Skip to content

Coronavirus (COVID-19): the policing response and what you need to know

Privacy notice

COVID-19 Privacy Notice

We may seek to collect and process your personal data in response to the recent outbreak of Coronavirus, which is above and beyond what would ordinarily be collected from you.

Read our Coronavirus Privacy Notice for more information.


This document explains the ways in which Avon and Somerset Constabulary collect, use and protect your personal information. It has been written in a clear and straightforward way as possible.

If you have any queries about the way in which we collect, use and protect the personal information you should contact us by:

The Chief Constable of Avon and Somerset Constabulary is a ‘controller’ for the purposes of the Data Protection laws. The current Data Protection laws are found in the General Data Protection Regulation and the Data Protection Act 2018.

In this notice, we use the phrase ‘Data Protection laws’ to mean the GDPR and the existing and new Data Protection Acts.

This notice often talks about “we” or “us”. This means Avon and Somerset Constabulary including our police officers, civilian staff, and third parties working on our behalf.

If you have provided us with personal information on behalf of another person, you should share this notice with them.

What is personal information?

Personal information broadly means information that identifies (or which could, with other information that we hold or are likely to hold, identify) a living individual.

This includes information provided to us by you (or on your behalf). It could also include information about you provided to us by other law enforcement agencies, government or local government agencies, companies, professionals or private persons.

Personal information could be held on a computer or could be in a paper record or image. It can also include other types of electronically held information, such as CCTV recordings and posts on social media.

Whose personal information do we handle?

We collect, hold, and use personal information from the following types of people:

  • Staff including police officers, employees, volunteers, agents, and temporary or casual workers
  • Former officers, members of staff, pensioners and beneficiaries
  • Potential and aspiring officers and staff
  • Offenders and suspected offenders
  • Witnesses
  • Victims
  • Complainants, correspondents and enquirers
  • Relatives, guardians or associates of the above
  • Suppliers
  • Contractors
  • Advisers, consultants and other professional experts, and
  • Other individuals necessarily identified in the course of police enquiries and activity

What types of personal information might we hold about you?

We may hold and process any or all of the following personal information about you:

  • Personal details such as your name, address and other biographical information
  • Details of your family, lifestyle and social circumstances
  • Information about your education and training
  • Your employment details
  • Other financial information about you
  • Details of goods or services that you provide
  • Information about offences you have committed and/or offences you are alleged to have committed
  • The details of criminal proceedings which have been brought against you (including the outcome of those proceedings and sentences imposed upon you)
  • Information about your physical appearance and biometric data (including records of your DNA and fingerprints)
  • Images of you, recordings of your voice or video footage of you
  • Licenses or permits that you hold
  • Information gathered about you by cookies or log files (including your internet protocol (IP) addresses, the type of browser you use to access our web site, the name of your Internet Service Provider (ISP), the date/time that you accessed our website, the referring/exit pages, and the number of clicks you made on our website)
  • References about you
  • Criminal Intelligence about you
  • References to manual records or files relating to you
  • Information relating to health and safety investigations concerning you, or
  • Details of complaints, incidents or accidents involving you (this could include situations in which you have made a complaint and situations in which another person has made a complaint about you).

How do we collect your personal information?

We will collect and process the information about you that you provide by filling in forms, by corresponding with us (by telephone, email or otherwise), by answering questions we ask of you, and/or by otherwise participating in a police investigation. We will also collect and process your personal information by using CCTV in police premises (including police custody suites) and by using body worn video cameras.

We will also collect your personal information by using cookies and log files on our website. Specifically, we use Google Analytics and Wufoo (Page Feedback).

