Extended Producer Responsibility (EPR) for packaging is a component part of wider Collection and Packaging Reforms (CPR) programme that will require certain producers of packaging to take greater responsibility for its disposal and recycling.recycling and secure the financial sustainability of the recycling industry. This privacy notice explains what personal data is being collected through the services (including ‘report packaging data’) provided under the EPR for packaging and how that personal data is used.

If you have any queries about the content of this privacy notice, email:

pEPRdataandserviceownerteam@Defra.gov.uk

Who collects your personal data

The environmental regulators are joint controllers of personal data. These are:

• Environment Agency (EA)
• Natural Resources Wales (NRW)
• Northern Ireland’s Department for Environment,Agriculture Food and Rural Affairs (Defra)(DAERA)
• Scottish Environment Protection Agency (SEPA)

Defra acts as the Scheme Administrator and is an independent controller forof a subset of the personal data wesubmitted collect:by producers that is necessary for calculating disposal costs.

If you need further information about how Defra uses your personal data and your associated rights, you can contact the Defra data protection manager at the above postal address or email:

data.protection@Defra.gov.uk

The data protection officer for Defra is responsible for checking that Defra complies with legislation. youYou can contact the Defra data protection managerofficer at the above postal address or email:

DefraGroupDataProtectionOfficer@Defra.gov.uk

Defra is also acting as the ‘data processor’ for the personal data being collected through some services. As the data processor, we collect and share data on behalf of the following 4 environmental regulatory bodies:

• Environment Agency (EA)
• Natural Resources Wales (NRW)
• Northern Ireland Environment Agency (NIEA)
• Scottish Environment Protection Agency (SEPA)

 What personal data Defra collects

Depending on the services you use, Defra collects your:

• name
• contact details
• organisation name
• Internet Protocol (IP) address, and details of which version of web browser you used
• information on how you use the site, using cookies and page tagging techniques
• questions, queries, or feedback you leave

How this data will be used

We collect this data for the following purposes.

 How environmental regulators will use your data

The environmental regulators will use your data to undertake their statutory monitoring role for EPR for packaging. This includes:

• approving or refusing a request to be an ‘approved person’ or someone with ‘delegated authority’
• tracking who has submitted organisation and packaging data.
• calculating recycling obligations
• assessing applications for registration and accreditation as packaging waste reprocessors or exporters
• monitoring of activities and trends in packaging and packaging waste markets
• carrying out compliance and enforcement activities

How the scheme administrator will use your data

The scheme administrator will use the data to:

• calculate fees where applicable, for example calculating the disposal cost obligations of producers
• issue invoices and manage incoming and outgoing payments
• calculate the grants payable to local authorities
• share data with a third-party organisation contracted to manage the invoicing of organisations for disposal cost obligations
• prevent and detect crime
• gather and respond to feedback aimed at improving our services
• monitor the performance and security of the online services
• process and respond to your complaint or data subject access request (DSAR)
• contact you to obtain further information
• inform you when a new document is available in your online account

How Defra will use your data

Defra will use your data:

• to invite you to join one or more services
• so that you can set up an account and access those services
• so the scheme administrator can contact you about those services
• to contact you about your submission
• to inform you when a new document is available in your online account

Data obtained from third parties

Depending on the services you use, Defra obtains your personal data from:

• one or more of the environmental regulators
• your representative
• a local authority
• the Ministry of Housing, Communities and Local Government
• publicly available sources

Lawful basis for processing your personal data

The lawful basis for processing your personal data is that it is necessary to:

• perform a task in the public interest as part of EPR for packaging
• do work as a government department under EPR for packaging

Legislation that supports this basis

EPRThe forprocessing packaging was introduced in support of thepersonal Government’s 25data Yearis Environmentprimarily Plan.supported Thisby isthe underpinnedProducer by sectionsResponsibility 50Obligations (Packaging and 51Packaging ofWaste) PartRegulations 32024 and Schedule, 4 and Schedulewhich 5 ofapply theacross Environmentall ActUK 2021.nations.

ItPrior isto alsothese supportedregulations bycoming legislationinto inforce, each ofnation theimplemented fourdata nations:

• Thecollection Packagingregulations Wastein (Data2023, Collectionwhich andhave Reporting)now (Wales)been Regulationsrevoked. 2023
• TheData Packagingcollected Wasteunder (Datathose Reporting)regulations (England)may Regulationscontinue 2023
• Theto Packagingbe Wasteprocessed (Dataunder Reporting)the (No.2)2024 Regulations (Northern Ireland) 2023
• The Packaging Waste (Data Reporting) (Scotland) Regulations 2023

framework.

Consent to process your personal data

The processing of your personal data is not based on consent. You cannot withdraw it.

Sharing your personal data

We will share the personal data collected under this privacy notice with the environmental regulators. We do this to deliver services as part of EPR for packaging.

The environmental regulators are controllers in their own right. You can learn more about how your personal data is processed by reading  the environmental regulators’ joint privacy notice.

We will publish a public list of large producers (PLLP) in accordance with legislation in each nation and subsequent amendments.

• The Packaging Waste (Data Collection and Reporting) (Wales) Regulations 2023
• The Packaging Waste (Data Reporting) (England) Regulations 2023
• The Packaging Waste (Data Reporting) (No.2) Regulations (Northern Ireland) 2023
• The Packaging Waste (Data Reporting) (Scotland) Regulations 2023

Defra respects your personal privacy when responding to access to information requests. We only share information when necessary to meet the statutory requirements of the Environmental Information Regulations 2004 and the Freedom of Information Act 2000.

How long Defra holds personal data for

We will keep your personal data for 7 years in line with the requirements of the EPR for packaging, except data related to Invoicing activities which will be retained for 11 years.

 What happens if you do not provide the personal data

You will not be able to use EPR for packaging digital services.

Use of automated decision-making or profiling

The personal data you provide is not used for:

• automated decision making (making a decision by automated means without any human involvement)
• profiling (automated processing of personal data to evaluate certain things about an individual)

Transfer of your personal data outside of the UK

If Defra willneeds onlyto transfer your personal data tooutside anotherthe countryUK, thatwe iswill only do so to countries deemed adequate for data protection purposes.purposes, and only where necessary for regulatory or technical reasons.

Your rights

Based on the lawful processing above, your individual rights are:

• the right to be informed
• the right of access
• the right to rectification
• the right to restrict processing
• the right to object
• rights in relation to automated decision making and profiling

Find out more about your individual rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

Complaints

You have the right to make a complaint to the Information Commissioner’s Office at any time.

Defra’s personal information charter

Defra’s personal information charter explains more about your rights over your personal data.

Updates

This privacy notice will be reviewed regularly and updated to reflect changes in legislation, services, or data processing activities