Canvassing Political Opinions

Electors

Name, Address, Electoral Roll Number, Telephone Number, Political Opinion, Contact Details, Marketing Preferences

Public Task (Democratic Engagement)

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Communicating with you via post about our policies, campaigns, events, fundraising appeals and opportunities to get involved with the party

Electors, Members/Former Members, Donors, Volunteers

Name, Address, Electoral Roll Number, Profiled Data

Public Task (Democratic Engagement)

Communicating with you via electronic message or SMS about our policies, campaigns, events, fundraising appeals and opportunities to get involved with the party

Electors, Donors, Volunteers

Name, Address, Contact Details (email, phone, social media etc)

Consent

Sending you surveys and processing your responses

Electors

Name, Address, Electoral Roll Number, Political Opinion, National and Local Issue Positions, Incidental Special Category data, Contact Details (email, phone, social media etc), Marketing Preferences

Public Task (Democratic Engagement)

• Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.
• Article 9(2)(a) UK GDPR - Explicit Consent for collection of incidental special category data

Conducting petitions and presenting the signatories to the specified recipient

Electors

Name, Postcode, Contact Details (email, phone, social media etc), Political Opinion, National and Local Issue Positions

Public Task (Democratic Engagement)

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties

Conducting Online Surveys, Petitions, etc…

Electors

Name, Address, Electoral Roll Number, Political Opinion, National and Local Issue Positions, Incidental Special Category data, Contact Details (email, phone, social media etc), Marketing Preferences, IP Address

Public Task (Democratic Engagement)

• Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.
• Article 9(2)(a) UK GDPR - Explicit Consent for collection of incidental special category data

Showing you adverts via social media platforms

Electors, Members/Former Members, Donors, Volunteers

Email Address

• Legitimate Interests
• Consent

Creating custom audiences for advertising on Social Media Platforms using existing supporters' details, profiled target audiences, and information from our cookies/pixels and using those audiences to create “lookalikes”

Electors, Members/Former Members, Donors, Volunteers, Supporters

Email Address, Address, Political Opinion

• Legitimate Interests
• Consent

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Registering for a campaign event(s) organised by CCHQ and administering the event

Electors, Members/Former Members, Supporters

Name, Address, Contact Details (email, phone, social media etc), Political Opinion

Public Task (Democratic Engagement)

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Polling Day Activities – e.g. “Knocking up” on the doorstep or via phone and “Telling” at polling stations

Electors

Name, Address, Electoral Roll Number, Polling Day Activity

Public Task (Democratic Engagement)

Signing up to Volunteer for the party and us sharing your details with the wider party

Volunteers

Name, Address, Contact Details (email, phone, social media etc), volunteering preferences, Political Opinion

Public Task (Democratic Engagement)

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Maintaining and administering a database to store Electoral Register data, canvassing data, membership data, survey responses etc – including operating a test environment

Members, Donors, Electors, Volunteers, Candidates, Elected representatives, Supporters, Officers and Staff

Name, Contact Details (email, phone, social media etc), Addresses, Political Opinion, Age, Voting History, Relationships, Electoral Roll Information, Issue Positions, Memberships, Donations, Survey Responses, User profile names, Hashed Passwords, IP addresses, User authentication, Usage data and usage history, Free text notes, Titles, Suffixes, Gender, First Language, Positions Held, Location Information, Profiled data, Records of data subject rights requests, constituent record history, Telling and Knocking Up Information.

• Public Task (Democratic Engagement)
• Legitimate Interests
• Legal Obligation (Compliance with Article 24 UK GDPR and S41 Political Parties, Elections and Referendums Act 2000)

• Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.
• Article 9(2)(a) UK GDPR - Explicit Consent for collection of incidental special category data

Providing our VoteSource Canvasser Application for doorstep data collection

Members, Donors, Electors, Volunteers, Candidates, Elected representatives, Supporters, Officers and Staff

Name, Address, Electoral Roll Number, Polling District, Political Opinion, Voting History, Contact Details (email, phone, social media etc), Survey Responses, Membership History, Telling and Knocking Up Information, Username, Hashed Password, IP Address, Geolocation, Device information, Usage data and history

• Public Task (Democratic Engagement)
• Legitimate Interests

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Processing your application for membership and administration of your membership

