Privacy notice

Your privacy is important to us. This Privacy Notice explains how West Mercia Police collects, stores, uses, discloses, retains and destroys information about people (their personal data [1]), and the steps we take to ensure that it is protected. It also describes the rights you have in regard to information we may already hold about you and any further personal information we might collect about you, either from you or from a third party[2]. 

The use and disclosure of personal data is governed in the United Kingdom by the Data Protection Act 2018 which is supplemented by the UK General Data Protection Regulation (UK GDPR) and incorporates the Law Enforcement Directive (LED).  The Chief Constable of West Mercia Police is registered with the Information Commissioner as a ‘controller’ and is obliged to ensure that West Mercia Police handles all personal data in accordance with the Data Protection Act 2018 and the UK GDPR.

West Mercia Police takes its responsibility very seriously and ensures that personal data is handled appropriately in order to secure and maintain individuals’ trust and confidence in the Police Service.

The Force’s Data Protection Officer together with other members of the Audit, Risk and Compliance Department provides help and guidance to ensure that the police force applies appropriate standards to protect your personal data. Personal data could be information which is held on a computer, in a paper record such as a file, as images, but it can also include other types of electronically held information such as CCTV images or Body Worn Video images.

Our ‘Appropriate Processing Documents’ (UK GDPR Processing and Law Enforcement Processing) also provide information about how West Mercia Police safeguards and protects the sensitive personal information it uses.  This ‘sensitive’ information includes personal data about an individual’s: race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life, sexual orientation, and criminality.

You can contact the Data Protection Officer if you have any questions or concerns about how we process your personal data:

1. Why do we process personal data?

West Mercia Police collects, stores, uses, discloses and retains personal data for two broad purposes; the Law Enforcement Purposes and to carry out activities to support the Law Enforcement Purposes, something we call General Purposes.

a) The Law Enforcement Purpose (Policing Purpose) which includes:

• the prevention, investigation, detection or prosecution of criminal offences
• the execution of criminal penalties
• safeguarding against and the prevention of threats to public security
• the policing purpose [3]

b) The provision of services to support the Law Enforcement Purposes (General Purposes) which includes:

• staff/pension administration, occupational health and welfare
• management of public relations, journalism, advertising and media
• management of finance, payroll, benefits, accounts, audit, internal review
• internal review, accounting and auditing
• training
• property management
• insurance management
• vehicle and transport management
• payroll and benefits management
• management of complaints
• vetting
• management of information technology systems
• legal services
• information provision
• licensing and registration
• pensioner administration
• research including surveys [4]
• performance management
• sports and recreation
• procurement
• planning
• system testing and fault resolution
• security
• health and safety management

it is appropriate to highlight we have a requirement to carry out user satisfaction surveys to evaluate our performance and effectiveness.  We may contact you if you have been a victim of crime or reported an incident to us to ask for your opinion about the service you have received.  Sometimes, like many police forces, we may use a private company to undertake these surveys. The information we obtain from the surveys are used to help us improve. 

West Mercia Police will only use the minimum amount of personal information necessary to carry out a particular activity.

2. Whose personal data do we handle?

In order to carry out the purposes described under Section 1 above West Mercia Police may collect, store, and disclose and retain personal data relating to a wide variety of individuals including the following:

• victims of crime
• witnesses to crime
• people convicted of an offence
• people suspected of committing an offence
• complainants, correspondents and enquirers
• advisers, consultants and other professional experts
• suppliers
• current and former staff including volunteers, agents, temporary and casual workers
• former and potential members of staff, pensioners and beneficiaries
• other individuals necessarily identified in the course of police enquiries and activity

West Mercia Police will only use appropriate personal information necessary to fulfil a particular purpose or purposes. 

3. What types of personal data do we handle?

In order to carry out the purposes described under Section 1 above, West Mercia Police may collect, use, disclose and retain personal data relating to or consisting of the following:

• personal details such as name, address and biographical details
• family, lifestyle and social circumstances
• education and training details
• financial details
• goods or services provided
• racial or ethnic origin
• membership of extremist political parties
• religious or other beliefs of a similar nature
• trade Union membership
• physical or mental health or condition
• sexual orientation
• offences (including alleged offences)
• criminal proceedings, outcomes and sentences
• physical identifiers including DNA, fingerprints and other genetic samples
• sound and visual images
• licenses or permits held
• criminal Intelligence
• references to manual records or files
• information relating to health and safety
• complaint, incident and accident details

West Mercia Police will only use appropriate personal data necessary to fulfil a particular purpose or purposes. 

