Privacy
Fair Processing Notice
The Economic and Financial Crime Bureau (EFCB) falls under the management of the Committee for Home Affairs. This privacy notice is intended to make it easier for you to understand what personal data we will process, how and why.
Our main role is to investigate serious and complex frauds, money laundering, terrorist financing and recovery of the proceeds of crime.
The Director of EFCB is the ‘Data Controller’ and is required to ensure that EFCB handles all personal information in accordance with the legislation. EFCB is registered with the Office of the Data Protection Authority.
In accordance with the requirements of the legislation, a Data Protection Officer has been appointed for EFCB. The Data Protection Officer is an independent officer who is responsible for ensuring that the personal information held is processed in accordance with the prescribed obligations of the legislation.
The Data Protection Officer is available to provide you with advice and assistance if you have any queries or concerns about how EFCB process your personal data. The contact details of the Data Protection Officer can be found near the end of this notice.
The Data Protection Law
The controller acknowledges its obligations as per the data protection law, which provides a number of requirements in terms of processing activities involving personal data. The controller further acknowledges the general principles of processing as well as the rights of a data subject and more information in relation to these provisions are provided within this fair processing notice.
Where EFCB processes your personal data for law enforcement purposes we must comply with The Data Protection (Law Enforcement and Related Matters) (Bailiwick of Guernsey) Ordinance, 2018 (here after called the LEO).
Where EFCB processes your personal data for general purposes we must comply with The Data Protection (Bailiwick of Guernsey) Law, 2017 (here after called the Law).
Although the rules for both purposes are similar, they are not identical – for example, your rights may be applied differently when EFCB process your personal data for law enforcement purposes than when processed under general purposes (the Law).
Law enforcement purposes include:
The prevention, investigation, detection or prosecution of criminal offences within or outside the bailiwick;
The execution of criminal penalties, including the safeguarding against and the prevention of threats to public security or the security of the British Isles; and
Exercising or performing any power or duty conferred or imposed on a public authority by a criminal proceeds enactment
When EFCB processes your personal data for Law Enforcement Purposes it could be because you are involved in an incident that has been reported to EFCB – perhaps as a witness, victim or suspect. It could be because you are involved in a crime that is being investigated or are associated with intelligence that law enforcement have gathered.
General purposes include:
Child and adult safeguarding
Management of public relations, journalism, advertising and media
Internal review processes
Insurance management
Management of complaints
Vetting
Management of information technology systems
Legal services
Information provision (e.g. crime prevention advice)
Research including surveys
Performance management
Procurement
Events Planning
Administration of data protection rights applications
The Principles of Processing
Lawfulness, fairness and transparency
Under the Law, personal data must be processed lawfully, fairly and in a transparent manner. Under the LEO the processing of personal data for any law enforcement purpose must also be lawful and fair though transparency requirements may be applied differently due to the potential to prejudice an ongoing investigation in certain circumstances.
What type of personal information?
The type of personal information we hold will vary depending upon the reason you have had contact with us but it may include:
Your name and address; date of birth; contact details (e.g. telephone number, email address); phone and electronic device download data; risk assessment; fingerprints, DNA or photograph; family, lifestyle and social circumstances; education and training details; employment details; financial details; goods or services provided; physical identifiers; audio recordings and visual images; licenses or permits held; references to manual records or files; information relating to safety and health; complaint, incident, civil litigation and accident details. This is not an exhaustive list but gives an example of the most common types.
We will use the minimum amount of personal information necessary to fulfil a particular purpose. Your personal information may be held on a computer system, in a paper record such as in a pocket notebook, physical file or a photograph, but it can also include other types of electronically held information such as CCTV or body worn video.
‘Special Category Data’ is personal data that is regarded as particularly sensitive and includes information relating to:
Race
Ethnic origin
Political opinions
Religious/philosophical beliefs
Trade union membership
Genetic data
Biometric data
Health
Sex life and/or Sexual orientation
Criminal
As noted in this section some of the information that we hold about you may be special category data and this will depend upon the reason you have had contact with us.
Lawful Basis
When processing your information for a law enforcement purpose we do so lawfully either because it is necessary for the law enforcement purpose or because we are required to do so by law. Where we process your more private, special category data, we do so because it is strictly necessary, appropriate safeguards are in place and one of the following conditions under schedule 2 of the LEO applies:
The processing is necessary for the controller to exercise any right or power, or perform or comply with any duty, conferred or imposed on the controller by an enactment or otherwise by law.
The processing is necessary in order to comply with an order or a judgment of a court or tribunal having the force of law in the Bailiwick.
The processing is necessary, for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), or the discharge of any functions of a court or tribunal acting in its judicial capacity.
The processing is necessary for the purpose of obtaining legal advice or otherwise for the purpose of establishing, exercising or defending legal rights.
