Privacy Information Notice
Privacy Information Notice
May 2018
1. For the purpose of this document the term products and services refers to the
products and services provided by Her Majesty’s Passport Office and the General
Register Office for England and Wales. For more information see Introduction.
2. HM Passport Office will retain and record information from your application
electronically when you make an application for a passport or use civil registration
services online or using our paper forms. Your information may be used to check
HM Passport Office systems and services work securely and effectively. For more
information see How we use the personal information you provide us.
4. HM Passport Office will pass information about your application or related records
to business partners and organisations in the UK and abroad when you use your
passport, obtain a service or when it is in the public interest to do so. For more
information on Data Processors see who has access to my personal information?
6. HM Passport Office may pass your data outside of the United Kingdom to business
partners. For more information see Information transferred outside of the United
Kingdom.
8. HM Passport Office will ensure that the information you supply to HM Passport
Office is accurately recorded on its records. You will have the right to see the
information that HM Passport Office holds about you. For more information see
Exercising your right to know what personal information we hold about you.
9. HM Passport Office will retain your personal information only for as long as is
necessary. For more information see Where is my personal data held and for how
long?
10. HM Passport Office may restrict the information it provides to you following requests
for information we hold about you for the purposes of law enforcement. For more
information see Law Enforcement Processing.
11. For more information on how to request information or register a complaint see
Other sources of advice and assistance or visit: HMPO Complaints Procedure.
12. If you deliberately give untrue or misleading information, HM Passport Office may
share information with the police in the UK or abroad and you could be prosecuted.
Privacy Information Notice
Contents
Introduction 5
Who is responsible for our services 5
Our commitment to you 5
How we use the personal information you provide us 6
Information from third parties. 7
Who has access to my personal information? 8
How is my information shared 9
What personal information is held on my passport? 10
What information is shown on a birth, death or marriage/ civil partnership certificate and
adoption? 11
Where is my personal data held and for how long? 12
Your rights in relation to the processing of your personal data 13
Rectification and Erasure of Data and Restriction of Processing. 13
Exercising your right to know what personal information we hold about you. 14
Exemptions to the right to subject access 15
Restrictions 15
Other sources of advice and assistance 16
Annex A. 17
Privacy Information Notice
Introduction
This policy explains your rights as an individual when using services provided by Her
Majesty’s Passport Office.
The Director General of HM Passport Office, Mark Thomson, who is also the Registrar
General for England and Wales, is responsible for issuing passports on behalf of the
Home Secretary under the powers of the Royal Prerogative.
The Registrar General is responsible for the registration of life events such births, deaths,
marriages and civil partnerships in accordance with the law 1. The service is delivered
locally by registration officers and local authorities in England and Wales.
The Home Office at 2 Marsham Street, Westminster, London SW1P 4DF is the data
controller for Passport Data. The Registrar General is a data controller for civil registration
data who can be contacted at General Register Office, Trafalgar Road, Southport, PR8
2HH. The Superintendent Registrar is also a data controller for birth, death and marriage
registrations and the local authority is a data controller for civil partnership registrations
held locally.
The Data Protection Officer, James Alexander, can be contacted at Office of the DPO,
Peel Building, 2 Marsham Street, London SW1P 4DF or Email:
dpo@homeoffice.gsi.gov.uk
Transparency: We will provide clear and accessible information about how and why we
gather, use, retain and share personal information as well as making customers aware of
how to exercise their rights to access or amend their information.
Trusted and Secure: We will ensure the security and accuracy of personal information,
protecting it from loss or unauthorised disclosure. We will ensure that we manage this
effectively, regularly monitoring and improving how our processes work.
. 1 The main legislation governing civil registration is the Births and Deaths Registration Act 1953, the
Marriage Act 1949 and the Civil Partnership Act 2004
Benefits to the Citizen: We will ensure that our management of personal information
delivers benefits to the law-abiding citizen, either as an individual (e.g. by helping people
travel abroad or access a service) or as a member of society (e.g. by helping protect the
public). We will only share personal information with others when Ministers have agreed
that such benefits exist in those circumstances, or where there is provision in law to
provide access to information.
Proportionality: We will only gather personal information that is needed for carrying out
our duties. We will not keep it for any longer than is necessary, ensuring that it is only seen
by those who need it to do their jobs. We will only share information with others where the
law allows this and we will provide the minimum amount of information needed to achieve
the benefit.