4. Where do we obtain personal data from? 

In order to carry out the purposes described under Section 1 above West Mercia Police may collect personal data from a wide variety of sources, other than directly from you, including the following:

• other law enforcement agencies
• HM Revenue and Customs
• international law enforcement agencies and bodies
• licensing authorities
• legal representatives
• prosecuting authorities
• defence solicitors
• courts
• prisons
• security companies
• partner agencies involved in crime and disorder strategies
• private sector organisations working with the police in anti-crime strategies
• voluntary sector organisations
• approved organisations and people working with the police
• independent Police Complaints Commission
• his Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS)
• auditors
• office of the Police and Crime Commissioner (OPCC)
• central government, governmental agencies and departments
• emergency services
• relatives, guardians or other persons associated with the individual
• current, past or prospective employers of the individual
• healthcare, social and welfare advisers or practitioners
• education, training establishments and examining bodies
• business associates and other professional advisors
• employees and agents of West Mercia Police
• suppliers, providers of goods or services
• persons making an enquiry or complaint
• financial organisations and advisors
• credit reference agencies
• survey and research organisations
• trade, employer associations and professional bodies
• local government
• voluntary and charitable organisations
• ombudsmen and regulatory authorities
• the media
• data processors working on behalf of West Mercia Police
• ANPR (Automatic Number Plate Recognition)

West Mercia Police may also obtain personal data from other sources such as its own CCTV systems, Body Worn Video footage or correspondence.

5. What is our lawful basis for processing this information?

West Mercia Police will only use your personal data where we have an appropriate lawful basis for doing so, for example we use your personal data where:

• we need to use the information to comply with our legal obligations
• we need to use the information for the performance of a task in the public interest
• we need to use the information to perform a contract with you
• we need to use the information to comply with law enforcement
• we need to use the information to protect yours or someone else’s life
• we have your consent to process the data for a specific purpose

Where we rely on your consent to process data, you have the right to withdraw this at any time. To withdraw consent please contact the Data Protection Officer using the details provided in this Privacy Notice.

6. How do we process personal data?

In order to achieve the purposes described under Section 1 West Mercia Police will handle personal data in accordance with the Data Protection Act 2018 and the UK GDPR.

Where we are processing data for the General Purposes we will ensure that any personal data is:

• processed lawfully, fairly, in a transparent manner in relation to individuals
• collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes
• further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes
• adequate, relevant and limited to what is necessary in relation to the purpose for which it is processed
• accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
• kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving
• purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the UK GDPR in order to safeguard the rights and freedoms of individuals, and
• processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures

Where we are processing personal data for Law Enforcement purposes we will ensure that any personal data is:

• processed lawfully and fairly
• collected for specified, explicit and legitimate purposes and not processed in a manner incompatible with the purpose for which it was originally collected
• adequate, relevant and not excessive in relation to the purpose for which it is processed
• accurate and, where necessary, kept up to date, and
• every reasonable step must be taken to ensure that personal data is accurate, having regard to the law enforcement purpose for which it is processed, is erased or rectified without delay
• kept for no longer than is necessary for the purpose for which it is processed. Appropriate time limits must be established for the periodic review of the need for the continued storage of personal data for any of the law enforcement purposes
• processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, “appropriate security” includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage)

7. How long does West Mercia Police retain personal data?

West Mercia Police keeps your personal data for as long as is necessary for the particular purpose or purposes for which it is held. Personal data which is placed on the Police National Computer is retained, reviewed and deleted in accordance with the agreed national retention periods which are subject to periodic change.

Other records containing personal data relating to intelligence, digital media, custody, crime, firearms, child abuse investigations, and domestic violence will be retained in accordance with the NPCC endorsed principles of the Management of Police Information (MoPI) 2006, and the National Retention Schedule which West Mercia Police has adopted.

West Mercia Police also manages personal data in accordance with our Records Deletion Procedure.

8. How do we ensure the security of personal data?

West Mercia Police takes the security of all personal data under our control very seriously. We will comply with the relevant parts of the Data Protection Act 2018, the UK GDPR and LED relating to security, and seek to comply with the National Police Chiefs Council (NPCC) and relevant parts of the ISO27001 Information Security Standard.

We will ensure that appropriate policy, training, technical and procedural measures are in place, including audit and inspection, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so, and then under strict guidelines as to what use may be made of any personal data contained within them. These procedures are continuously managed and enhanced to ensure up-to-date security.

9. Who do we disclose personal data to?

In order to carry out the purposes described under Section 1, above West Mercia Police may disclose personal data to a wide variety of recipients in any part of the world, including those from whom personal data is obtained (as listed above). Recipients of the data may include:

• law enforcement agencies (including international agencies)
• businesses (including security companies, and other supplies of goods and services) and other private sector organisations working with the police in anti-crime strategies
• partner agencies working on crime reduction or safeguarding initiatives
• agencies and other third parties concerned with the safeguarding of and investigation relating to international and domestic national security
• local authorities, national and local government departments and agencies (including the Home Office, HM Revenue and Customs, the Serious Fraud Office, the Child Maintenance Service, the National Fraud Initiative, and private safeguarding agencies)
• police and crime commissioners
• legal representatives, prosecuting authorities, courts, prisons, and other partners in the criminal justice arena
• victim support service providers
• bodies or individuals working on our behalf
• authorities involved in offender management
• ombudsmen, auditors and regulatory authorities
• other bodies or individuals where required under any legislation, rule of law, or court order
• other bodies or individuals where necessary to prevent harm to individuals
• the media

We may also disclose to other bodies or individuals where necessary to prevent harm to individuals. Disclosures of personal data will be made on a case-by-case basis, using the personal data appropriate to a specific purpose and circumstances, and with necessary controls in place.

Where you have provided your personal data to us for the purposes of the police constable recruitment process, your data, including biographical monitoring information, will be shared with the College of Policing.

It will be stored on their secure network or within their Assessment Information Management System (AIMS). From this information, your name, email address and candidate reference number will be uploaded to the new online assessment platform for constable recruitment and shared with the third party provider hosting the system in order to progress your application virtually.

Some of the bodies or individuals to which we may disclose personal data are situated outside of the European Union - some of which do not have laws that protect data protection rights as extensively as in the United Kingdom. If we do transfer personal data to such territories, we will take proper steps to ensure that it is adequately protected as required by the Data Protection Act 2018.

West Mercia Police will also disclose personal data to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and by court order. This may include disclosures to the Child Maintenance Service, the National Fraud Initiative, and the Home Office and to the Courts.

West Mercia Police may also disclose personal data on a discretionary basis for the purpose of, and in connection with, any legal proceedings or for obtaining legal advice. 

10. What rights do you have about how West Mercia Police manages your personal data? 

The UK GDPR provides certain rights for individuals however all of these rights do not apply when it comes to Law Enforcement processing, and the applicable rights do not apply in all circumstances. Details of the rights are described below: 

The right to be informed – You are entitled to be told how we obtain, use, retain and store your personal data and who we share it with. This is described within this Privacy Notice.

The right of access – Previously a Subject Access request. You can request access, which may be subject to some exemption, to a copy of information that may be held about you, along with information on what personal information we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making. You can usually make a request for access free of charge.

Details of the application process, known as ‘Right of Access’ can be found on the West Mercia Police website.

Alternatively individuals may contact West Mercia Police by using the contact details provided below; in writing or via telephone however the preferred method is via the application process. 

Information Compliance Unit
West Mercia Police
PO Box 55
Hindlip
Worcester
WR3 8SP

Telephone: 01905 331565 / 331545

Email: [email protected]

Rights of access do not apply to the processing of ‘relevant personal data’ [5], we can limit confirmation that we are processing data and any access to personal data, if necessary and proportionate in order to:

• avoid obstruction to an official or legal inquiry, investigation or procedure
• avoid prejudicing prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties
• protect public security, or
• protect the rights and freedoms of others
• where a limitation is in place the individual must be given an explanation of the reasons, unless providing this information undermines the purpose of imposing the restriction

The right to rectification – Under Article 16 of the UK GDPR, individuals have the right to have inaccurate or incomplete personal data rectified. West Mercia Police  can refuse this request where the data is necessary and proportionate or relates to ‘relevant personal data’ ie to avoid obstructing an official or legal inquiry, investigation or procedure, or to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, as detailed above. 

