This privacy notice is provided by the Bishop of Peterborough to explain what to expect when we collect and process your personal information in accordance with the [UK GDPR / the EU General Data Protection Regulation (GDPR)]. This notice covers data collected by the Bishop of Peterborough, the Bishop of Brixworth and their joint office (the bishops’ office).
Data controller(s)
The data controller is:
- The Rt Revd Debbie Sellin, The Bishops’ Office, The Palace, Peterborough PE1 1YA, bishop@peterborough-diocese.org.uk, 01733 562492
For further information on the Bishop of Peterborough please go to:
www.peterborough-diocese.org.uk
Your personal data – what is it?
Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in my possession or likely to come into such possession. The processing of personal data is governed by the UK General Data Protection Regulation 2016/679 (the “GDPR and the Data Protection Act 2018, (the “DPA 2018”)
How do I gather data?
I may gather data about you from emails or written correspondence you send to me or those who process data on my behalf. I may also collect data from telephone calls you make to myself or the bishops office.
I work closely with other Church of England bodies including The Archbishop’s Council, The Church Commissioners for England, the Church of England Central Services (“National Church Institutions” or “NCIs”), and the Diocesan Registry. I, and those who process data on my behalf, will only request data from these organisations when it is necessary to fulfil my role in providing a service to you.
How do I process your personal data?
I comply with my obligations under the UK GDPR and DPA 2018 by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
You are responsible for ensuring the accuracy of all the personal data you supply to me and I will not be held liable for any errors unless you have advised me previously of any changes in your personal data.
I use your personal data for the following purposes: –
I use the data which I hold to exercise my legal and pastoral responsibilities as diocesan bishop. This includes:
- oversight of and responsibility for clergy and licensed lay ministers in the diocese (see relevant privacy noticed for specific details of how I manage the data of each group)
- carrying out any legal duties and requirements of the office of the Bishop of Peterborough
- maintaining records of churchwardens and other bishop’s officers
- the pastoral care of people within the diocese, including clergy and their families
- carrying out comprehensive safeguarding procedures in accordance with best safeguarding practice
- carrying out procedures in relation to the clergy discipline measure
- managing employment records of those who work in the bishops’ office
- maintaining my own accounts and records
- maintaining records and correspondence linked to my responsibilities within the House of Lords or as a trustee, patron or vice president of other bodies.
- What is the legal basis for processing your personal data?
Most of the data I hold is processed under the lawful reason of legitimate interest, that is that I need to process the data in order to fulfil my responsibilities as bishop and chief pastor to the Diocese of Peterborough. An example of this would be the pastoral care of a clergy widower living in the diocese or to look into a complaint made about a priest in the diocese.
Some of our processing is to comply with legal obligation. An example of this would be to fulfil my duties under Canon Law to ensure that those I ordain have received the appropriate training.
I may also process data if it is necessary for the performance of a contract with you, or to take steps to enter into a contract. An example of this would be a priest applying for a parochial vacancy.
I may process information about your religious beliefs. This is permitted for religious organisations to administer membership or contact details.
I may also need to process (and share with certain 3rd parties listed below) special category data (most likely health data, data relating to religious and/or philosophical beliefs) to comply with my safeguarding duties and obligations. I would process this only if it is necessary for reasons of Substantial Public Interest (under Article 9(g)). When processing and/or sharing any special category data all efforts will be made to ensure appropriate measures are put in place regarding security of data and adherence to the requirements of Schedule 1 of the DPA 2018
If I wish to use your personal data for a new purpose, not covered by this Data Privacy Notice, then I will provide you with a new notice explaining this new use prior to commencing the processing of your personal data and setting out the relevant purposes and processing conditions. Where and whenever necessary, I will seek your prior consent to the new processing.
Sharing your personal data
Your personal data will be treated as strictly confidential, and will be shared only when necessary with institutional bodies that comprise the Church of England or the third parties listed below. The exception to this is for licensed clergy and clergy with permission to officiate who are required to have public contact details (see licensed clergy privacy notice and permission to officiate privacy notice)
If I wish to share your personal data in any other way outside the Church of England, or in any other means, then I will always seek your consent first. The exception to this is where it is in the public interest and is necessary for the purposes of:
- protecting an individual from neglect or physical, mental or emotional harm; or
- protecting the physical, mental or emotional well-being of an individual where that individual is a child or is an adult at risk.
Third parties
- Institutional bodies that comprise the Church of England for the purposes of administrative functions (including governance bodies and committees)
- Internal and external auditors, and quality assurance reviewers, independent reviewers
- Judicial, statutory, regulatory bodies
- Law enforcement and prosecution agencies pursuing security or criminal investigations
- Legal or other internal/external advisors
- Third-party system providers:
Legal or other internal/external advisors including:
- Anna Spriggs, a partner of Howes Percival LLP, fulfils the Diocesan Registry function and provide legal advice to the Bishop and James Stewart the Deputy Registrar (Hunt & Coombs LLP).
- The Diocesan Chancellor David Pittaway KC and the Deputy Chancellor Sir Martin Griffiths KC
- Legal advisers who provide specialist, non ecclesiastical, legal advice to the Bishop.
Thirtyone:eight – an independent Christian safeguarding charity, who conduct Disclosure and Barring Service (DBS) checks on my behalf, as well as offering other safeguarding support services
A National Safeguarding Information Sharing Agreement (ISA) has been signed by Church of England bodies and the Church in Wales under the Church of England Information Sharing Framework.
A National Safeguarding Data Sharing Agreement (DSA) has been signed by the Church of England bodies and the Church in Wales and the National Police Chiefs Council.