Value for Money: We will ensure that we manage our data in a cost effective way so to
ensure we deliver value for money to those who pay fees for our services.
Information will be recorded as part of dealing with any applications or queries you make –
for example, case notes on how we make a decision on your passport application or
whether to correct a civil registration record, or audio recordings of a call made to our call
centre.
When using our online services, this sometimes involves placing small amounts of
information on your device, for example, computer or mobile phone. These include small
files known as cookies. They cannot be used to identify you personally. Our cookies policy
provides more information:
https://www.gov.uk/help/cookies
In addition, we may sometimes use the personal information we hold about you for a
number of other purposes:
Customer Research: You may be contacted about the services we offer and to
get your opinion about how such services should be run in the future. Please see
“Exercising other important rights about your personal information” below for
information.
Training and Assurance: We may use your personal information when training our
staff – primarily when training those conducting interviews or dealing with
customers over the telephone. We will also review your personal information as a
necessary part of conducting audits to ensure that our staff are carrying out their
duties effectively and in accordance with the law.
Testing our systems: We prefer to use “dummy” or anonymised data for testing
our IT systems but exceptionally, we may need to use some of your personal
information to assist in testing our systems effectively where no other reasonable
alternative exists. In such circumstances, we ensure that the security and integrity
of your data is never put at risk.
Statistical analysis: In order to review the effectiveness of our services, we will
collate information to measure and judge our performance. Wherever possible, we
will use anonymised data to achieve this but some of your personal information may
be involved in conducting such analysis where no reasonable alternative exists.
As part of our Operational processes your personal information will only be available to
those who have a need to see it in order to carry out their duties. We have put in place a
range of policies, processes, and system controls in order to enforce this principle. Staff
who have access to personal information must obtain security clearance and their activity
is subject to random audit and review.
Sopra Steria: Opening passport applications received in the post and recording
their contents onto our passport application processing system; processing reports
of passports which have been reported as lost or stolen, and writing to you if we
need some additional information to support your application
DXC: Developing and supporting our online application channel, passport
application processing system, passport records database and supporting IT
systems.
De La Rue: Printing passports where an application has been approved by HM
Passport Office.
DX Secure: Delivering passports and returning supporting documents in the UK.
DHL: Delivering passports and returning supporting document to customers outside
of the UK.
Credit reference agencies: Assisting with statistical analysis.
VFS Global and TLScontact: provide passport application submission services,
interview facilitation, DNA facilitation, and passport and document collection
services overseas.
The Foreign and Commonwealth Office and FCO Services: Receive and
facilitate processing of some British passport applications made overseas on our
behalf.
Home Office Digital Data and Technology: Host and maintain the computer
systems used for the registration of births, deaths, marriages and civil partnerships
and for online certificate ordering.
Post Office Ltd: Providing the Check & Send service which helps customers
submit applications to HM Passport Office.
Teleperformance: Answering initial customer enquiries at our contact centre for the
Passport Advice line in the UK and sending letters to invite some applicants to an
interview
Church of England and other denominations relating to marriage ceremonies
held in their buildings.
Kainos, Equal Experts and Interact Consulting assist with software and
programme development of HM Passport Office systems.
HM Passport Office does not share data unless it is lawful, proportionate and relevant to
do so.
A copy of any register entry will be provided by the Registrar General in accordance with
the law to any applicant, provided they supply enough information to identify the entry
concerned and pay the appropriate fee. The copy may only be issued in the form of a
paper certified copy (a “certificate”). An application for a certificate may also be made to
the local office where the event was registered.
A central index of registration events is publicly available in order to help members of the
public identify the registration record they might need. Information about the indexes can
be found at Research your family history using the General Register Office.
A full list of the Registrar General’s data sharing arrangements can be found at Annex A
Passport validation service (PVS) to support the business community and government
departments in preventing fraud and crime.
This includes:
Law enforcement agencies to help prevent and detect crime
For employment purposes in order to check the immigration status of potential
employees
Facilitate passport and consular services overseas, and
Financial services to prevent or detect fraud.
Other government agencies to help fulfill their aims and objectives.
The PVS service may confirm if a passport is valid based on information provided by a
PVS customer but will not disclose your personal information. Law enforcement
organisations, other government departments and financial bodies may access the Data
Verification Application (DVA) system records directly, and may therefore have access to
personal data. Data sharing will only take place where there is a statutory power in place
that permits the data sharing to occur.
