The Labour Party in Government  

This privacy notice is part of the Labour Party’s obligation of notification to you for the transfer and sharing of your personal data between the Labour Party and any government departments.  

There are three scenarios where the transfer and sharing of your personal data between the Labour Party and any government departments will take place: 

1. The Labour Party has transitioned into government and a member(s) of Labour Party Staff are continuing their work with you. Your personal data will move from the Labour Party to the relevant government department(s), and you will only work with that/those government departments moving forward. 

2. The Labour Party is working in collaboration with a government department(s) and you, or your personal data are involved in that work (and you have already been made aware of this). This means there will be an ongoing sharing or shared use of your personal data between the Labour Party and any government departments until the work comes to an end. 

3. The Labour Party is transitioning out of government and individuals currently employed in any government departments that move to being Labour Party staff are continuing any work with you or your personal data in their new Labour Party staff role. This means the Labour Party will no longer be sharing your personal data with any government departments but is continuing the work that was started whilst in government. 

This privacy notice does not replace or act as privacy notice for any government departments. This privacy notice is only for work begun before the transition to government that will continue whilst in government, work that begins whilst in government that is a collaboration between the Labour Party and any government departments and any work that is due to continue after the Labour Party’s time in government.  

This privacy notice is not a prescriptive list of projects of work but is an assurance of secure and compliant transfers and sharing of personal data related to when the Labour Party is in government. 

There will have been (or will be) another privacy notice presented to you at the time your personal data was originally collected within the work you are involved with. This privacy notice is for the purpose of transfers and sharing of personal data rather than the work itself. 

What personal data do we collect? 

This will be personal data used within the work you were or are involved in which began either before the Labour Party was in government or while the Labour Party was in government will be, but is not limited to: 

• Work relevant personal identifiers: for example, name, email address, telephone number, post code, where you work, job title, local council; 

• Work relevant characteristics: for example, age, gender, ethnicity, academic achievement, location, first language, disability, benefits status, school attendance information, accessibility needs; 

• Work relevant information about you or related to you which you have made publicly available including anything on any social media platform; 

• Work relevant responses to interviews, electronic conversations (emails, direct messages), meetings we have with you, conversations and surveys, questionnaires and Polls (digital or paper-based); 

• Work relevant derived data about you which is where new information or datasets that are created from existing data, or data we have collected within our work with you; 

• Work relevant sensitive information including hospital or GP records, criminal records and further special categories of personal information as characterised in the UK GDPR (race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, information concerning your sex life or sexual orientation); 

• Work relevant personal information related to the Equality Act 2010 inclusive of data known as ‘Protected Characteristics’ (age, disability, gender reassignment, marriage or civil partnership (in employment only), pregnancy and maternity, race, religion or belief, sex, sexual orientation); 

• Personal information related to our internal equality and diversity monitoring policy (geographical location, organisation, socio-economic class, caring responsibilities, educational background); and 

• Pseudonymous and anonymous data we have created from your personal data so that work is able to continue with the least amount of personal data necessary. 

Projects vary and work varies and so, if the type of personal data being used in the work you are involved in is not listed above does not mean it cannot be used. What is important is that the personal data being used is within your expectations of use.  

Where something does not seem to be within your expectations of use of your personal data within the work, the best course of action will be to contact the person you have been in touch within the past about the work. Where this is not possible or successful you can email [email protected] which may take slightly longer for a response to any complex queries of this nature. 

Where do we get your personal data? 

There will be a variety of ways the Labour Party has gathered your personal data and each will be specific to the kind of work we are doing with you which you will have been made aware of. 

This privacy notice is not designed to be the point of first awareness of how your personal data will be used in the work you are involved in. This privacy notice is in regard to transferring or sharing your personal data between the Labour Party and any governmental department within that work. 

Therefore, all personal data gathered will have already been gathered either directly or indirectly from you when the work began. Examples of this may be, but are not limited to: 

• From yourself via email, telephone or face to face communications we have with you (direct data collection); 

• Online or physical surveys, questionnaires or polls you have answered or completed for us where you may or may not have had the option to tell us who you are (direct data collection); and 

• Publicly available data from areas such as websites and social media (indirect data collection). 

How is your personal data transferred or shared and what is our lawful basis for this? 

The original lawful basis for the use of your personal data within the work you or your personal data is involved in will remain the same. This will have been provided to you at the time of your first involvement with any the work. 