The processing is necessary for the administration of justice, or the exercise of any function of the Crown, a Law Officer of the Crown, the States or a public committee.
The processing is necessary for a historical or scientific purpose.
The processing is authorised by regulations made by the Committee for this purpose and carried out in accordance with those regulations or
The processing is authorised or required by any other enactment and carried out in accordance with the enactment.
The data subject has provided their consent to the processing for the given purpose.
The processing is necessary to protect the vital interests of the data subject or any other individual and the data subject is physically or legally incapable of giving consent or the EFCB cannot reasonably be expected to obtain the consent of the data subject.
The processing is necessary for the purposes of preventing fraud or a particular kind of fraud and consists of the disclosure of personal data by EFCB as a member of an anti-fraud organisation.
The disclosure of personal data by EFCB is in accordance with arrangements made by an anti-fraud organisation.
Personal data and special category data used for a law enforcement purpose is collected directly from you and from a variety of sources. Where appropriate, you will be aware that the processing is taking place. The only circumstances in which you will not be made aware are those where to advise you would prejudice the law enforcement purpose for which the data is being gathered. Data may be collected from other authorities both locally and in the UK, and occasionally from overseas authorities. Members of the public may also provide information for this purpose.
Data that is processed for all other purposes that are not a law enforcement purpose are processed in a lawful manner in accordance with the Law and in particular, Schedule 2 Parts I and II. The processing condition will vary according to the specific purpose in each case, but in broad terms, one or more of the following conditions apply (this list is not exhaustive and will depend upon circumstances):
The processing is necessary for the controller to exercise any right or power, or perform or comply with any duty, conferred or imposed on the controller by an enactment.
The processing is necessary to protect someone’s life, health and safety.
The processing is necessary to perform a function that is of a public nature, or a task carried out in the public interest.
The processing is necessary in order to comply with an order or judgment of a court or tribunal.
The processing is necessary in accordance with legal proceedings.
The processing is necessary for the administration of justice or for the function of a States or public committee.
Where do we get the personal information from?
We may obtain personal information from a wide variety of sources, including: Guernsey Border Agency (including Customs and Excise and Immigration and Nationality Services), other law enforcement agencies (Guernsey Vetting Bureau; Disclosure and Barring Service); income tax; UK and international law enforcement agencies and bodies; licensing authorities; legal representatives; prosecuting authorities; advocates; courts; Prison, Probation service; Housing; partner agencies involved in crime and disorder strategies; voluntary sector organisations; auditors; States Committees; emergency blue light services; individuals themselves; current, past or prospective employers of the individuals; healthcare, social and welfare services or practitioners; education; employees, officers and agents of Guernsey Police; suppliers, providers of goods or services; persons making an enquiry or complaint; financial organisations and advisors; credit reference agencies; survey and research organisations; trade union, staff associations and professional bodies; Parish Douzaines; voluntary and charitable organisations; Ombudsmen and regulatory authorities; the media; and any other relevant bodies.
There may be times where we obtain personal information from sources such as CCTV system, body worn video or correspondence. EFCB may monitor, record and retain telephone calls, texts, emails and other electronic communications to and from the Bureau in order to deter, prevent and detect inappropriate or criminal activity, to ensure security, and to assist the purposes we have described.
Who do we share your Personal Information with?
To carry out the purposes described, EFCB may disclose personal information to a wide variety of recipients, including those from whom personal data is obtained. Disclosures of personal information are made on a case-by-case basis, using the personal information appropriate to a specific purpose and circumstances, with necessary controls in place and only where there is a lawful basis for doing so.
Information may be shared with: Guernsey Police, Guernsey Border Agency; disclosure to other law enforcement agencies (including international agencies); health and social care; youth offending teams; Probation Service; Prison Service; criminal justice system, Courts/Tribunals, partner agencies working on crime reduction initiatives; partners in the Criminal Justice arena; Victim Support Service provider; to bodies or individuals working on our behalf such as IT contractors; Parish Douzaines; agencies involved in offender management; States of Guernsey government Committees; ombudsmen and regulatory authorities; the media; the Disclosure and Barring Service; international agencies concerned with the safeguarding of international and domestic national security; to other bodies or individuals where necessary to prevent harm to individuals and the EFCB insurer.
Some of the bodies or individuals to whom we may disclose personal information are situated outside of the European Union/EEA. If we do transfer personal data to such territories, we undertake to ensure that there are appropriate safeguards in place to certify that it is adequately protected as required by the data protection legislation.
The States of Guernsey have a professional relationship with a third party supplier, Agilisys Guernsey Ltd. who provide support to and carry out maintenance on the IT infrastructure of the organisation. For Agilisys to carry out the function which they are contracted to provide, there will be instances where they may have sight of your personal data. EFCB will only provide Agilisys with access to your personal data where there is a legitimate and lawful purpose for this access to be given in line with Schedule 2 of the Law and our internal policies and directives.