Life Events Verification (LEV) is a service that currently provides for the electronic
verification of birth registration data to government departments. LEV will enable
government departments, including HMRC, UKVI, to verify births registered in England
and Wales after 2009 instead of checking a paper birth certificate.
HM Passport Office may share information with overseas law enforcement agencies such
as Europol or Immigration Enforcement Investigation for the purpose of preventing,
investigating and prosecuting crime and fraud overseas.
VFS Global and TLScontact, The Foreign and Commonwealth Office and FCO Services
receive and facilitate the processing of some British passport applications made overseas
on our behalf.
HM Passport Office may contact applicants and counter signatories from outside of the
United Kingdom, directly by email, text, phone or post. HM Passport Office cannot assure
the integrity of communications or IT systems which do not form part of HM Passport
Office services or those of its business partners.
Your personal information, digitised image and signature are all located on the personal
details page of the passport. The page is in two parts. The upper part is for visual
inspection, while the lower part consists of two lines of print which can be read by special
passport-reading equipment at immigration controls – it contains no additional information
compared to what is listed on the page already. It simply repeats this information in a way
that can be easily read by such equipment.
In 2006, HM Passport Office introduced the e-passports, which include a chip. The chip
stores your digitised image and the personal information printed on the personal details
page of your passport and so there is no personal information held on the chip that you
cannot see already.
Once information has been placed on the chip, it cannot be amended. When the chip is
being read by passport reading equipment, the information on the chip is protected against
third parties reading the information from a distance (known as “eavesdropping” or
“skimming”) by an advanced digital encryption technique.
What information is shown on a birth, death or marriage/ civil
partnership certificate and adoption?
The format of birth, marriage and death certificates has varied over the years and the
content may differ depending on when the event was registered, but generally speaking
will include the following information:
Birth:
Registration district and sub district of birth
Entry number, date and place of birth
Name and surname
Gender
Name, surname and occupation of father (if recorded)
Name, surname and occupation of mother
Usual address
Name, surname and usual address of the informant (if not the mother or father)
Date of registration
Name of registrar
Death:
Registration district and sub district of death
Entry number
Gender, date and place of death
Name, surname, maiden name (if applicable)
Occupation and usual address of the deceased
Date and place of birth of the deceased
Name, surname and usual address of the informant
Cause of death
Date of registration
Name of the registrar
Marriage:
District of marriage
Place of marriage
Entry number
Date of marriage
Name and surname of parties to the marriage
Age, condition, rank or profession
Residence at the time of the marriage
Name, surname and rank or profession of each party’s father
Signatures of both parties and their witnesses
Name of the person(s) who conducted, and registered the marriage
Adoption:
Entry number
Date of birth
Registration district and sub district of birth, or place and country of birth (if born abroad)
Name and surname
Gender
Name and surname, address and occupation of the parent(s) of the adopted child
Date of adoption order or date on which the adoption was effected
Description of court by whom effected
Date of entry
Signature of officer deputed by Registrar General to attest the entry
Civil Partnership:
Registration Authority where the civil partnership was registered
Date and place of civil partnership registration
Name and surname of civil partners
Date of birth, gender, condition and occupation of the civil partners
Residence at the time of the civil partnership registration
Father’s name, surname and occupation of each civil partner
Mother’s name, surname and occupation of each civil partner
Signatures of civil partners
Name and surname of witnesses
Signature of civil partnership registrar
Where you have applied for a passport overseas, records of your application are held
securely overseas at consular posts by our partner VFS Global and TLScontact or the
Foreign and Commonwealth Office. In some circumstances, our market research partners
may store information securely overseas when they are collecting information from
participants. We tell participants when this is the case at the point of collection.
Where you have applied for a passport or a certificate, the information gathered will be
destroyed at different times based on the information in question and how long it is
necessary to keep it. For example: Personal information obtained from other organisations
in order to verify information on a passport application or to support an interview will be
deleted 28 days after a passport has been issued. Such information may be retained for
longer where the application was refused or it is required for the purpose of the prevention
or detection of crime.
Information about passport deliveries are ordinarily retained for three months for UK
deliveries and six months for overseas deliveries in order to address any subsequent
queries from customers and to retain evidence of delivery or attempted delivery. Such
information may be retained for longer where it is required for the purpose of the
prevention or detection of crime.