The below information is directly in relation to the lawful mechanism for transferring and sharing personal data between the Labour Party and any governmental departments. 

Purpose for using personal data	Lawful basis for using
When transitioning into government: To share personal data from the Labour Party to a governmental department or departments that will continue the work begun by the Labour Party. This is where the Labour Party does not intend to continue the work it began although the work will continue with a different data controller (the relevant government department).	The lawful basis used by the Labour Party for the movement of personal data through the Five Safes Framework (see below) is based on the legitimate interest of the Data Controller in accordance with UK General Data Protection Regulation (GDPR), Article 6.1(f). Where there may be any ‘Special categories of personal data’ in the transfer, the transfer shall be of substantial public interest in accordance with GDPR Article 9.2(g). Upon successful transfer of personal data to a governmental department and at the point of closure of a secure transfer location, all uses of the personal data shall be under the controllership of the governmental department to which it was transferred and the lawful basis for the use of the personal data within the governmental department (where there will not be further/ongoing collaboration with the Labour Party) will be for the performance of a task carried out in the public interest in accordance with GDPR Article 6.1(e), also known as “Public Task”. Where any ‘Special categories of personal data’ are within the data transferred, their use will be for the purpose of substantial public interest in accordance with GDPR Article 9.2(g).
Whilst in government: To share personal data between the Labour Party and the governmental department(s) for specific working collaboration(s) which may have begun before the Labour Party came into government and will continue, or where the work began whilst the Labour Party was in government.	The lawful basis used by the Labour Party for the movement and continued sharing of personal data is the legitimate interest of the Data Controller in accordance with UK General Data Protection Regulation (GDPR), Article 6.1(f). Where there may be any ‘Special categories of personal data’ in the transfer, the transfer shall be of substantial public interest in accordance with GDPR Article 9.2(g).
When transitioning out of government: To share personal data from a governmental department or departments to the Labour Party for the Labour Party to continue the work begun by a government department individually or within a collaboration with the Labour Party. This is where the government department or departments do not intend to continue the work begun although the work will be continued by the Labour Party (the Labour Party will become the sole data controller for the uses of the personal data upon transfer of personal data).	The lawful basis used by the Labour Party for the movement of personal data through the Five Safes Framework (see below) is based on the legitimate interest of the Data Controller in accordance with UK General Data Protection Regulation (GDPR), Article 6.1(f). Where there may be any ‘Special categories of personal data’ in the transfer, the transfer shall be of substantial public interest in accordance with GDPR Article 9.2(g). Upon successful transfer of personal data from a governmental department to the Labour Party, and at the point of closure of a secure transfer location, all uses of the personal data shall be under the controllership of the Labour Party. Where any ‘Special categories of personal data’ are within the data transferred, their use will be for the purpose of substantial public interest in accordance with GDPR Article 9.2(g), or where relevant, the Labour Party will seek consent from the data subject for its continued use of this data in accordance with GDPR Article 9.2(a).
To identify personal data and take relevant action upon submission of a data subject rights request.	Compliance with a legal obligation under UK GDPR Article 6.1(c). The legal obligation is the UK General Data Protection Regulation to uphold your data protection rights. Special categories of personal data used for the purpose of Substantial Public Interest (Preventing or detecting unlawful acts; Protecting the public; Regulatory requirements) under UK GDPR Article 9.2(g).
To be able to assess any impact on individuals of a data breach involving personal data held on Labour Party systems or on third party systems.
To help protect an individual from neglect or physical, mental or emotional harm, or protect the physical, mental or emotional well-being of an individual.	Use of the personal data is necessary to protect the vital interests of an individual or individuals in accordance with UK GDPR Article 6.1(d). Special categories of personal data used for the purpose of Substantial Public Interest (Preventing or detecting unlawful acts; Protecting the public; Regulatory requirements) under UK GDPR Article 9.2(g).
To deal with legal claims and ongoing litigation cases.	Compliance with a legal obligation under UK GDPR Article 6.1(c). The legal obligation is the UK General Data Protection Regulation to uphold your data protection rights. Special categories of personal data used for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity under UK GDPR Article 9.2(f).

What are the security measures in place for this transfer or sharing of my personal data?  