Transferring personal information outside the UK
I will not transfer your personal information to countries outside the United Kingdom, except where I or my office use the services of a third party (listed above) who host data outside the UK. I and my office will only use third parties who ensure that data hosted outside the UK is held in accordance with UK GDPR. Where data transfer is required outside these third parties, for example in relation to our international link diocese, separate consent will be sought.
How long do I keep your personal data?
We will keep your information in accordance with the retention section of the Clergy File Policy and Guidance, and the Church of England retention schedule.
Church of England Retention Schedule
Your rights and your personal data
Unless subject to an exemption under the UK GDPR or DPA 2018, you have the following rights with respect to your personal data: –
- The right to request a copy of your personal data which I hold about you;
- The right to request that I correct any personal data if it is found to be inaccurate or out of date;
- The right to request your personal data is erased where it is no longer necessary for me to retain such data;
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
- The right to object to the processing of personal data, (where applicable)
- The right to lodge a complaint with the Information Commissioner who may be contacted at www.ico.org.uk/concerns or telephone 0303 1231113
Further processing
If I wish to use your personal data for a new purpose, not covered by this Data Protection Notice, then I will update this privacy notice on the Bishops’ Office page of the Diocese of Peterborough’s website, and where practicable alert you to this new notice prior to commencing the processing and setting out the relevant purposes and processing conditions. Wherever and whenever necessary, I will seek your prior consent to the new processing.
Contact Details
To exercise all relevant rights, queries or complaints please contact The Bishops’ Office, The Palace, Peterborough PE1 1YA, bishop@peterborough-diocese.org.uk
You have the right to make a complaint at any time to [the Information Commissioner online at: Make a complaint about how an organisation has used your personal information | ICO or by phone on 0303 123 1113 (local rate).
Under current arrangements, the ICO will generally expect you to have approached the data controller first, before making a complaint to them.
This Privacy Notice will be reviewed and amended from time to time to align with changes to Church or UK legislation, codes of practice, policy or guidance.
Privacy Notice – Legitimate Interest Assessments
Where the legal basis under which I hold your data is legitimate interest I am required to justify that it is appropriate to use the lawful basis ‘legitimate interest’. To do this I complete a legitimate interest assessment. A summary of each of these assessments which relate to this privacy notice is below. For a copy of the full Legitimate Interest Assessment, please contact andrew.birks@peterborough-diocese.org.uk
Pastoral care of clergy widow(er)s
| I have a specific purpose with a defined benefit | To provide pastoral care to the widow(er)s of clergy who I am aware are either resident in the diocese or whose spouse had a strong link with the diocese |
| The processing is necessary to achieve the defined benefit. | Yes |
| The purpose is balanced against, and does not override, the interests, rights and freedoms of data subjects. | The widow(er)s rights and freedoms are overridden, but with the benefit to them of providing pastoral care and support. Strict procedures are in place to ensure that contact details are not shared outside the Church of England. |
Interviews for parochial posts and employment within the bishops’ office
| I have a specific purpose with a defined benefit | To appoint the most suitable candidate to a post |
| The processing is necessary to achieve the defined benefit. | Without processing it would not be possible to ensure that an appropriate candidate was being appointed |
| The purpose is balanced against, and does not override, the interests, rights and freedoms of data subjects. | The processing does legitimately override the rights and freedoms of the candidate, but this is important to ensure that the right candidate is placed in the right parish |
Temporary mailing lists for events, communications and Christmas cards
| I have a specific purpose with a defined benefit | To form temporarily held mailing lists to allow for invitations to events, sending of Christmas Cards or other communications from the bishops. |
| The processing is necessary to achieve the defined benefit. | Yes. It would not be possible to complete this defined purpose without creating temporary lists. |
| The purpose is balanced against, and does not override, your the interests, rights and freedoms. | The processing does legitimately override the subjects rights and freedoms, however without this it would not be possible to make appropriate invitations or contact which may well be of benefit to the data subject. There is a procedure in place to ensure that only up to date contact information is kept for an appropriate length of time. |
Parish files
| I have a specific purpose with a defined benefit | To ensure completion of regulatory responsibilities connected to parishes and also pastoral care of parishes. |
| The processing is necessary to achieve the defined benefit. | Without processing of data it would not be possible to fulfil the defined purpose |
| The purpose is balanced against, and does not override, the interests, rights and freedoms of data subjects. | Any personal data is held securely and procedures limit access appropriately. |
Churchwarden’s contact details
| I have a specific purpose with a defined benefit | Maintenance of an accurate list of current churchwardens contact details, and those to be admitted to the office. |
| The processing is necessary to achieve the defined benefit. | Without processing it would not be possible for the Archdeacon to comply with his duties. |
| The purpose is balanced against, and does not override, the interests, rights and freedoms of data subjects. | The rights and freedoms of the churchwardens are legitimately overridden. Without such records it would not be possible to support the churchwardens in their role. |
General correspondence
| I have a specific purpose with a defined benefit | Processing general correspondence received in the office |
| The processing is necessary to achieve the defined benefit. | It is not possible to respond appropriately to correspondence without this processing |
| The purpose is balanced against, and does not override, the interests, rights and freedoms of data subjects. | The interests, rights and freedoms of the data subjects are not overridden as it is reasonable to assume that correspondence sent to and responded to by an office will be kept for an appropriate amount of time. |
Lay and Ecumenical Canons
| We have a specific purpose with a defined benefit | To allow the bishop to retain appropriate records of those who are bestowed the title of lay or ecumenical canon |
| The processing is necessary to achieve the defined benefit. | It is not possible to achieve the defined benefit without the processing of the information. |
| The purpose is balanced against, and does not override, the interests, rights and freedoms of data subjects. | It is necessary to process this information to maintain accurate records. |