Privacy Notice

The Legislation Publishing Service (“the service”) is provided by of the National Archives, a non-ministerial department under the Department for Digital, Culture, Media and Sport on behalf of HM Government. Publishing all UK legislation is a core part of the remit of His Majesty’s Stationery Office (HMSO), part of The National Archives, and the Office of the King's Printer for Scotland.

The service is delivered online via https://publishing.legislation.gov.uk with support available through email or telephone. The service is used to publish legislative items in an efficient manner and part of this requires the handling of personal information from users across government. For the purposes of applicable legislation, including the EU General Data Protection Regulation (GDPR), as amended or supplemented (the “Data Protection Laws”) the National Archives is the Data Controller of your personal information.

Introduction

This Privacy Notice describes what information the National Archives collects about you and why, what we do with that information, how we share it and how we handle the content you place in the service.

The service is operated under contract by The Stationery Office (TSO) on behalf of The National Archives (TNA). In accordance with the EU General Data Protection Regulation (Regulation 2016/679) (the “GDPR”), TNA is the Data Controller of any personal data processed under the contract, and TSO are the Data Processor.

Scope

The scope of the Privacy Notice encompasses your use of the service including communications with the National Archives through email or telephone.

The legal basis for this processing is that the National Archives, in providing you with an account to access the Legislation Publishing Service on the legislation.gov.uk website is exercising the function of a Minister of the Crown.

The Collection of Personal Data

The information that is collected about you is premised on your use of the service as part of your employment.

Your Account

When you sign up for an account on the service (https://publishing.legislation.gov.uk/user/register) we collect the following basic information about you:

• Name
• Contact number
• Job title (including the jurisdiction and department that you work for)
• Email address

We use the information to create and maintain your account so that you can log in to the service. The information may also be used to contact you about your account or important changes to the service.

If your job role relates to the ordering of products or services (for example the processing and publication of items of legislation) then your personal information may be used to fulfil orders or to contact you regarding the order.

This information is shared with TSO who are a contractor of the National Archives. TSO only use the information in relation to the services outlined above and will not use it as part of any commercial activities.

Email or telephone communications

If you contact the National Archives as part of your use of the service then we will collect any information that you choose to provide. That information is then used to review and respond to any comment or query that is raised.

If your job role relates to use of the “validation” aspect of the service then you may on occasion have need to contact the SI Support Team as part of your use of the service. The SI Support Team is a part of TSO and will only use personal information to review and respond to any comment or query that is raised. The information will not be used as part of any commercial activities.

Legal Basis

If you create an account on the service, or contact by email or telephone about that account the legal basis for this processing is that the National Archives, in providing you with an account to access the Legislation Publishing Service on the legislation.gov.uk website is exercising the function of a Minister of the Crown.

Disclosure

In the context of our legal basis for processing your personal information we may disclose the personal information held about you to:

• Our contractor
• Our IT host company for the service

Security

We work to protect the security of your information during transmission by using Transport Layer Security (TLS) software, which encrypts the information that you input.

The service is subject to regular penetration testing to ensure the highest level of security available.

The service uses a content-management framework called Drupal that is maintained in line with the latest security updates and patches.

It is important that you protect against unauthorised access to your computer and your password.

The transmission of information over the Internet is not completely secure. Although we do our best to protect your personal data, we cannot guarantee the security of data transmitted from your department’s network to the service. Any transmission is at the risk of your department. Once we have received your information we will use strict procedures and security features to try to prevent unauthorised access.

International Transfers of Personal Information

Personal information is processed using data centres located inside the European Union.

Retention of Personal Information

The period for which we retain personal information will vary depending on the purposes which it was collected for, as well as the requirements of Data Protection Laws.

If you have signed up for an account on the service your information will be stored for as long as is necessary to provide the account. If you no longer require the account it is your responsibility to let us know.

If you contact us by email or telephone your personal information will be retained for as long as the National Archives deems necessary for review and response to the comment or query as well as longer term improvement of the service.

Your Rights

You may have certain rights in relation to the personal information that we collect about you. These may include the right to request access to your personal information, to request that it is erased, that its processing is restricted, or that any inaccurate personal information is rectified. You may also have the right to object to the processing of your personal information or, in some circumstances, to obtain a copy of the personal information in machine readable format. Please submit any request to the National Archives, using this form: https://nationalarchives.gov.uk/contact-us/your-views/. You can also use this form if you wish to make a complaint to us about our handling of your personal data

You also have the right to complain about the use of your personal information to the Information Commissioner’s Office:

Phone: 0303 123 1113

Web: https://ico.org.uk/global/contact-us/

Changes to the Privacy Notice

The Privacy Notice will be reviewed from time to time to take account of changes to our operations or practices and, further, to make sure it remains appropriate to any changes in law, technology and the business environment. Any personal information held will be governed by the most current Privacy Notice.

For more information please contact our Data Protection Officer, Linda Stewart, at

Email addresses follow the format: firstname.lastname@nationalarchives.gov.uk.