Menu
UK Parliament

Independent Complaints and Grievance Scheme Privacy Notice

This notice gives the information required by the United Kingdom General Data Protection Regulation ('UK GDPR') about personal data we process for the purposes of the Independent Complaints and Grievance Scheme ('the Scheme').

When a complaint is made under the Scheme, we process the personal data of the person who makes the complaint, the person against whom the complaint is made and witnesses.

References in this notice: to 'we', 'our' or 'us' are to the Corporate Officer of the House of Commons and the Corporate Officer of the House of Lords. 'You' or 'your' are to an individual whose personal data we process in dealing with a complaint made under the Scheme.

Everything that we do with your data, for example, collecting, storing, using, sharing or deleting it is referred to as 'processing'.

This notice will be updated periodically. We will communicate any significant changes as appropriate. 

About us

The Corporate Officer of the House of Commons and the Corporate Officer of the House of Lords are Joint Controllers of any personal data processed as described in this Privacy Notice.

The House of Commons Data Protection Officer is the Head of Information Compliance. Their contact details are:

The House of Lords Data Protection Officer is the Head of Information Compliance. Their contact details are:

The personal data we process

We will process personal data about you, in relation to a complaint made under the Scheme, which is provided to us:

  • directly by you or another person
  • by the ICGS helpline or
  • by an independent investigator (including, in particular, the initial assessment and the final report and evidence bundle)

The personal data we process may include:

  • your name and contact details (such as email address and telephone number)
  • details of the complaint under the Scheme made by you or about you by another person
  • information provided by a witness
  • information about your relationship with either the House of Commons or the House of Lords
  • information about your involvement in any previous investigation

Our lawful bases for processing your data

The lawful bases for processing your personal data will depend on the specific reason we have collected it. These include:

  • UK GDPR Article 6(1)(a) we have your consent
  • UK GDPR Article 6(1)(e) the processing is necessary for the performance of a public task, namely the exercise of a function of either House of Parliament (see section 8 of the Data Protection Act 2018), or where the processing is in the public interest
  • UK GDPR Article 6(1)(f) the processing is necessary for the purposes of our legitimate interests or those of a third party when fairly balanced against your interests and rights.

The relevant legitimate interests for the purposes of Article 6(1)(f) include:

  • our legitimate interest of ensuring that complaints made under the Scheme are fairly and robustly investigated and (if upheld) appropriate sanctions are imposed, with a view to upholding the principles set out in the Parliamentary Behaviour Code
  • our legitimate interest of dealing with a legal claim

Special category personal data

A further lawful basis is required when processing special categories of personal data which include racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetic and biometric data, health data, sex life or sexual orientation.

The legal bases we rely on for processing this type of data are:

  • UK GDPR Article 9(2)(a) where we have your explicit consent to do so
  • UK GDPR Article 9(2)(f) the processing is necessary to deal with any legal claims
  • UK GDPR Article 9(2)(g) the processing is necessary for reasons of substantial public interest, namely
    • the exercise of a function of either House of Parliament (see paragraph 7 of Schedule 1 to the Data Protection Act 2018) or
    • to protect you or another person from physical, mental or emotional harm (see paragraph 18 of Schedule 1 to the Data Protection Act 2018)

Read our policies regarding the processing of special category data:

Who we share your personal data with

We may share your personal data with:

  • the independent investigator appointed to investigate the complaint
  • the appropriate decision-making body (the decision-making body (DMB) for staff of the Commons, Lords or Parliamentary Digital Service will be the relevant HR department; for MPs, the DMB is the Parliamentary Commissioner for Standards and potentially the Independent Expert Panel; for MPs’ staff, the DMB is their employing MP; for members of the Lords and their staff, the DMB is the Lords Commissioner for Standards)
  • persons who can take appropriate steps to protect you or another person from harm

Note that investigations under the Scheme are carried out by external independent investigators under contracts with the Corporate Officer of the House of Commons and the Corporate Officer of the House of Lords. The investigators, or the company that engages them, are controllers in their own right for the personal data they process. They have their own privacy notices which they will provide to you.

Storage and retention of your personal data

We take the security of your data seriously. All personal data you provide to us (whether electronically or in paper form) will be stored securely in accordance with our policies. We have an information security process in place to oversee the effective and secure processing of your personal data.

Some personal data controlled by us is held outside the UK, including on data servers in the European Economic Area (EEA). Under the Data Protection Act 2018, all countries within the EEA are regarded as providing an adequate level of data protection. We would not transfer personal data to a person in a country outside the UK or EEA unless satisfied that that person and country had safeguards in place to protect personal data. 

The Controllers will retain your personal data for as long as is necessary for the purpose it was collected. Retention periods can be found in the Parliamentary Authorised Records Disposal Practice.

Your rights

Under the UK GDPR you have the right to:

  • access your personal data
  • request rectification of your personal data
  • request erasure of your personal data
  • restrict the processing of your personal data
  • object to the processing of your personal data
  • portability of your personal data

This is subject to the exceptions specified in the UK GDPR and Data Protection Act 2018. Note in particular:

  • paragraph 7 of Schedule 2 to the 2018 Act which provides that the rights do not apply where this would be likely to prejudice the proper discharge of our public function of protecting members of the public against seriously improper conduct
  • paragraph 13 of Schedule 2 to the 2018 Act which provides that the rights do not apply where required for the purpose of avoiding an infringement of the privileges of either the House of Commons or House of Lords

Where we are relying on your consent to use your personal data, you can withdraw that consent at any time by contacting the relevant Data Protection Officer. However, we may take the decision to continue processing your data, even following a request by you to stop, if we consider it necessary for the purposes of our legitimate interests or those of a third party when balanced against your interests and rights. In these circumstances you will be advised of the decision and the reason for it.

If you have any concerns relating to the use of your personal data you may complain to the relevant Data Protection Officer.

You also have the right to complain to the Information Commissioner as the supervisory authority, about our collection and use of your personal data. They can be contacted at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Further details about your rights can be found on the Information Commissioner’s website.