Members

Name, Address, Political Affiliation, Contact Details (email, phone, social media etc), Date of Birth, Payment Information

• Contract
• Legal Obligation (Compliance with Article 24 UK GDPR and S41 Political Parties, Elections and Referendums Act 2000

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Inviting you to renew your membership and/or re-join the party

Members/Former Members

Name, Contact Details (email, phone, social media etc), Address

Legitimate Interests

Sharing your membership details with your local Conservative Association

Members

Name, Address, Political Affiliation, Contact Details (email, phone, social media etc), Date of Birth

Contract

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Communicating with you via electronic message about your membership, our policies, campaigns, events, fundraising appeals and opportunities to get involved with the party

Members/Former Members

Name, Address, Contact Details (email, phone, social media etc)

Contract

Conducting petitions and presenting the signatories to the specified recipient

Electors

Name, Postcode, Contact Details (email, phone, social media etc), Political Opinion, National and Local Issue Positions

Public Task (Democratic Engagement)

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties

Administering Membership Suspensions and Expulsions

Members/Former Members, Complainants, Witnesses,

Name, Details of Suspension/Expulsion, Contact Details, Address, Ethnicity, Religious or Philosophical Beliefs, Trade Union Membership, Health Data, Criminal Offence Data, Sex Life, Sexual Orientation, Political Opinion - incl Membership of a political party, Age, Social Media Activity (Public and Private), Personal Communications Data, Details of Complaint, Complaint Resolution, Witness Evidence

• Contract
• Public Interest/Legal Obligation (Compliance with the Equality Act 2010)

• Article 9(2)(g) "Substantial Public Interest" - DPA Schedule 1, Part 2, Paragraph 6 - "Statutory Etc and Government Purpose" - there is a substantial public interest to ensure that engagement with politics complies with the Equality Act 2010
• Article 9 UK GDPR - Schedule 1 DPA 2018; Schedule 1, Part 2 Paragraph 10 - Preventing or detecting unlawful acts
• Article 10 UK GDPR - meet a condition of Schedule 1 DPA 2018; Schedule 1, Part 2 Paragraph 10 - Preventing or detecting unlawful acts

Process appeals against expulsion and suspension by Party Members

Members/Former Members, Complainants, Witnesses,

Name, Contact Details, Address, Ethnicity, Religious or Philosophical Beliefs, Trade Union Membership, Health Data, Criminal Offence Data, Sex Life, Sexual Orientation, Political Opinion - incl Membership of a political party, Age, Social Media Activity (Public and Private), Personal Communications Data, Details of Complaint, Complaint Resolution, Witness Evidence

• Legitimate Interests
• Contract
• Public Interest/Legal Obligation (Compliance with the Equality Act 2010)

• Article 9(2)(g) "Substantial Public Interest" - DPA Schedule 1, Part 2, Paragraph 6 - "Statutory Etc and Government Purpose" - there is a substantial public interest to ensure that engagement with politics complies with the Equality Act 2010
• Article 9 UK GDPR - Schedule 1 DPA 2018; Schedule 1, Part 2 Paragraph 10 - Preventing or detecting unlawful acts
• Article 10 UK GDPR - meet a condition of Schedule 1 DPA 2018; Schedule 1, Part 2 Paragraph 10 - Preventing or detecting unlawful acts

Processing your donation or loan and checking your eligibility to donate or loan sums of more than £500

Donors

Name, Address, Electoral Roll Number, Contact Details (email, phone, social media etc), Payment Information, Political Affiliation

• Public Task (Democratic Engagement)
• Legal Obligation – Compliance with Parts IV and 4A Political Parties, Elections and Referendums Act 2000

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Reporting donations and loans to the Electoral Commission

Donors

Name, Address, Donation Amount, Political Affiliation

Legal Obligation – Compliance with Parts IV and 4A Political Parties, Elections and Referendums Act 2000

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 6 Statutory and Government Purposes

Maintaining and administering a fundraising database

Members/Former Members, Donors

Name, Address, Political Opinion, Contact Details (email, phone, social media etc), Donation History, Biographical Information, Occupation, Correspondence, Family Connections, Marketing Preferences, Date of Birth

