Road project contractors: privacy notice

This privacy notice describes how we will handle any personal data collected on our behalf by our contractors in the course of transport infrastructure projects.

Welsh Government is responsible for delivering various transport infrastructure projects. Examples of such infrastructure projects include building new roads and bridges or upgrading existing roads. In the course of undertaking such projects Welsh Government carries out public tasks.

In order to deliver transport infrastructure projects Welsh Government contracts with various consultants and contractors who may collect personal information on their behalf. Welsh Government enters into contracts with contractors in respect of the construction work on such projects and also engages consultants to act on its behalf in managing these projects. This privacy notice deals with personal information that is collected on behalf of Welsh Government by its contractors in the course of transport infrastructure projects.

In this situation Welsh Government (referred to as "we", "us" or "our" in this privacy notice) is the data controller and is responsible for the personal data collected and decides how it should be processed. We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. Details of how you can contact our DPO appear at the bottom of this notice.

Contractors engaged by Welsh Government in the course of transport infrastructure projects are data processors and process data on our behalf in accordance with our instructions.

This privacy notice aims to give you information on how we collect and process your personal data in the course of transport infrastructure projects, including any data collected by Welsh Government contractors on our behalf.

This privacy notice does not apply to people who currently work for Welsh Government, have worked for us or who are interested in working for us. We have separate privacy notices for these groups.

It is important that you read this privacy notice together with the general Welsh Government privacy notice so that you are fully aware of how and why we are using your data. We may also publish or issue supplementary privacy notices from time to time to deal with specific situations. This privacy notice relates only to transport infrastructure projects and supplements any other notices we may send to you or which we publish on our website and is not intended to override them.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). Personal information could be communicated in a number of ways. This could include, but may not be limited to, information communicated by email or other electronic means, in paper form or verbally.

The personal information collected and processed by us (or on our behalf) as part of a transport infrastructure project may include the following information about individuals:

• name
• home/business address including postcode
• email address
• telephone numbers
• date of birth
• letters, emails or other records of communications
• views and opinions about planned or existing projects
• information about the impact of projects on individuals
• feedback on existing projects
• information about individual land ownership
• employment information including job title (in the case of supplier, consultant or contractor personnel)
• information about performance where relevant to the project (in the case of supplier, consultant or contractor personnel)
• photographs

We do not generally collect any Special Categories of Personal Data (this includes details about race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences. However, information may occasionally be provided to our contractors which could include Special Category data. For example, a member of the public may provide information about how they would be particularly impacted by a proposed scheme because of their health issues. Alternatively, they might provide information about their political opinions in the course of correspondence.

Information is collected by contractors acting on behalf of Welsh Government in the ways set out below. This information may be provided directly by individuals, or provided by third parties such as other contractors or subcontractors or our consultants or may be collected from publicly available sources. Information may be collected in the following ways:

• through preparing contractual documentation
• through preparing and maintaining communication registers,
• in the course of obtaining compulsory purchase orders
• in the course of consultation processes
• through preparing or receiving reports
• through correspondence with the public or personnel working for consultants, other contractors or subcontractors
• through correspondence with stakeholders,
• through correspondence with suppliers
• through correspondence with landowners
• through correspondence with local authorities (where applicable)
• through preparing or receiving the minutes of meetings
• information provided at public information exhibitions
• information provided in the course of public inquiries
• through questionnaire responses
• through carrying out surveys
• as part of the cost auditing and verification process when administering  contracts.

Please note that the above list is not intended to be exhaustive.

We will only use your personal data when the law allows us to. In most cases we process the above information as part of our public task i.e. exercising our official authority to undertake the core functions of the Welsh Government in relation to transport infrastructure projects or in undertaking contract management activity. In most instances our lawful basis for processing personal information will therefore be that we need to do so in order to carry out a public task. In the course of undertaking these core functions we may need to process personal information for a number of different purposes. Examples would include:

• to enter into and manage the contracts we have with our consultants and contractors in order to ensure the delivery of our transport infrastructure projects
• to provide the public with information about proposed projects and to keep them informed about existing projects
• to obtain public opinion and feedback, to undertake consultation with the public and stakeholders and, where appropriate, to undertake public inquiries
• to take steps which are necessary to ensure project delivery e.g. acquiring land where this is essential to the project

We may occasionally also process personal information in the following circumstances:

• where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We will only rely on this lawful basis where we are processing for a legitimate reason other than performing our tasks as a public body.
• where we need to comply with a legal or regulatory obligation.

Generally we do not rely on consent as a legal basis for processing your personal data.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

We will keep personal information contained in files in line with our retention policy. Your personal data may be kept for 6 years (or up to 20 years for major projects) after the contract end date. 

We may have to share your personal data with the parties set out below for the purposes set out in the “How we use your personal data” section above.

• with our consultants or other contractors :
  • in the course of managing the project
  • where we ask them to contact or distribute information to members of the public on our behalf
  • in the course of public consultation or in order to arrange a public inquiry
• with our auditors to include:
  • Welsh European Funding Office
  • European Funds Audit Team
  • Wales Audit Office
  • EU Auditors
• with our lawyers or other professional advisers

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party processors to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

We do not transfer information outside the European Economic Area (EEA) or store personal information on servers which are hosted outside the EEA.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Under certain circumstances, you have rights under data protection laws in relation to your personal data. You have the right to:

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Withdraw consent at any time should we be relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.
• Lodge a complaint with the Information Commissioner’s Office (ICO) who is the independent regulator for data protection

If you wish to exercise any of the rights set out above, or if you would like further details about the information the Welsh Government holds and its use, please contact our DPO using the details below:

Data Protection Officer
Welsh Government
Cathays Park
Cardiff
CF10 3NQ

Email Address: dataprotectionofficer@gov.wales

The contact details for the Information Commissioner’s Office are:

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 01625 545 745 or 0303 123 1113

Website: ico.org.uk