Appropriate Policy Document

1. Scope of this document

This document covers our processing of personal data revealing political opinions — special category data under Article 9 of the UK GDPR. In practice that is unavoidable for a political party: knowing that someone is a member, an activist, a candidate, or attends our meetings reveals something about their political views.

It sits alongside, and does not replace, our Privacy Policy, which describes everything we do with personal data and the rights you have over it. Where the two overlap, the Privacy Policy is the fuller account; this document is the specific record the Data Protection Act requires us to keep.

It covers this website, and it covers the local members and activists list we work from and the contact we make with people on it by email and telephone. That list is held on Action Network, a platform provided to us by GPEW; the platform is GPEW’s, but the decisions we make about who to contact locally and why are ours, and this document covers those decisions.

It also covers the surveys and canvassing we carry out with residents — asking electors at the door or by telephone what they think about their area and how they intend to vote, and recording the answers against their entry on the electoral register. That processing concerns people who are not our members, and it is the largest thing we do that depends on paragraph 22 rather than on Article 9(2)(d). Section 2 explains why, and our Privacy Policy sets out in full what is recorded and what residents can do about it.

It does not cover the Green Party of England and Wales, which maintains the national membership and activist records as a separate controller under its own policies.

Special category data other than political opinions

Paragraph 22 covers political opinions only. One other kind of special category data reaches us without being asked for: GPEW’s platform tags a record when someone joins a Special Interest Group affiliated with the party, and depending on the group that tag can imply something about a person’s ethnicity, religion or belief, disability or health, sex or sexual orientation, or trade union membership.

That data is outside the paragraph 22 condition. We rely on Article 9(2)(d) for it, which requires no policy document, and we apply the handling rules in section 4 to it regardless — we do not copy it into this website’s database, and we do not use it to decide who to contact. We record it here so that the boundary of this document is explicit rather than assumed.

2. The condition we rely on

Processing special category data needs both a lawful basis under Article 6 and a separate condition under Article 9.

• Article 6 — legitimate interests (Article 6(1)(f)) for running a local party and its website; contract (Article 6(1)(b)) where you have asked us for something specific, such as an account or an event place. The Privacy Policy states the basis for each activity individually.
• Article 9(2)(d) — processing carried out in the course of the legitimate activities of a not-for-profit body with a political aim, relating solely to its members, former members or people in regular contact with it, and not disclosed outside the party without consent. This is our primary condition, and it covers the great majority of what we do: our members, our activists, our postholders, and people who deal with us regularly. It is directly effective and requires no policy document.
• DPA 2018 Schedule 1, Part 2, paragraph 22 — processing of personal data revealing political opinions, by an organisation included in the register maintained under section 23 of the Political Parties, Elections and Referendums Act 2000, necessary for the purposes of its political activities. Paragraph 22(4) defines political activities as including campaigning, fund-raising, political surveys and case-work. We rely on this for the processing Article 9(2)(d) cannot reach, because it involves people who are not our members or regular contacts — canvassing and surveying electors, campaigning to the wider public, and case-work for residents who come to us with a problem. Canvassing is by volume the principal example: paragraph 22(4) names political surveys expressly, and a resident who answers the door is neither a member nor in regular contact with us.

Our position on paragraph 22(1)(b)

Paragraph 22(1)(b) requires the processing to be carried out by an organisation included in the register maintained under section 23 of the 2000 Act. That register is a register of parties. Accounting units are not entries in it: they are creatures of section 26, which lets a registered party’s financial scheme identify constituent organisations each responsible for its own financial affairs. We are one of those, within GPEW’s registration.

We consider the condition available to us, because an accounting unit is a constituent part of the registered party rather than a separate party — the political activity is the registered party’s activity, carried on locally. We state the point openly rather than assert bare registration, so that anyone reviewing this document can see exactly what is being relied on.

For most of what we do, this question is not load-bearing. Article 9(2)(d) covers members and regular contacts on its own, and Article 9(2)(e) covers information our councillors and candidates have manifestly made public. Neither depends on the point above.

Canvassing is the exception, and we say so rather than let it pass. Surveying electors who are not members rests on paragraph 22 alone, so if the condition were held to be unavailable to an accounting unit, that processing — together with campaigning contact with non-members and case-work for non-members — would have no Article 9 condition and would have to stop in its present form. Our answer in that event would be to have it carried out under GPEW’s own registration, GPEW being indisputably on the section 23 register, and for us to act on GPEW’s behalf rather than as controller in our own right. We would not simply continue and hope the point was not taken.

The two statutory limits on this condition

Paragraph 22 does not apply without limit, and we treat both exceptions as operative rules rather than background:

• Paragraph 22(2) — substantial damage or distress. The condition is not met where processing is likely to cause substantial damage or substantial distress to a person. Anyone handling party data who believes a particular use would cross that line must stop and refer it to the contact above before proceeding.
• Paragraph 22(3) — the right to give notice. If you give us written notice requiring us to stop processing your data, and allow a reasonable period to comply, the condition ceases to apply once that period has ended. This is a statutory right specific to political parties and is in addition to the general right to object under Article 21. Send such a notice to the contact address above; we will confirm receipt and tell you what we have stopped.