The process in place for secure and compliant data transfer upon the Labour Party’s transition into government is based on the methodology known as the ‘5 Safes’ used by the NHS and the Office for National Statistics. These are: 

‘Safe People’  We require the individual requesting the data (a “Requester”) for transfer to use their newly established government email address to make the request and to also provide a proof of identity similar to how we ID verification for data subject rights requests. I.e. we ask them for a copy of either a passport, driver’s license or council tax/utility bill. 

‘Safe Projects’  We ask the Requester to provide full details of what data is required and why. This request is reviewed by the information technology team, data protection team, and if relevant the governance and legal unit within the Labour Party to ensure the data requested is appropriate and ethical use. 

‘Safe Data’  We ensure a criteria of what data is or is not allowable for transfer. Any personal data transferred must be relevant to the work and may be embedded in the documentation or demonstrably part of information needed to form governmental policies or information required to form a Labour Party government. Data transfers must not contain: Labour Party Member data (unless already embedded in the work), Financial data, Personal data, Labour Party Human Resources data, data about attendees at Labour Party Conferences and events. 

‘Safe Settings’  Labour Party staff moving from the Labour Party to Government employment will be provided with a secure location to save their data before they move. When they have left the employment of the Labour Party, they will no longer have access to the secure location and need to submit a data request form we send them as a link via email from the Labour Party IT Helpdesk. Once the request form is submitted and subsequently approved, they are provided a link to a new, managed secure location only accessible to the one governmental email address they provided. This access will be time limited to 5 working days, after that access will be revoked and will need to be requested again via another request form. All access is monitored, and automatic security alerts are in place for any anomalous activity. 

‘Safe Outputs’  The secure location and/or the data will be password protected. Once the data has been accessed it will be removed from the secure location and the location will be terminated. Data will only be transferred using this secure process.  Where data is transferred via USB drive, paper copy, email, instant messaging services (text/SMS or WhatsApp etc.), personal cloud file share services (e.g. DropBox, GoogleDrive etc.) or email (e.g. to personal accounts or by asking an old Labour Party colleague to send to you etc.), shall be treated as a data breach and investigated by the Data Protection Team. 

A step-by-step guide has been provided to all Labour Party staff transitioning to any governmental department and access to the step-by-step guide is easily available internally to any Labour Party staff. 

The Labour Party conducted a data protection risk assessment to account for any risks posed to individuals whose personal data may be involved in the transition to government. A data sharing framework was established between the Labour Party and relevant governmental departments for any transitions and any ongoing working collaboration(s). 

How do you know if your personal data has been transferred or shared? 

Due to how transitioning into government takes place there is no formal notification procedure to alert people their personal data has been transferred.  

It is most likely that you will find out about the transfer when you are contacted by phone or email by the same person you were in touch with when they worked at the Labour Party. They have been instructed to identify themselves as now working in that governmental department when they get back in touch with you.  

An email would come from a governmental departmental email address rather than a Labour Party email address. 

If you are involved in any work that began whilst the Labour Party are in government then you will be made aware of any transfers or sharing of your personal data when it is first collected, and this privacy notice is not meant to be a substitute for that privacy notice. 

How long will we keep your personal data in the secure transfer location? 

Any personal data held in the secure transfer location will only ever be held for five (5) working days after it is loaded to the secure transfer location. At the end of the five working days, which we feel is enough time for someone to access and download the data to a governmental department, the data is removed, and the secure transfer location is deleted. 

What are your rights and how can you express them? 

To understand your data privacy rights and to submit a rights request, the best way to do so is by visiting the ‘YOUR RIGHTS’ page on our website which you can get to by clicking here. 

How can you complain about our use your personal data? 

The best way to make a complaint is by visiting our page on ‘HOW TO MAKE A DATA PROTECTION COMPLAINT’ which you can access by clicking here. .  

How can you report a breach or misuse of personal data? 

If you know of, or suspect, a breach or misuse of personal data then please contact the Data Protection Team via email using:  [email protected] 

How can you contact us about this privacy notice? 

If you have any questions about the information in this privacy notice, then you can contact the Data Protection Team via email using: [email protected] or by post within a letter to: 

Labour Statutory Data Protection Officer 

The Labour Party, Southworks, 20 Rushworth Street, United Kingdom, SE1 0SS 

When was this privacy notice last updated? 

We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify you of the changes where required by applicable law to do so. Last modified: 05 July 2024.