House of Commons and Sole Traders Privacy Notice

About the House of Commons

The Corporate Officer (Clerk of the House) is the Controller of any personal data processed as described in this Privacy Notice. The Data Protection Officer is the Head of Information Compliance.

If you have any questions about the use of your personal data, please contact us:

• Email - hcinformationcompliance@parliament.uk
• Telephone – 0207 219 4296
• Post – Information Compliance Service, House of Commons, SW1A 0AA

The personal data we collect, the purpose and lawful basis for processing

This notice relates to the personal data which has been shared by you with the House of Commons in your capacity as a sole trader. For example, your name, address and bank account details.

Data Analytics

From time to time, we also run a data analytics exercise using your personal data for internal assurance and counter fraud purposes.

The data analytics exercise involves examining large volumes of raw data, using speciality software, identifying issues of data quality, exceptions or analysis, one element of which can be data matching, which may warrant further investigation, as well as assurance. Our internal audit team will review any data inconsistencies or anomalies flagged as part of the data analytics exercise.

The processing in the data analytics exercise is carried out in accordance with Article 6 (1) (e) of the UK GDPR (performance of a task carried out in the public interest) for the purposes of prevention and detection of fraud.

National Fraud Initiative

We also participate in the National Fraud Initiative (NFI) which assists in the prevention and detection of fraud. The NFI is a data matching exercise that compares information held by, and between, around 1,300 public sector organisations to help identify potentially fraudulent claims, errors and over-payments.

Data matching involves comparing sets of data held by one organisation with records held by the same or another organisation to see how far they match. This includes personal data about sole traders.

Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it indicates that there is an inconsistency that requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

A full data specification for the NFI is available on the Cabinet office website.

It is expected that data matching will be carried out between October and January on a bi-annual basis with the investigation of anomalies from the end of January. Data going back 3 years will be used.

The data processing involved in sharing personal data with the Cabinet Office for the NFI is done under the lawful basis found at Article 6 (1) (e) of the UK GDPR (performance of a task carried out in the public interest) for the purposes of prevention and detection of fraud.

Further detail about the lawful bases for processing personal data can be found on the Information Commissioner’s website.

Who we share your personal data with

When we run a data analytic exercise we share your personal data with a specialist external provider of audit services. The external provider is engaged by us as a data processor and we have a UK GDPR compliant contract with them.  This provides assurance that they have appropriate security controls in place and will protect your personal data.

In order to participate in the NFI, we share your personal data with the Cabinet Office as described above. The Cabinet Office runs a data matching exercise on the personal data in order to prevent and detect fraud. The Cabinet Office will share with us any data inconsistencies.

You may also wish to refer to the Code of Data Matching Practice on the Cabinet Office website where you can also find out more information on the National Fraud Initiative in general.

Storage and retention of your personal data

The House of Commons will retain your personal data for as long as is necessary for the purpose it was collected, i.e. for the duration of your contract or trading relationship with us, or longer where it is lawful to do so. Periodically when an account has been inactive for over two years the data is deleted.

Where we share your data with the external provider of audit services, we will ensure that they are required to provide appropriate technical and organisational measures to protect the security of your personal data (in storage, use and transfer), that appropriate retention periods are in place and that they are under a duty of confidentiality. This will be defined in any contract we have with the data processor.

The Cabinet Office will retain your data for four years.

The House of Commons will retain your personal data for as long as is necessary for the purpose it was collected. Retention periods can be found in the Houses of Parliament Authorised Retention and Disposal Policy (ARDP).

Disclosure and security of your personal data

We take the security of your data seriously. All personal data you provide to us will be stored securely, both physically and electronically, in accordance with our policies. We have an information security process in place to oversee the effective and secure processing of your personal data.

For National Fraud Initiative – personal data will be securely transmitted to the NFI under data handling protocols specified by the NFI team and agreed with our Senior Information Risk Owner or their representatives.

For data analytics - personal data will be securely transmitted to the specialist external provider of audit services under data handling protocols agreed with our Senior Information Risk Owner or their representatives.

Some personal data controlled by us are held outside the UK. These data are predominantly held in data centres within the European Economic Area (EEA), for the purpose of hosting and maintenance. Regulations under section 17A of the DPA 2018 specify that all countries within the EEA are regarded as providing an adequate level of data protection. If personal data are transferred to a country outside the UK or EEA, the adequacy of that country and the organisations and systems processing the data is assessed to ensure that appropriate safeguards are in place

Your rights

You can exercise your rights in relation to the personal data we hold by contacting the Information Compliance Service. These rights include (subject to limited exemptions):

• the right of access
• the right to request rectification  
• the right to request erasure 
• the right to restrict the processing
• the right to object to the processing 
• the right of data portability

Right to complain

If you are unhappy with the use of your personal data by the House of Commons Administration, you should contact the Data Protection Officer in the first instance.  You also have the right to complain to the supervisory authority if you consider that the Administration is in breach of your data protection rights. The supervisory authority is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Further details about your rights and the complaints process can be found on the Information Commissioner’s website.