• Legitimate Interests
• Legal Obligation – Compliance with S41 Political Parties, Elections and Referendums Act 2000

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Registering for an event(s) organised by CCHQ and administration of the event

Attendees

Name, Address, Contact Details (email, phone, social media etc), Dietary Requirements, Biographical Information, Payment Information

• Contract
• Legal Obligation (Compliance with Article 24 GDPR and S41 Political Parties, Elections and Referendums Act 2000

Article 9(2)(g) GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Providing you with information about the event(s) for which you have registered

Attendees

Name, Contact Details (email, phone, social media etc)

• Contract (for ticketed events)
• Legitimate Interests

Hosting Video Conferencing and Virtual Events

Electors, Members/Former Members, Donors, Volunteers, Elected Representatives

Name, Contact Details (email, phone, social media etc), IP Address, Political Opinion, Images and Recorded Images

Legitimate Interests

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Political research using publicly available sources

Elected Representatives, Political Staff, Candidates, Members, Activists, Donors, Electors, Members of the public

Name, Publicly available information (e.g. occupation, social media posts, other internet posts, directorships, media history, property and financial holdings etc), Misconduct, Publicly available special category information (e.g. political opinion, trade union membership, criminal offences, etc)

Legitimate Interests

• Article 9(2)(e) UK GDPR – Personal data manifestly made public by the data subject
• Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 11 Protecting the public against dishonesty etc.

Due diligence of prospective members, potential appointees, donors and volunteers using publicly available sources

Members, Donors, Supporters, Volunteers, Potential Appointees

Name, Publicly available information (e.g. occupation, social media posts, directorships, media history, property and financial holdings etc), Misconduct, Publicly available special category information (e.g. political opinion, trade union membership, criminal offences, etc)

Legitimate Interests

• Article 9(2)(d) UK GDPR – processing is carried out in the course of its legitimate activities with appropriate safeguards
• Article 9(2)(e) UK GDPR – Personal data manifestly made public by the data subject
• Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 11 Protecting the public against dishonesty etc.

Communication with media organisations

Elected Representatives, Political Staff, Candidates, Members, Activists, Donors

Name, Publicly available information (e.g. occupation, social media posts, directorships, media history, property and financial holdings etc), Misconduct, Publicly available special category information (e.g. political opinion, trade union membership, criminal offences, etc)

Legitimate Interests

• Article 9(2)(e) UK GDPR – Personal data manifestly made public by the data subject
• Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 11 Protecting the public against dishonesty etc.

Contacting us by email, post, via one of our website “contact us” forms or telephone and CCHQ processing and keeping a record of your correspondence

Electors, Members of the public

Name, Contact Details (email, phone, social media etc), Correspondence, Political Opinion, Incidental Special Category Data, IP Address (on our website)

Legitimate Interests

• Article 9(2)(a) UK GDPR - Explicit Consent for processing of incidental special category data
• Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Managing security and your safety when you visit one of our offices

Visitors

Name, Time and date of visit, Person you are visiting, Log of your movements within our offices, CCTV Images, Thermal Image (as part of our Covid secure precautions), Details of accidents and/or security incidents

• Legal Obligation (Compliance with Articles 24 and 32 UK GDPR, Health and Safety at Work Act 1974) 
• Legitimate Interests

• Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 1, Paragraph 1 Employment, Social Security and Social Protection
• Article 10 UK GDPR - meet a condition of Schedule 1 DPA 2018; Schedule 1, Part 2 Paragraph 10 - Preventing or detecting unlawful acts

Reporting accidents and/or security incidents to relevant healthcare organisation or law enforcement authority

Visitors

Name, Details of accidents and/or security incidents

• Legal Obligation (Compliance with Reporting of Injuries, Diseases and Dangerous Occurrences Regulations) 
• Legitimate Interests
• Vital Interests

• Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 1, Paragraph 1 Employment, Social Security and Social Protection
• Article 10 UK GDPR - meet a condition of Schedule 1 DPA 2018; Schedule 1, Part 2 Paragraph 10 - Preventing or detecting unlawful acts

Processing your purchase, delivering your order and administering your transaction

Customers

Name, Contact Details (email, phone, social media etc), Address, Payment Details, IP Address

