Extended producer responsibility for packaging: privacy policynotice

Who

Extended collectsProducer yourResponsibility personal(EPR) data

Defrafor packaging is actinga ascomponent thepart ‘dataof processor’wider Collection and Packaging Reforms (CPR) programme that will require certain producers of packaging to take greater responsibility for theits disposal and recycling. This privacy notice explains what personal data is being collected through the services (including ‘report packaging data’data’) service.

Asprovided under the dataEPR processor,for wepackaging collect and sharehow that personal data onis behalfused.

If ofyou have any queries about the fourcontent environmentalof regulatorythis bodies.privacy Thesenotice, are:email:

• the

  pEPRdataandserviceownerteam@Defra.gov.uk

  Who Environmentcollects Agencyyour (EA)

• thepersonal Scottishdata

  The EnvironmentDepartment Protectionfor AgencyEnvironment, (SEPA)

• NaturalFood Resourcesand WalesRural (NRW)
• theAffairs Northern(Defra) Irelandis Environmentcontroller Agencyfor (NIEA)

Defra’sthe mainpersonal addressdata forwe correspondence is:collect:

If you need further information about how Defra uses your personal data and your associated rightsrights, you can contact the Defra data protection manager at data.protection@defra.gov.uk orat using the above postal address above.
or email:

data.protection@Defra.gov.uk

The data protection officer for Defra is responsible for checking that Defra complies with legislation. Youyou can contact themthe atDefra defragroupdataprotectionofficer@defra.gov.uk ordata usingprotection manager at the above postal address above.
or email:

What

DefraGroupDataProtectionOfficer@Defra.gov.uk

Defra is also acting as the ‘data processor’ for the personal data being collected through some services. As the data processor, we collect and howshare itdata ison used

Webehalf willof collectthe your:following 4 environmental regulatory bodies:

• nameEnvironment Agency (EA)
• telephoneNatural orResources mobileWales number(NRW)
• emailNorthern addressIreland Environment Agency (NIEA)
• addressScottish ifEnvironment usedProtection forAgency business(SEPA)

 What purposes,personal includingdata postcodeDefra collects

Depending on the services you use, Defra collects your:

• name
• contact details
• organisation name
• Internet Protocol (IP) address, and details of which version of web browser you used
• information on how you use the site, using cookies and page tagging techniques
• questions, queriesqueries, or feedback you leave

How this data will be used

We collect this data and:for the following purposes.

• share

   How itenvironmental withregulators thewill use your data

  The environmental regulators sowill theyuse knowyour whodata hasto submittedundertake organisationtheir andstatutory packagingmonitoring data,role andfor soEPR theyfor canpackaging. approveThis includes:

  • approving or refuserefusing a request to be an ‘approved person’ or someone with ‘delegated authority’
  • sharetracking itwho withhas submitted organisation and packaging data.
  • calculating recycling obligations

  How the scheme administrator sowill theyuse canyour workdata

  The outscheme administrator will use the data to:

  • calculate fees where applicable, for example calculating the disposal costscost obligations of producers
  • issue invoices
  • calculate the grants payable to local authorities
  • share data with a thirdthird-party party organisation contracted to manage the invoicing of organisations for disposal cost obligations
  • calculateprevent wasteand disposaldetect feescrime
  • calculategather administrativeand feesrespond to feedback aimed at improving our services
  • gathermonitor feedbackthe toperformance improveand oursecurity of the online services
  • respondcontact you to anyobtain feedbackfurther information

  How Defra will use your data

  Defra will use your data:

  • to invite you sendto usjoin one or more services
  • monitorso thethat performanceyou can set up an account and securityaccess those services
  • so the scheme administrator can contact you about those services

  Data obtained from third parties

  Depending on the services you use, Defra obtains your personal data from:

  • one or more of the onlineenvironmental serviceregulators
  • your representative
  • a local authority
  • the Ministry of Housing, Communities and Local Government
  • publicly available sources

  Lawful basis for processing your personal data

  The lawful basis for processing your personal data is that it is necessary:necessary to:

  • to perform a task in the public interest as part of theEPR Collectionfor & Packaging Reforms (CPR) programmepackaging
  • to do our work as a government department asunder partEPR offor thepackaging, Collection & Packaging Reforms (CPR) programme, introduced in support of the Government’s 25 Year Environment Plan,Plan, which is underpinned by sections 50 and 51 of Part 3 and Schedule 4 and Schedule 5 of the Environment Act 2021

  Consent to process your personal data

  The processing of your personal data is not based on consent. You cannot withdraw it.

  WhoSharing we share your personal data with

  We will share the personal data collected under this privacy notice with the environmental regulatorsregulators. and the scheme administrator. We do this to providedeliver aservices digital service as part of theEPR Collectionfor & Packaging Reforms (CPR) programme.packaging.

  The environmental regulators are controllers in their own right. You can learn more about how your personal data is processed by reading the environmental regulatorsregulators’ atjoint theprivacy followingnotice.

  We websites:will publish a public list of large producers (PLLP) in accordance with legislation in each nation and subsequent amendments.

  • ScottishThe EnvironmentPackaging ProtectionWaste Agency(Data Collection and Reporting) (Wales) Regulations 2023
  • NaturalThe ResourcesPackaging WalesWaste (Data Reporting) (England) Regulations 2023
  • NorthernThe IrelandPackaging EnvironmentWaste Agency(Data Reporting) (No.2) Regulations (Northern Ireland) 2023
  • EnvironmentThe AgencyPackaging Waste (Data Reporting) (Scotland) Regulations 2023

  Defra respects your personal privacy when responding to access to information requests,requests. butWe weonly may have to share information when necessary to meet the statutory requirements of the Environmental Information Regulations 2004 and the Freedom of Information Act 2000.

  How long weDefra holdholds personal data for

  We will keep your personal data for 7 years in line with the requirements of the CollectionEPR &for Packagingpackaging, Reformsexcept (CPR)data programme.related to Invoicing activities which will be retained for 11 years.

  What What happens if you do not provide the personal data

  IfYou you do not provide the personal data required you will not be able to participateuse inEPR thefor service.packaging services.

  Use of automated decisiondecision-making making or profiling

  The personal data you provide is not used for:

  • automated decision making (making a decision by automated means without any human involvement)
  • profiling (automated processing of personal data to evaluate certain things about an individual)

  Transfer of your personal data outside of the UK

  Defra will only transfer your personal data to another country that is deemed adequate for data protection purposes.

  Your rights

  Based on the lawful processing above, your individual rights are:

  • the right to be informed
  • the right of access
  • the right to rectification
  • the right to restrict processing
  • the right to object
  • rights in relation to automated decision making and profiling

  Find out more about your individual rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

  Complaints

  You have the right to make a complaint to the Information Commissioner’s Office at any time.

  Defra’s personal information charter

  Defra’s personal information charter explains more about your rights over your personal data.