Your personal data may also be shared with the Scrutiny Management Committee ('SMC') and also the Internal Audit function of the States of Guernsey as may be required for the completion of their relevant functions. Furthermore, any personal data shared with SMC and Internal Audit will be limited and processed in accordance with Sections 5 and 13(b) of the Law.
Purpose limitation
Under the Law and LEO, personal data must not be collected except for a specific, explicit and legitimate purpose and, once collected, must not be further processed in a manner incompatible with the purpose for which it was originally collected.
EFCB acknowledges its responsibility with regards to this data protection principle and therefore maintains that it will not further process that personal data in a way which is incompatible to its original reason for processing as specified in section 2, unless required to do so by law.
Minimisation
Under the Law and LEO, personal data processed must be adequate, relevant and limited to what is necessary, or not excessive, in relation to the purpose for which it is processed.
EFCB maintains that it will only process the personal data which is detailed in section 2, and will not process any further personal data that is not necessary in relation to the original reason for processing personal data as specified in section 2, unless required to do so by law.
Accuracy
Personal data processed must be accurate, kept up-to-date (where applicable) and reasonable steps must be taken to ensure that personal data that is inaccurate is erased or corrected without delay.
EFCB will ensure that all personal data that it holds is accurate and kept up-to-date, and any personal data that is inaccurate will be erased or corrected without delay.
Storage limitation
Personal data must not be kept in a form that permits identification of a data subject for any longer than is necessary for the purpose for which it is processed.
EFCB keeps your personal information as long as is necessary for the particular purpose or purposes for which it is held. Records that contain your personal information relating to criminal investigations; civil investigations are retained in accordance with our Retention and Disposal Policy. In broad terms these are structured according to the offence type or category, for example serious offences against a person, or firearms licences.
EFCB follow guidance issued by the College of Policing on the management of police information and records management. Further information can be obtained from the College of Policing www.app.college.police.uk
Personal information which is placed on the Police National Computer (PNC) is retained, reviewed and deleted in accordance with the Retention Guidelines for Nominal Records on the Police National Computer.
We will regularly review our data to ensure it is still required and is lawful for us to continue to retain it and when it is no longer required we will securely destroy it. We will respect your individual rights under the Law.
Integrity and confidentiality
Personal data must be processed in a manner that ensures its appropriate security, including protecting it against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
EFCB takes the security of all personal information under our control seriously and complies with the relevant parts of the Law and LEO relating to security.
We will ensure that appropriate policy, training, technical and procedural measures are in place. These will include, but are not limited to, ensuring our buildings are secure and protected by adequate physical means. The areas restricted to our officers and staff are only accessible by those holding the appropriate identification and have legitimate reasons for entry. Audits of our buildings security to ensure they are secure. Ensuring our systems meet appropriate industry and government security standards.
We carry out regular audits and inspections, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so. Our staff training, standard operating procedures and policies contain strict guidelines as to what use may be made of any personal information contained within them.
All individuals with access to electronic and manual records are vetted in a manner commensurate with their role that they are expected to undertake.
EFCB comply with the information security standards of the States of Guernsey and further safeguards are applied to maintain connectivity with national systems and networks.
Accountability
EFCB is responsible for, and must be able to demonstrate, compliance with the data protection principles. EFCB will implement appropriate technical and organisational measure that ensure and demonstrate compliance, this includes internal data protection policies such as staff training, internal audits of processing activities and reviews of internal policies. We have also implemented measure that meet the principles of data protection by design and data protection by default.
Data Subject Rights
The Data Protection Law and LEO provide you as an individual with certain rights. The most commonly used right is that of the ‘right to access’ under section 15 of the Law and section 13 of the LEO. Individuals can ask whether any information is held about them by an organisation and request a copy of that information. In order to access your information held by the EFCB you will need to make a request to the EFCB. The best way to do this is by completing an application form click here.
The Law and LEO also provide you with other rights, not least the right to complain to the regulatory authority. More information about all your rights can be found at https://gov.gg/dp and through the Office of the Data Protection Authority at https://www.odpa.gg/.
Contact Details
The contact details of the controller are as follows:
The Director of EFCB
Economic & Financial Crime Bureau, Marie Randall House, Upland Road, St Peter Port, Guernsey, GY1 3AB
Email: [email protected]
The contact details for the Data Protection Officer for EFCB are as follows:
Data Protection Officer for EFCB
Sir Charles Frossard House, St Peter Port, Guernsey, GY1 1FH
Tel: +44 (0)1481 220012
Email: [email protected]
Changes to our Privacy Notice
We keep our fair processing notice under regular review. This fair processing notice was last updated on 6th June 2023. If we plan to use your personal information for a new purpose we will update this notice and communicate the changes before we start any new processing.