Contract

Creating a user account

Customers

Name, Contact Details (email, phone, social media etc), Address, Payment Details, IP Address

Contract

Downloading and using one of our mobile applications (e.g. share2win)

Elected Representatives, Political Staff, Candidates, Members, Activists, Donors, Electors, Members of the public

Name, Contact details, identifiers, user content, usage data, diagnostics, political opinion

Contract

• Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Sending us a message and us responding to you

Customers

Name, Contact Details (email, phone, social media etc), Correspondence

Legitimate Interests

Keeping a record of your transaction for accounting purposes

Customers

Name, Contact Details (email, phone, social media etc), Address, Payment Details

Legal Obligation (Compliance with S.41 Political Parties, Elections and Referendums Act 2000)

Providing advice, training and support on matters relating to the Constitution and the Voluntary Party

Association Officers, Association Staff, Staff, Members, Activists, Volunteers

Name, Contact Details (email, phone, social media etc), Correspondence

Legitimate Interests

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Communication with Party Officers at Board, Regional and Association Level and Party Members

Party Officers, Members

NameName, Contact Details (email, phone, social media etc), Correspondence, Political Opinion, Incidental Special Category Data, Volunteering Interests, Events Interests

Legitimate Interests

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Providing advice and support on the selection of local government candidates

Association Officers, Association Staff, Candidates

Name, Position, Contact Details (email, phone, social media etc), Correspondence, Candidate CV’s, Political Opinion

Legitimate Interests

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Providing advice and support on local disciplinary issues

Association Officers, Association Staff, Members, Activists

Name, Details of Disciplinary Case, Correspondence

Legitimate Interests

Managing Young Conservative Groups

Members, Students

Name, Contact Details (email, phone, social media etc), Occupation, Region of Residence, Political Opinion, Correspondence

Public Task (Democratic Engagement)

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Managing Affiliated Groups

Members

Name, Contact Details (email, phone, social media etc), Occupation, Region of Residence, Political Opinion, Correspondence

Public Task (Democratic Engagement)

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Managing Affiliated Groups

Members

Name, Contact Details (email, phone, social media etc), Occupation, Region of Residence, Political Opinion, Correspondence

Public Task (Democratic Engagement)

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Managing External Relationships

Members, Community Stakeholders, Candidates, Elected Representatives, Business Owners

Name, Contact Details (email, phone, social media etc), Occupation, Region of Residence, Political Opinion, Correspondence

Public Task (Democratic Engagement)

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Providing support to Local Councillors and the Conservative Councillors’ Association

Elected Representatives

Name, Contact Details (email, phone, social media etc), Occupation, Region of Residence, Political Opinion, Correspondence

Public Task (Democratic Engagement)

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Processing, investigating, and administering breaches of our Code of Conduct in accordance with the procedures set out in our Code of Conduct

Complainants, Witnesses, Members of Parliament, Peers, Members of the European Parliament, Members of the Scottish Parliament, Members of the Welsh Assembly, Members of the Greater London Assembly, Police & Crime Commissioners, elected Mayors, Councillors and Association, area, regional, and national Party officers

Name, Contact Details, Address, Ethnicity, Religious or Philosophical Beliefs, Trade Union Membership, Health Data, Criminal Offence Data, Sex Life, Sexual Orientation, Political Opinion - incl Membership of a political party, Age, Social Media Activity (Public and Private), Personal Communications Data, Details of Complaint, Complaint Resolution, Witness Evidence

Public Task (Democratic Engagement)

• Article 9(2)(g) "Substantial Public Interest" - DPA Schedule 1, Part 2, Paragraph 6 - "Statutory Etc and Government Purpose" - there is a substantial public interest to ensure that engagement with politics complies with the Equality Act 2010
• Article 9 UK GDPR - Schedule 1 DPA 2018; Schedule 1, Part 2 Paragraph 10 - Preventing or detecting unlawful acts
• Article 10 UK GDPR - meet a condition of Schedule 1 DPA 2018; Schedule 1, Part 2 Paragraph 10 - Preventing or detecting unlawful acts

Processing, investigating, and administering breaches of our Social Media Complaints and Opposition Candidacy Rules in accordance with the procedures set out in our Code of Conduct

