Data Privacy.

When you contact us, visit us, access or use our services either online, by post, in person or by other means, or otherwise engage with our work, we may collect, store and use your personal data. We may also receive personal data about you from other people.
The personal data we collect and process may include:
name, address, phone number, email address, other personal contact details proof of identity, personal data that you share when you contact us by letter, email, phone or other means.

We process your personal data so we can:

• make sure that our Office functions properly
• investigate complaints about MLAs’ conduct
• ensure correspondence with you is correctly addressed
• explain and promote the work of the Northern Ireland Assembly Commissioner for Standards

The reason we collect personal data, also known as the lawful basis, defines the purpose for processing information. These bases include:

• where it is necessary for the performance of our public task or is in the public interest (GDPR Article 6 (1) (e))
• where we have your consent to do so (GDPR Article 6 (1) (a))
• where necessary to fulfil a legal obligation (GDPR Article 6 (1) (c)), such as collecting information about donors to MLAs.

We collect data to investigate complaints about MLAs
The personal data we collect and process may include:

• name, address, phone number, email address, other personal contact details
• photographs, video or audio recordings and images, including CCTV footage
• proof of identity
• personal data that you share when you contact us by letter, email,
• phone or other means
• special category data including data on politics – see section below

We may also on occasion share personal data with:

• the Standards and Privileges Committee and its staff
• an MLA who is the subject of a complaint (so they know the name of an individual who has made a complaint against them)
• a witness or potential witness in an investigation
• Northern Ireland Assembly authorities (where this is relevant to a suspected breach of the rules)

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• you have corresponded with the Office of the Northern Ireland Assembly Commissioner for Standards or taken part in its work e.g. by making a complaint or submitting evidence
• you have requested a publication from us
• you have provided feedback
• you have submitted data for the Register of Members’ Interests.

We may also receive personal data about you from other people, e.g. as a complainant or potential witness in an investigation or inquiry into a complaint or concerning an entry in the Register of Members’ Interests.

A further lawful basis is required when processing special categories of personal data as these require greater protection. Special categories include:

• racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic and biometric data
• health data
• sex life or sexual orientation

We may process special categories of personal data where it is relevant to an investigation. The law will differ depending on the circumstances but might include processing where we have your explicit consent or where it is necessary for substantial public interest.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. The Northern Ireland Assembly Commissioner for Standards will retain your personal data for as long as is necessary for the purpose it was collected, or for six months. This is to enable us to respond to follow-up requests by the Information Commissioner’s Office.

You have certain rights over the personal data you provide to us. We will ensure you can exercise these.
The following scenarios explain these rights in more detail:

• where we are relying on your consent to use your personal data, you can withdraw that consent by unsubscribing from our services or writing to us
• you can request access to the personal data we hold about you by contacting the Commissioner’s Office
• you can ask us to update your personal data if it changes
• in certain circumstances, you can request we erase the personal data we hold, or ask us to stop or restrict processing it if you have an objection
• if you have any concerns relating to the use of your personal data, you may complain to the Commissioner in the first instance

Full details on your rights are available from the Information Commissioner’s Office.