Privacy notice

Your local Electoral Registration Office (ERO) is the Data Controller for the service Apply for a postal vote locally and the Secretary of State for Levelling Up, Housing and Communities is Data Controller for the Apply for a postal vote service and the identity check.

The purpose of this privacy notice is to tell you how DLUHC will process your personal data provided as part of the service Apply for a postal vote.

DLUHC are only allowed to use, gather, and share personal information where we have an appropriate legal basis to do so. We only collect and process personal information to fulfil our legal and official functions. We will only use personal information when the law allows us to and where it is necessary and proportionate to do so.

What personal data DLUHC are collecting and why

We will collect the following personal data about you as these are needed to apply online for a postal vote:

  • your full name
  • date of birth
  • address (including previous addresses and alternative forwarding address for ballot paper)
  • overseas address where relevant,
  • your National Insurance number
  • a digital image of your signature
  • any documents provided in support of your application
  • if you have chosen to provide them, your email address and telephone number

If we cannot verify your identity, we will ask you for further information — which may include other sensitive information about yourself. If we need to do this, we’ll explain clearly to you what we require.

If you agree to our use of “cookies” (see below) on the website we use, we will also collect information about your website activity (e.g., number of visits, time spent on pages).

How we use your personal data

We will use your data to process your postal vote application. This will require us to share your data with certain partners and service providers, which we explain below.

The application process requires us to check that you are genuinely the person making the application for yourself, and not someone else. We therefore use some of the personal data provided in your application to check.

If you cannot provide a National Insurance number when applying for a postal vote, we’ll need to check your identity another way and will need to collect some additional personal data from you. We’ll explain this clearly to you if that happens.

We also check your application information against data held on the Electoral Register to verify whether you are eligible to apply for an absent vote arrangement.

With whom we will be sharing the data

Your local ERO will share your personal data with the Department for Levelling Up, Housing and Communities (DLUHC) — and their IT service providers who are providing the IT systems we use to process online postal vote applications.

Where we share your data with DLUHC, the ERO will ensure that the processing of your personal data remains in strict accordance with the requirements of data protection laws, and we will update this privacy notice to reflect any change to those arrangements.

We will also share your National Insurance Number, name (and previous name where provided), date of birth and address (and previous address where provided) is with the DWP they will check this information against their own records, as part of checking your identity.

How long we will keep your personal data

We will retain your data in accordance with our legal obligations, which means your data can be held while your application is being determined and then deleted.

Your rights

Under the UK General Data Protection Regulation (UK GDPR) you have rights as to how your personal can be used. These are explained here:

  • You have the right to request information about how your personal data are processed, and to request a copy of that personal data.
  • You have the right to request that any inaccuracies in your personal data are rectified without delay.
  • You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.
  • You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.
  • You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
  • You have the right to object to the processing of your personal data.

If you wish to exercise any of these rights – for example, request personal data that we hold about you – please contact us at the details provided below.

In relation to data collected by website cookies: You have the right to withdraw your consent by using the “cookie banner” that will appear when using our website for the first time.

Lawful basis for processing the data

We are using the following lawful basis under UK GDPR to process personal data:

  • Article 6(1)(e) of the UK GDPR – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority
  • Article 6(1)(c) basis of processing that is “necessary for compliance with a legal obligation to which the controller is subject”.

We may also process “special categories” of personal data which may include information about your health or other details about yourself. Where we do so our lawful basis is

  • Article 9(2)(g) of the UK GDPR – processing is necessary for reasons of substantial public interest.

If you consent to your data being collected by website cookies, our lawful basis for processing this data is:

  • Article 6(1)(a) of the UK GDPR — the data subject has given consent to the processing of his or her personal data for one or more specific purposes.

Is any personal data sent overseas?

We will not be sending your personal data outside of the UK.

Automated decision making and profiling

No decision will be made about you solely based on automated decision making (that’s where a decision is taken about you using an electronic system without human involvement), and which has a significant impact on you.

Storage, security, and data management

Your ERO has a duty to safeguard and ensure the security of your personal data where we process this. We do that by having systems and policies in place to limit access to your information and prevent unauthorised disclosure, accidental loss, or alteration of your data. We also have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Contact details and more information

The data controller for personal data used to apply for a postal vote is your local ERO.

To contact your ERO’s Data Protection Officer, contact your local Electoral Registration Office.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
casework@ico.org.uk
0303 123 1113

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.