Complainants, Witnesses, Members of Parliament, Peers, Members of the European Parliament, Members of the Scottish Parliament, Members of the Welsh Assembly, Members of the Greater London Assembly, Police & Crime Commissioners, elected Mayors, Councillors and Association, area, regional, and national Party officers

Name, Contact Details, Address, Ethnicity, Religious or Philosophical Beliefs, Trade Union Membership, Health Data, Criminal Offence Data, Sex Life, Sexual Orientation, Political Opinion - incl Membership of a political party, Age, Social Media Activity (Public and Private), Personal Communications Data, Details of Complaint, Complaint Resolution, Witness Evidence

Public Task (Democratic Engagement)

• Article 9(2)(g) "Substantial Public Interest" - DPA Schedule 1, Part 2, Paragraph 6 - "Statutory Etc and Government Purpose" - there is a substantial public interest to ensure that engagement with politics complies with the Equality Act 2010
• Article 9 UK GDPR - Schedule 1 DPA 2018; Schedule 1, Part 2 Paragraph 10 - Preventing or detecting unlawful acts
• Article 10 UK GDPR - meet a condition of Schedule 1 DPA 2018; Schedule 1, Part 2 Paragraph 10 - Preventing or detecting unlawful acts

Processing Payments to Suppliers

Suppliers Staff

Name, Contact Details, Job Title

Contract

Processing Payments from donors, members and supporters and keeping a record for accounting purposes

Donors, Members, Supporters

Name, Address, Political Affiliation, Contact Details (email, phone, social media etc), Date of Birth, Payment Information

• Contract
• Legitimate Interests

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Preparing and Reporting Election Spending Returns to the Electoral Commission

Campaign Staff, Suppliers, Association Officers, Association Staff, Candidates, Election Agents, Volunteers

Name, Address, Expense Details, Job Title, Correspondence (for preparing returns)

Legal Obligation (Compliance with Part V Political Parties, Elections and Referendums Act 2000)

Performing Market Research to get a sense of political opinion across the UK

Electors

Name, Address, Telephone Number, Constituency, Gender, Age, Profiled data, National and local issue positions, Political Opinion

Public Task (Democratic Engagement)

Article 9(2)(g) UK GDPR – substantial public interest – DPA 2018, Schedule 1, Part 2, Paragraph 22 Political Parties.

Conducting Opinion Polling to get a sense of political opinion across the UK

Electors

Name, Address, Telephone Number, Constituency, Gender, Age, Profiled data, National and local issue positions, Political Opinion

Public Task (Democratic Engagement)

Right to be informed

You have the right to be informed about the collection and use of your personal data. CCHQ provides this in the form of privacy notices and/or privacy information at the point of collection or within one month of obtaining your data. 

We may not provide privacy information where you either already have such information or it would involve a disproportionate effort to provide such information.

Right of access to your data

You have the right to request a copy of your personal information that we hold. This is commonly known as a Subject Access Request.

Right of rectification of your data

You have the right to request that inaccurate or incomplete information that we hold about you is corrected.

Right to be forgotten

In certain circumstances you can ask for the data we hold about you to be erased from our records. When we do so, we keep the bare minimum of your information in order to continue to respect your wishes when your personal data is next provided to us by a local authority, which is at least annually. There is some data that must be retained by law and other data that we may have a legitimate interest to retain

Right to restriction of processing

You have the right to request that we restrict the processing of your data where you are contesting the accuracy of the data or when the data has been unlawfully processed.

Right to data portability

You have the right to have the data we hold about you transferred to a third-party organisation and you can ask that we provide it in a machine readable format.

Information is only within the scope of the right to data portability if it is personal data that you have provided to us.

Right to object

You have an absolute right to object to your data being used for direct marketing, including profiling for direct marketing purposes – we mark your data clearly with a “no processing” label.

If we process your data on the basis of “legitimate interests” or “a task carried out in the public interest” then you have the right to object to us using your data in that way. This right is not absolute, and we may continue to process your data if we can demonstrate compelling legitimate grounds for the processing.

Automated individual decision-making, including profiling

We may use computer software to make decisions about you or to create a profile about you. You have the right not to be subject to such a decision or to that profiling where it creates legal effects concerning you or where it significantly affects you.