Contents

Our legal basis for processing your personal data

When we will process your personal data

Who we might share your personal data with

Your rights

Requesting your personal data

How to make a complaint

How to make a query

Additional information

Our legal basis for processing your personal data

Article 6(1) of the General Data Protection Regulations explain where the processing of personal data is lawful. These are:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• processing is necessary for compliance with a legal obligation to which the controller is subject
• processing is necessary in order to protect the vital interests of the data subject or of another natural person
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

HM Inspectorate of Prisons process personal data (including special categories) under the terms of (a)(b)(c)(d).

[a] for example, where data subjects have explicitly subscribed to communications, or given consent to be contacted for survey/consultation purposes

[b] for example, where data subjects have entered into a contract of employment with HM Inspectorate of Prisons

[c] for example, where data subjects are under the supervision of organisations who provide custodial services, and whose work HM Inspectorate of Prisons has a legal obligation to inspect

[d] for example, where data subject(s) have been identified as being at risk of harm in order to take preventative measures to reduce that risk of harm

Additional information on the remit of HMI Prisons can be found here.

When we will process your personal data

HM Inspectorate of Prisons will process your personal data when:

• you are a member of staff (including prospective members of staff, fee paid staff, and short-term placements)
• you are a person that has a connection to an inspection (including a person who has offended, victims, those with parental responsibility of children or young people who have offended, staff within organisations who provide custodial services)
• you have explicitly subscribed to receive communications or given consent to be contacted for survey/consultation and other purposes
• we undertake research from information gained through inspection or other lawful means
• you make contact with us
• you enter into any contract to provide services to us
• we need to fulfil any contractual obligations.

Who we might share your personal data with

Other than internal staff within HM Inspectorate of Prisons, we might share your personal data with:

• partner inspectorates
• other official bodies
• providers of custodial services who we have inspected
• third-party service providers in the course of service delivery.

We will not:

• sell or rent your data to third parties; or
• share your data with third parties for marketing purposes.

We will share your data if we are required to do so by law – for example, by court order, or to prevent fraud or other crime.

Your rights

You have the right to make a subject access request. This means we will confirm what personal data we hold about you and provide a copy of that data. In additional to this, you can:

• ask for any incorrect personal data to be amended
• ask for your personal data to be erased (in certain circumstances)
• object to or request we restrict the processing of your personal data
• receive a copy of your personal data in a format that is accessible to you
• object to automated decision-making and profiling (HM Inspectorate of Prisons does not process personal data this way)

Requesting your personal data

If you wish to make a subject access request, please write to:

The Data Protection Officer
Ministry of Justice
102 Petty France
London
SW1H 9AJ

or email: data.compliance@justice.gov.uk

Please provide proof of identity with your request. We must provide a copy of your personal data, if held, within 30 days of receiving your request (or within receiving proof of identity).

There may be instances where you have requested your personal data but we cannot provide it due to it being exempt from disclosure. If this is the case, we will tell you in our response.

You can only request your own personal data.

How to make a complaint

If you wish to make a complaint because you feel your request has not been handled correctly, you can either contact our Data Protection Officer, using the email address below, or contact the Information Commissioner’s Office.

How to make a query

If you wish to make any queries relating to personal data, please contact:

data.compliance@justice.gov.uk

Additional information

HM Inspectorate of Prisons is an Arm’s Length Body of the Ministry of Justice and, as such, follows its data protection and information security policies and procedures. The Ministry of Justice’s Information Charter can be viewed here.