We may also collect and process information about you from third parties including other governmental agencies, companies, professionals or private citizens. In particular, we may receive personal information about you from:

  • Other law enforcement agencies
  • HM Revenue and Customs
  • International law enforcement agencies and bodies
  • Licensing authorities
  • Legal representatives (whether yours or another person’s)
  • Prosecuting authorities
  • Courts
  • Prisons
  • Security companies
  • Partner agencies involved in crime and disorder strategies
  • Private sector organisations working with the police in anti-crime strategies
  • Voluntary sector organisations
  • Approved organisations and people working with the police
  • The Independent Office for Police Conduct (IOPC)
  • Her Majesty’s Inspectorate of Constabulary
  • Auditors
  • The Office of the Police & Crime Commissioner for Avon and Somerset (OPCC)
  • Central government, governmental agencies and government departments
  • Other emergency services
  • Private individuals
  • Relatives, guardians or other persons associated with you
  • Your current, past or prospective employers
  • Healthcare, social and welfare advisers or practitioners
  • Education, training establishments and examining bodies
  • Business associates and other professional advisors
  • Our employees and agents
  • Suppliers, providers of goods or services
  • Financial organisations and advisors
  • Credit reference agencies
  • Survey and research organisations
  • Trade, employer associations and professional bodies
  • Local government
  • Voluntary and charitable organisations
  • Ombudsmen and regulatory authorities
  • The media
  • Data Processors working on behalf of the Constabulary

Why do we hold your personal information?

We obtain, hold, use and disclose personal information for two broad purposes:

Law enforcement purposes 

These are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. This includes safeguarding against (and preventing) threats to public safety. It also involves our obligations to protect children and the vulnerable, and to uphold the Queen’s Peace.

The provision of services to support law enforcement

This includes:

  • Police Officer and Police Staff administration, occupational health and welfare
  • Police Officer and Police Staff recruitment
  • Police Officer and Police Staff Performance management
  • Initiating and managing contracts with third parties
  • Management of public relations, journalism, advertising and media
  • Management of finance
  • Internal review, accounting and auditing
  • Training
  • Property management
  • Insurance management
  • Vehicle and transport management
  • Payroll and benefits management
  • Management of complaints
  • Vetting
  • Management of internal information technology systems
  • Management of external information technology systems (including our website)
  • Legal services
  • Information provision
  • Licensing and registration
  • Pensioner administration
  • Research, including surveys
  • Sports and recreation
  • Procurement
  • Planning
  • System testing
  • Security
  • Health and safety management

Using your information in accordance with the Data Protection Laws:

Data Protection laws require us to meet certain conditions before we are allowed to use your personal information in the way(s) described in this notice. We will always ensure that your personal information is handled fairly, lawfully and with appropriate justification.

We will only use the minimum amount of your personal information necessary to fulfil a particular purpose or purposes.

The lawful conditions that we will rely on for processing your personal data are as follows:

  • That you have given us consent to process your information
  • That it is necessary for us to process your personal information in that way for law enforcement purposes
  • That it is necessary for us to process your personal information in that way for the administration of justice
  • That it is necessary for us to process your personal information in that way to protect your vital interests or the vital interests of another person
  • That it is necessary for us to process your personal information in that way for the establishment, exercise or defence of a legal claim
  • That it is necessary for us to process your personal information in that way for the performance of a task that we are carrying out in the public interest (or in the exercise of our official authority)
  • That it is necessary for us to process your personal information in that way to prevent fraud (by passing your personal information to an anti-fraud organisation), or
  • That it is necessary for us to process your personal information in that way to comply with our legal or contractual obligations

We will strive to ensure that any personal information used by us or on our behalf is of the highest quality and in particular that it is:  adequate, relevant and not excessive; accurate and where necessary kept up to date; only kept for as long as we need it and disposed of securely: and kept secure.

Sharing of your personal information will be made on a case-by-case basis, using only the personal information appropriate to a specific purpose and circumstances, and with necessary controls in place.

