Subject Access Request Privacy Policy

CLICK HERE to give Open Rights Group consent to use your Subject Access Request results for our research.

By submitting your documents you are agreeing to Open Rights Group processing your personal data under the General Data Protection Regulation.

The processing undertaken is for the purposes of research in seeking to understand the use of personal data in political campaigns by parties in the United Kingdom. We will use evidence from this research to advocate for positive changes to better safeguard the right to privacy of the electorate and increase responsibility from the parties on their use of personal data in political campaigns.

Open Rights Group will analyse the data you have provided against other subject access requests submitted to Open Rights Group from members of the public. This will produce broad trends about:

  1. The type of data collected by parties;

  2. The type of profiling undertaken by parties;

  3. Which parties are profiling more and which are profiling less.

We will not publish or share your personal data with any third parties. The use of this data is purely for research purposes and will remain in line with Open Rights Group’s existing privacy policy which explicitly states that none of this information will be sold or transferred to third parties. For access to Open Rights Group’s please visit https://www.openrightsgroup.org/privacy/

Security

Your data will be stored separately from the other personal data held by Open Rights Group. Only select members of staff will be permitted access to this personal data and only to perform analysis on the data received to map the trends available from the personal data you have provided

Your data will be pseudonymised to make sure we are meeting the standards of data minimisation. Once we receive your personal data we will remove demographic trends and type of profiling undertaken (scores attributed to you by the parties profiling) and your postcode, and place in a database for analysis. We will not bring any of your personal data such as name, specific address, polling card number. Instead we will assign a random identifier that will provide us with the ability to retrieve the information, but not identify you from that information.

Retention

We will retain your personal data only for as long as is necessary to extract relevant information for research, from which point we will seek to delete the personal data permanently. 

We will retain the data for no longer than 2 years, or the end of ORG’s work on the use of personal data in political campaigns, whichever is shorter.

Revoke consent

You have the right to withdraw consent at any time in this process. This will mean that your personal data will no longer be available for analysis by Open Rights Group. Thus we would consider it no longer necessary for the purposes laid out, and subsequently delete that data. If the personal data you provided has been anonymised it will still be included in the research ORG carries out, it will only be the personal data that we hold that we will delete.

You have a right to lodge a complaint with a supervisory authority. In the United Kingdom that is the Information Commissioner’s Office.

If you would like to make a complaint, more information, and the relevant form, are available here: 

https://ico.org.uk/make-a-complaint/your-personal-information-concerns/personal-information-concerns/personal-information-concerns-report/

Your rights

I would like to know what personal data Open Rights Group are currently holding or processing about me.

If you want to know what personal data Open Rights Group currently has on you, you can ask us. Under the General Data Protection Regulation you have the right to request a data controller - in this case Open Rights Group - gives you the personal data they currently have on you.

I would like to correct inaccurate information

For example, having received your personal data you notice there are inaccuracies about the personal data and you would like to correct that personal data.

You have a right to correct any inaccurate personal data Open Rights Group holds about you. Just write to us with the correcting information and we will make that change without undue delay.

When you do this, another right kicks in: the right to restrict processing. We will not process your personal data for the period of time it takes Open Rights Group to verify the accuracy of personal data. 

I would like to delete personal data Open Rights Group currently holds about me

For example, you no longer want Open Rights Group to have access to the personal data we currently have.

You have a right to have your personal data held by Open Rights Group erased. As the basis for processing your personal data is consent all you have to do is withdraw that consent to process personal data. After that Open Rights Group will have no other ground for processing your personal data and we will delete it without undue delay.

Contact Details

If you have any further questions please contact info@openrightsgroup.org to discuss.

You have the right to raise any issues or concerns directly with the Information Commissioner’s Office.