any information provided about possible fraud against Welsh Government, will be shared with members of the Welsh Government External Assurance Panel (EAP) which will investigate such concerns. The information you have provided will be retained securely for the length of the investigation.

If you visit us at one of our offices you will need to provide your name and contact details to the officials you are meeting. When you arrive you will be asked to sign in if the building has a reception and we will then keep sign in sheets for at most 2 months. If you have a parking space allocated in a Welsh Government office with controlled parking, then we will need your registration number prior to your visit. This information will be kept for 12 months.

Many of our offices also have CCTV cameras and you may therefore be recorded as part of your visit. Any office that has CCTV cameras will have clear signs to indicate the presence of the cameras. These cameras are for security purposes and the video will not be used for any other purpose, we will keep CCTV footage for no more than 30 days.

Welsh Ministers have statutory powers to process personal data which informs how they exercise their public functions. Any response you send us will be seen in full by Welsh Government staff dealing with the issues which this consultation is about or for planning future consultations. Where the Welsh Government undertakes further analysis of consultation responses then this work may be carried out by third party contractors (e.g. a research organisation or a consultancy company). Welsh Government’s standard terms and conditions for such contracts set out strict requirements for the processing and safekeeping of personal data.

In order to show that the consultation was carried out properly, the Welsh Government will publish a summary of the responses to each consultation. We may also publish responses in full. Normally, the name and address (or part of the address) of the person or organisation who sent the response are published with the response. If you want to remain anonymous, indicate your preference when you send your response. We will remove your details before publishing.

You should also be aware of our responsibilities under responsibilities under Freedom of Information legislation.

If your details are published as part of the consultation response then these published reports will be retained indefinitely. Any of your data held otherwise by Welsh Government will be kept for no more than 3 years.

Welsh Government organise various types of events to help us in the work we do. Regardless of the purpose of the event we will need your personal data if you attend. This will include your name, contact details, the organisation you are from, dietary requirements and if the venue includes controlled access parking, then your car registration number will be required. We will use your contact details to send you information about attending the event and we may send you material from the event afterwards. In some cases we use a third party to manage our events, and our contracts set out strict requirements for the processing and safekeeping of personal data. Where you need to report to a reception at a venue, we will provide the venue with the names of all attendees and if relevant your car registration.

If the event is being held in a Welsh Government office then you can find out more in the section about visiting Welsh Government offices.

We will keep your personal information for no more than one year after any event you attend. If we wish to use your personal data for any reason other than to organise the event then we will ask you about this as part of the booking process.

As part of our work we often invite stakeholders to take part in various working groups. If you are asked to join a working group or put yourself forward, we will provide you with a description of the working group that will include:

• its purpose
• your role in the group
• how often the group will meet and over what period
• if minutes and papers of the group are published.

While you are a member of the group, we will contact you to arrange meetings, to send you papers for meetings or other information that is relevant to the purpose of the group. If we wish to use your personal data for any reason other than for the purpose of your membership of the group, then we will ask you about this first.

If you no longer wish to be a member of a working group, then you can contact the group secretariat to be removed.

We will retain any contact information for the life of the group, or your part in it, plus 3 years. Minutes and other papers that mention you by name will be retained in accordance with criteria set out in the Welsh Government’s retention schedule and as such, will be kept for as long as any associated documents.

All of the information you provide during the recruitment process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary.

We will use the contact details you provide to us to contact you to progress your application. We will use other information you provide to us during the recruitment process, to assess your suitability for the role you have applied for.

We will also ask you about your previous experience, qualifications and/or education and for details of referees who we may contact in the event that we make you a conditional job offer. During the recruitment process we will also ask you for answers to questions relevant to the role you have applied for. Staff in our HR Recruitment Teams will have access to all of this information.

You will also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. It will not be made available to any staff outside our recruitment team, including hiring managers, in a way which can identify you. Any information that you do provide will be used only to produce and monitor equal opportunities statistics.

If we make a conditional offer of employment we will ask you for information so that we can carry out pre-employment checks. You must successfully complete pre-employment checks to progress to a final offer of employment, with the Welsh Government.

If we make a final offer of employment, we will also ask you for further information once you have accepted the offer such as bank details.

Third parties sometimes provide elements of our recruitment service for us. We have contracts in place with our third party data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

All information provided during the recruitment process will be retained in accordance with criteria set out in the Welsh Government’s retention schedule.

A full description of the recruitment process is available on the recruitment page.

Under data protection legislation, you have the right:

• to be informed of the personal data Welsh Government holds about you and to access it
• to require us to rectify inaccuracies in that data
• to (in certain circumstances) object to or restrict processing
• for (in certain circumstances) your data to be ‘erased’
• to (in certain circumstances) data portability
• to lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection

For further information about the information which the Welsh Government holds and its use, or if you wish to exercise your rights under the UK GDPR, please see contact details below: