FSNI Privacy Notice

Data Controller Name

Data Controller Name: Department of Justice (Forensic Science Northern Ireland)

Address: 151 Belfast Road, Carrickfergus, Co Antrim, BT38 8PL

Telephone: (028) 9036 1888

Email: FSNI FoI Mailbox FSNI.FOI@fsni.gov.uk

Data Protection Officer Name: DoJ Data Protection Officer

Telephone: (028) 9037 8617

E-mail: DataProtectionOfficer@justice-ni.gov.uk

Why are you processing my personal information?

Forensic Science Northern Ireland (FSNI) processes personal data that is necessary for the purposes of the Administration of Justice including independent reviews. This is FSNI’s Lawful Purpose under the UK GDPR/UK Data Protection Act 2018 and the majority of this information would come under the Law Enforcement Directive.

Legal Basis for Processing

Personal data is primarily processed to assist an investigative authority or independent review body in the administration of Justice through the provision of impartial scientific advice and support, to enhance the Criminal Justice System. While FSNI is not set up under any specific Legal Authority it is a competent authority for the processing of personal data under the provisions included at Part 3 (Law Enforcement Processing); Chapter 1; Sections 29 (1)(a); (1)(b); (2) and (3); 30 (1)(a) and Schedule 7 (3): of the Data Protection Act 2018.

What categories of personal data are you processing?

We process personal data relating to:

• Subjects / defendants which may include children
• Victims which may include children
• Employees
• Customers and clients

• Legal Profession
• Suppliers and services providers
• Advisers, consultants and other professional experts
• Complainants and enquirers
• Third parties

We also process the following special category data :

• Racial or ethnic origin
• Sexual orientation
• the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual

Where do you get my personal data from?

• Police Service of Northern Ireland
• Public Prosecution Service
• Other Northern Ireland Government Departments
• Health Trusts
• Other investigative and statutory review bodies
• Private customers

Do you share my personal data with anyone else?

• Public Prosecution Service
• Police Service for Northern Ireland
• Other Northern Ireland Government Departments
• Other investigative and statutory review bodies (e.g. CCRC)

Personal information is shared with the investigative body (e.g. PSNI) or “private customer” that originally provided the personal information to FSNI / submitted the items / material for forensic analysis.

The information being shared between FSNI and PSNI may also be provided, as required by Law and/or subject to the agreement of either party, to other criminal justice organisations and review bodies and appointed defence representatives / experts to enable them to perform their statutory and other functions of the criminal justice system efficiently and effectively (e.g. Public Prosecution Service; Coroners Services; Police Ombudsman NI; Criminal Cases Review Commission; etc.).

Personal data is only shared when it is necessary

1. ‘’for the performance of a task carried out in the public interest or in the exercise of official authority vested in the *controller” in terms of Article 6(1)(e) of the UK GDPR
2. ‘’for compliance with a legal obligation to which the *controller is subject’’ under Article 6(1)(c) of the UK GDPR

(*investigative authority)

Do you transfer my personal data to other countries?

In some cases, subject to the investigative authority agreement, your personal data may be transferred to other countries particularly in relation to criminal offence, the prevention or detection of crime and the protection of the vital interests of individuals.

How long do you keep my personal data?

Full details may be found in the DoJ Retention and Disposal Schedules:

What rights do I have?

• You have the right to obtain confirmation that your data is being processed, and access to your personal data
• You are entitled to have personal data rectified if it is inaccurate or incomplete
• You have a right to have personal data erased and to prevent processing, in specific circumstances
• You have the right to ‘block’ or suppress processing of personal data, in specific circumstances
• You have the right to data portability, in specific circumstances
• You have the right to object to the processing, in specific circumstances
• You have rights in relation to automated decision making and profiling

FSNI Case Work enquiries and Subject Access Requests

Section 3 of the Act defines ‘personal data’ - which is in the possession of, or is likely to come into the possession of the data controller - as: -

2. “Personal data” means any information relating to an identified or identifiable living individual

3. “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to —

• an identifier such as a name, an identification number, location data or an online identifier, or
• one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(5) “Data subject” means the identified or identifiable living individual to whom personal data relates.

Under data protection legislation, organisations handling personal data fall into one of two categories, which are “Data Controller” or “Data Processor”. This distinction also determines how an organisation should respond to enquiries and a Subject Access Request (SAR). Data Controllers are the main decision-makers – they exercise overall control over the purposes and means of the processing of personal data. Processors act on behalf of, and only on the instructions of, the relevant controller. It is therefore a ‘data controller’ who has responsibility for responding to subject access requests.

Under the Act and ICO Guidance issued, FSNI is classed as a ‘Data Processor’. This is because all the personal information it holds and processes in relation to individuals involved in some way in a crime or similar incident is owned by and provided to FSNI by the relevant

“Investigating Authority”. FSNI provide scientific advice and support to those organisations within the criminal justice system and do so only on their behalf. In its own right, FSNI do not process any personal information about you.

Therefore any forensic case work related enquiries and Subject Access Requests should be submitted directly to the relevant investigating authority, such as the PSNI.

How do I complain if I am not happy?

If you are unhappy with how any aspect of this privacy notice, or how your personal information is being processed, please contact our Departmental Data Protection Officer at:

• Email: DataProtectionOfficer@justice-ni.gov.uk
• Phone: 028 9037 8617