3. What we process under this condition

We do not buy personal data and we do not combine our records with commercial datasets. We do, however, use canvass returns to decide which campaign literature is delivered to which address, and that is political targeting — we describe it as such in the Privacy Policy rather than deny it here. Its boundaries are that the support estimate is a canvasser’s manual judgement rather than anything computed, that it determines only which leaflet a household receives, that it is built solely from what the resident told us and the electoral register, and that it is never used for online or social media advertising.

4. Procedures for complying with the Article 5 principles

This section is the explanation required by Schedule 1, Part 4, paragraph 39(a). Each principle is followed by what we actually do, rather than a restatement of the principle.

5. Retention and erasure

This section is the explanation required by Schedule 1, Part 4, paragraph 39(b). Our general rule is that data is kept only while it serves the purpose it was collected for, and that nothing is kept beyond 12 months unless there is a specific reason to keep it longer — an active membership, a published record of who represents residents, or a canvass gathered for an electoral cycle that has not yet ended. Those exceptions are named below rather than left implicit.

Retention is enforced automatically, not left to periodic manual tidying. The windows below are declared in one place in our source code, applied by a sweep that runs every day, and published in our Privacy Policy from the same declaration — so the periods we state and the periods we apply cannot drift apart. An automated test refuses to build the site if any window is set beyond the 12-month ceiling.

Records kept for as long as they remain current

• Member accounts — while the account exists. Deleted on request, subject to anything we must keep by law.
• Committee, councillor and candidate profiles — while the person holds the role, plus a reasonable archive period, because there is a public interest in an accurate record of who represented or stood in an area.
• Correspondence and case-work — up to two years from our last exchange unless it needs to be kept longer as a party record.

Canvass records and the electoral register

These are the one deliberate exception to the 12-month rule, and the only category we keep for years rather than months. A canvass return is gathered to plan a campaign that runs to an election, so a window shorter than the electoral cycle would destroy the data before it had served the purpose it was collected for — and would mean canvassing the same households repeatedly to rebuild what we had thrown away, which is worse for the resident, not better.

• Canvass returns — kept for one electoral cycle, up to four years and in no event more than five, then deleted. A later canvass of the same area replaces the earlier record rather than being added to it.
• Copies of the full electoral register — replaced each time a new one is supplied, with the superseded copy destroyed. No historic copies are kept.
• Contact details given to a canvasser — deleted with the canvass record, or sooner once the matter the resident raised is resolved.

Because these are files rather than rows in the website’s database, the automated sweep cannot reach them: this window is enforced by us, on a review at the end of each cycle. We state that plainly, because a published figure that nothing enforces is worth less than one that a named person is accountable for, and we would rather you knew which kind this is.

Records held on GPEW’s platform

The local members and activists list, the campaigning messages sent from it, and sign-ups for events run on it are held on Action Network, which GPEW provides. Those records are subject to GPEW’s retention policy, not the automated sweep described above, and we say so plainly rather than implying a protection we do not control.

What we do control, and do:

• people who leave the party or ask to be removed come off the local organising lists;
• an opt-out from campaigning contact is recorded and kept, because deleting the record outright would let us contact the person again by mistake — the suppression record is the narrowest thing that honours the request;
• we keep no separate local copy of the list that could outlive the platform record; and
• a request for erasure that concerns the platform is passed to GPEW and followed up, not simply redirected.

Erasure

Erasure means deletion of the record, not flagging it as inactive. Where a record is deleted, any linked personal data is removed with it or unlinked. Requests for erasure go to the contact above and are actioned within one month. Some material may survive briefly in encrypted backups; those rotate on their own schedule and are not used to reinstate deleted records.

6. Records of processing

Schedule 1, Part 4, paragraph 41 requires our record of processing to note some additional matters for processing carried out under a Schedule 1 condition. Our record states, for each relevant activity:

• which Article 9 condition is relied on — Article 9(2)(d), Article 9(2)(e), or Schedule 1, Part 2, paragraph 22 — and, where it is paragraph 22, that this document is in place;
• the Article 6 lawful basis and how the processing satisfies it; and
• whether the data is retained and erased in line with the policies in section 5 and, if not, the reasons why not.

Changes made through the member dashboard are additionally written to an audit log recording who made the change, when, and the values before and after, so that an incorrect or unauthorised change can be identified and reversed.

7. Retention, review and availability of this document

As required by Schedule 1, Part 4, paragraph 40, we:

• keep this document in force while the processing continues;
• review and update it periodically — at least annually, and whenever the way we process data changes materially. The current review date is shown at the top of this page;
• retain it, and keep it available, until six months after the processing it covers has stopped; and
• make it available to the Information Commissioner on request, without charge. Publishing it here means it is also available to you.

If you think anything in this document is wrong, or is not being followed, please tell us at louis@hollingworth.nl. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.