How we handle your correspondence data

1. The identity and contact details of the Ministry of Housing, Communities and Local Government (MHCLG) and our Data Protection Officer

MHCLG is the data controller. The Data Protection Officer can be contacted at: dataprotection@communities.gov.uk.

2. What personal data we are collecting and why

We collect personal data to respond to emails, letters, queries, or other communications from members of the public, parliamentarians and organisations.

The following personal data is being collected for this purpose:

• your name
• address
• email address

We will also:

• collect details of any concerns or issues raised in your correspondence
• process any other personal data, including special category data, or data about criminal convictions, which you volunteer about yourself

Special categories of personal data include:

• data about racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic data
• biometric data for the purpose of uniquely identifying a natural person, health, or sex life or sexual orientation

If you have used our webform to send us your correspondence, we will process the following data:

• Necessary cookies
• Optional analytics cookies (only if you give us your consent)

We may use artificial intelligence (AI) tools to process correspondence more efficiently. These tools assist in the case management process, such as identifying topics in correspondence or routing enquiries to the appropriate teams, but do not make decisions and all suggestions are reviewed and approved by staff before any further action is taken. Responses to correspondence are fully checked and finalised by a staff member. 

Data used by artificial intelligence is not used for training the AI models.

3. Lawful basis for processing the data

UK data protection legislation sets out when we are lawfully allowed to process your data. The lawful basis that applies to this processing is that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case, that is being accountable and transparent about the functions and policies for which the department is responsible.

Where special category data or data about criminal convictions is volunteered by a correspondent, our legal basis for processing it is that processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department. The substantial public interest is being accountable and transparent about the functions and policies for which the department is responsible.

In relation to constituency correspondence, our legal basis for processing it is that the processing consists of the disclosure of personal data to an elected representative or a person acting with the authority of such a representative; and it is in response to a communication to the controller from that representative or person which was made in response to a request from an individual; and the personal data is relevant to the subject matter of that communication; and the disclosure is necessary for the purpose of responding to that communication.

If you consent to optional analytics cookies, we process this data on the basis that you have given clear consent for us to process your personal data for the purpose of improving our webform. Further details are available through the cookie banner on the webform.

4. With whom we will be sharing the data

Your information may be shared with other public bodies, or the devolved administrations, where it is necessary and in order to provide a full answer to you.

Your information may be shared with other public bodies, the devolved administrations, constituency offices or political parties, where it is necessary to transfer correspondence to a more appropriate body for an answer.

Your information may be shared with your MP, where they are writing on your behalf.

As personal data will be stored on our IT infrastructure, it will also be shared with our data processors, who provide email and document management and storage services.

5. Where we obtained your data

Where we did not receive your personal data from you, it could have been received from your MP, another body, from another person writing in on your behalf or from another correspondent.

6. For how long we will keep the personal data, or criteria used to determine the retention period.

Personal information in correspondence will usually be deleted 5 calendar years after the correspondence or the case is closed or concluded.

However, correspondence may be kept if it is sufficiently significant that it should be retained for the historical record.

7. Your rights, for example, access, rectification, erasure

The data we are collecting is your personal data, and you have rights that affect what happens to it. You have the right to:

• know that we are using your personal data
• see what data we have about you
• ask to have your data corrected, and to ask how we check the information we hold is accurate
• complain to the Information Commissioner’s Office (see para 11)

In some circumstances you may also have the right to withdraw your consent to us having or using your data, to have all data about you deleted, or to object to particular types of use of your data. We will tell you when these rights apply.

If you have given consent for us to use analytical cookie data about you, you can withdraw this through the cookie banner on the webform.

8. Sending data overseas

Your personal data will not be sent overseas.

9. Automated decision making

We will not use your data for any automated decision making.

Some elements of our correspondence handling process are assisted by artificial intelligence (AI). These tools assist our staff in decision making and all suggestions are reviewed before action is taken.

10. Storage, security and data management

Your personal data will be stored in a secure government IT system and uploaded into our secure case management system.

11. Complaints and more information

When we ask you for information, we will keep to the law, including the Data Protection Act 2018 and UK General Data Protection Regulation.

If you are not happy with how we use your personal data, you should contact dataprotection@communities.gov.uk.

If you are still not happy, or for independent advice about data protection, privacy and data sharing, you can contact:

Telephone: 0303 123 1113 or 01625 545 745

https://ico.org.uk/