We keep records of civil registration events indefinitely as a record to which the public has
access. In addition, records of what passports have been issued and the key information
included on such passports are kept for 80 years.
We keep our retention periods under review and will update this section should we make
changes.
For more information see What to keep: Home Office guide to managing information.
The personal data collected from applications is used to administer existing services, such
as confirming the validity of passports or protecting individuals against fraudulent
applications submitted in their identity. The erasure or restricted processing of data
collected would have a disproportionate impact upon the ability of HM Passport Office to
carry out its core functions. Requests for restrictions of processing will be restricted to
requests to be excluded from market research.
If you do not wish to be contacted for market research purposes you can contact
customerinsight@hmpo.gsi.gov.uk asking to be opted out of market research. In your email
you should provide providing the following information:
Title
Full Name
Address
Date of Birth
Email address
Exercising your right to know what personal information we hold about
you.
You have the right to be told if HM Passport Office holds any personal information about
you and if so to be given a copy. The personal information must be provided to you in a
clear form. These are sometimes known as “subject access” rights.
The General Data Protection Regulation also gives you other rights about how your
personal information is handled. An individual has the right to:
Ensure that the personal data held by HM Passport Office about them is accurate
Be assured that their data is never used for the purpose of direct marketing
Object and state if they do not wish to have a decision which would have a
significant effect on them taken by automatic means.
Making a request
If you would like to apply for a copy of your personal information, you should:
Make a request in writing using the details below
Provide us with information to help find your records. At a minimum, this should include:
Your name
Your date of birth
Your address
Any previous name you were known by
If applicable, your UK passport number, (if you have lost your passport, please try to
provide us with an approximate date and place of issue).
Provide us with a means of verifying your identity. The best way of doing this is to provide
a copy of the personal details page of your passport. If you do not have a passport, we will
accept a photocopy of your photo card driving licence or another form of official photo ID.
Where your request applies solely to information about you contained as part of a civil
registration record, such as your birth registration, you should make an application for a
copy of the certificate by applying online through the GOV.UK website:
https://www.gov.uk/order-copy-birth-death-marriage-certificate
Or by contacting your local Registration office at your local authority.
We have developed a subject access request form for you to use. You do not have to use
it in order to make a subject access request. However, it is a useful guide to help you
provide all the information we need in order to deal with your application as quickly and
smoothly as possible. Download the Subject access request form here.
We will be happy to help you complete the request. The Citizens Advice Bureau may also
be able to help.
Prejudice the prevention or detection of crime (see Law Enforcement Processing below)
Disclose personal information about another person
Disclose adoption records for those not yet 18 years old
Disclose information which relates to a person who has made an application under the
Gender Recognition Act.
When we use an exemption set out in legislation, we will let you know about this in our
response to your request. Consideration will be carried out in accordance with the Guides
to Information provided by the Information Commissioner’s Office.
When the Home Office is carrying out law enforcement processing, it may not always be
appropriate to provide this information at the point of data collection, or directly to a data
subject. This is because it could potentially undermine the law enforcement purpose for
which the data is being processed. Further information see Home Office personal
information charter.
Restrictions
HM Passport Office may restrict your right to information if doing so would be a necessary
and proportionate measure to:
a) avoid obstructing an official or legal inquiry, investigation or procedure;
b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal
offences or the execution of criminal penalties;
c) protect public security;
d) protect national security; or
e) protect the rights and freedoms of others.
In such circumstances HM Passport Office will notify you in writing of the following:
what information has not been provided, and the reasons for this;
your rights of complaint to the Information Commissioner, and to apply to a court.
This requirement to provide information about the exercise of the restriction does not apply
if the Home Office decides this would undermine the purpose of applying the restriction.
Other sources of advice and assistance
You also have the right to complain to the Information Commissioner’s Office about the
way we are handling your personal information.
Further information and advice can be obtained from the Information Commissioner and
the Citizens Advice Bureau, whose contact details are as follows:
The Office of the Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: ICO.org.uk
Adoption court To compile Entry number, date and Yes S77 Adoption and 6 (c) legal obligation
orders from and maintain a place of birth Children Act 2002
relevant courts central record The rights to object to
Name and surname
in England and of adoptions processing of
Wales and some Sex personal data or have
overseas Name, surname personal data erased
adoptions address and do not apply
occupation of parents
Date of adoption and
name of court
Date of entry
Officer who attested the
entry
2. Sharing of registration information