The request must be processed within one month, or three months in complex cases. Where a request is refused the individual must be notified and where no action is taken individuals have the right to be informed of how to seek a judicial remedy.

The right to erasure – Under Article 17 of the UK GDPR, individuals have the right to have personal data erased and to prevent processing in specific circumstances:

• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
• When the individual withdraws consent
• When the individual objects to the processing and there is no overriding legitimate interest for continuing with the processing
• When the personal data was unlawfully processed
• When the personal data has to be erased in order to comply with a legal obligation
• When the personal data is processed in relation to the offer of information society services to a child

West Mercia Police can refuse such a request where it is necessary and proportionate or relates to 'relevant personal data', ie to avoid obstructing an official or legal inquiry, investigation or procedure or to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, as detailed above.  The erasure of personal data relating to criminal offences cannot be considered until its full period of retention has been reached (as detailed in the National Retention and Disposal Schedule which has been adopted by West Mercia Police).

The right to restrict processing – Under Article 18 of the UK GDPR, individuals have the right to restrict the processing of personal data, for example, if an individual believes that the data is incorrect but it is not possible to confirm the accuracy of the data.  West Mercia Police can refuse such a request where it is necessary and proportionate or relates to ‘relevant personal data’, in order to avoid obstructing an official or legal inquiry, investigation or procedure or to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, as described above. 

Where a request is received the individual must be informed in writing as to whether West Mercia Police has granted the request; and if it has been refused, the reasons why.

The right to data portability (not applicable to law enforcement processing) - Under Article 20 of the UK GDPR, individuals have the right to data portability which allows individuals to obtain and reuse their personal data for their own purposes across different service.  It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way without hindrance to usability.  The personal data must be provided in a structured, commonly used and machine readable form.  The information must be provided free of charge.

The right to object (not applicable to law enforcement processing) - Under Article 21 of the UK GDPR, individuals have the right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling), and processing for purposes of scientific research and statistics.

Rights in relation to automated decision making including profiling - Under Article 22 of the GDPR, individuals have the right to object to decisions made about them on the basis of automated processing including profiling, where those decisions have legal or other significant effects.  This includes processing where there is no human intervention, for example where automated processes are used to sift recruitment applications. 

An individual has the right to withdraw their consent – This does not apply to offenders or suspected offenders as the processing is necessary to perform a task within the public interest without their consent being given.  There may however be  circumstances in which individuals have given the police consent to use their information; this can be withdrawn at any time by writing to the Data Protection Officer using the details at section 12 Contact Us at the bottom of this notice.                             

Individuals have the right to complain to the Information Commissioner’s Office if they believe that they are or have been adversely affected by the handling of personal data by West Mercia Police. Individuals may direct their complaint to the Information Commissioner’s Office via the website or by telephone (0303 123 1113),

11. Monitoring

West Mercia Police may monitor or record and retain telephone calls, texts, emails and other electronic communications to and from the force in order to deter, prevent and detect inappropriate or criminal activity, to ensure security, and to assist the purposes described under section 1 above. West Mercia Police does not place a pre-recorded ‘fair processing notice’ on telephone lines that may receive emergency calls (including misdirected ones) because of the associated risk of harm that may be caused through the delay in response to the call.

How do we use cookies?

Cookies are used on this website to improve user experience and for essential functionality; they are not used for identification purposes.

Learn more about how we manage cookies.

12. Contact Us

If you have any concerns about how West Mercia Police has handled your personal information you should contact the Data Protection Officer (DPO) via email or in writing to:

Data Protection Officer
West Mercia Police
Audit, Risk and Compliance
PO Box 55
Hindlip
Worcester
WR3 8SP

Telephone: 01905 331565 / 331545

Email: [email protected]

13. If you want to raise a concern with the Supervisory Authority

The Information Commissioner is the independent Authority responsible within the UK for ensuring we comply with data protection legislation. If you have a concern about how we have used your personal information or you believe you have been adversely affected by our handling of your data you may wish to contact them using the information below:

The Information Commissioner’s Office
Wycliffe House
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Email: [email protected]

Date of last update and changes

We last updated this privacy notice in January 2024. We keep this privacy policy under regular review and update it if any of the information in it changes.