Our legitimate interests

When holding, disclosing or otherwise handling your personal information, we have a number of legitimate interests. These include:

  • Ensuring that we are able to handle your information for the purposes of a contractual, quasi-contractual or employment relationship existing between you and us
  • Enabling us to provide services to you
  • Allowing us to comply with our duties to prevent crime, to protect the public from criminal activity, to discover the identities of those responsible for crime, to assist in the prosecution of offenders, to execute criminal punishments, to uphold the Queen’s Peace, and to safeguard children and the vulnerable
  • Facilitating our compliance with legal obligations to share information (for instance when we are ordered to share information by a court)
  • Permitting us to fulfil our licensing and regulatory responsibilities, or
  • Ensuring that accurate records are kept of policing and criminal activity.

Who might we share your personal information with?

In order to fulfil our law enforcement purposes, and to provide services to support law enforcement, we may disclose your personal information to other agencies, companies and persons including those from whom we obtain personal information (as listed above).

This may include disclosures to other law enforcement agencies, partner agencies working on crime reduction initiatives, partners in the Criminal Justice arena, Victim Support, and to bodies or individuals working on our behalf (such as IT contractors, survey organisers, expert bodies or lawyers).

We may also disclose personal information to other private individuals.

Where required, or where it is appropriate to do so, personal information may be shared with the OPCC (including the PCC, their staff, agents and appointed volunteers) to facilitate and support policing and to deliver applicable statutory functions.

Some of the bodies or individuals to whom we may disclose personal information are situated outside of the United Kingdom and some are outside European Union. Some of the territories in which these persons are located do not have laws that protect personal information as extensively as in the United Kingdom. If we do transfer personal information to such territories, we will take proper steps to ensure that it is adequately protected as required by data protection law.

We will also disclose personal information to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and/or by a court order. This may include disclosures to the Child Support Agency, the National Fraud Initiative, or to the Courts. We may also disclose personal information on a discretionary basis for the purpose of, and in connection with, any legal proceedings or for obtaining legal advice.

What are your rights when your personal information is handled by the constabulary?

You have the following rights under Data Protection Law (please note that if your personal information is held for a law enforcement purpose the right to data portability and the right to object do not apply):

  1. Right to be informed
  2. Right of access 
  3. Right to rectification
  4. Right to erasure
  5. Right to restrict processing
  6. Right to data portability (does not apply to law enforcement processing)
  7. Right to object (does not apply to law enforcement processing)
  8. Rights related to automated decision making, including profiling

You should also be aware that if we are holding, disclosing or otherwise processing your personal information because you have given us consent to do so, and this is the only basis on which we process your data, you may withdraw that consent at any time. If you wish to do so you should contact our Data Protection Officer.

Right to be informed

You have the right to be informed about the collection and use of your personal information. This notice gives you the information to which you are entitled. Additional information will also be provided on our website.

We will endeavour to provide information which is concise, transparent, and easy to understand. There may be occasions when it is necessary and proportionate to restrict the provision of information in the context of law enforcement, for example. 

Right of access

The right of access, commonly known as subject access, allows you to establish what personal information we hold about you and to verify the lawfulness of the way in which process that information. Some exemptions apply.

There is no fee for making a request. However, we can charge a reasonable fee when a request is unfounded, excessive or repetitive. We will advise you first if we believe that this is the case.

We must respond to requests within one calendar month. However, where a request is of a complex nature and/or involves a high volume of data, we can extend this by a further two months. You will be advised if this is the case. Details of the application process can be found on our Access-to your personal information page.

You may also contact our Data Protection Officer (at the address provided at the start of this notice).

Right to rectification

It is important that the personal information that we hold is accurate and kept up to date. If you believe that your information is not accurate or up to date, you should contact the Data Protection Officer. We may not always be able to change or agree to remove the information, but we will correct factual inaccuracies and may include comments on the record to show that you disagree with what is recorded. 

Right to erasure (right to be forgotten)

If your personal information is no longer needed for the purpose for which it was originally collected or processed; if we have relied on your consent to process the information and you have withdrawn that consent; if there is no legal reason for us to use your information; or if deleting the information is a legal requirement you have the right to have it deleted.

This is not an absolute right and there will be circumstances when we cannot erase your personal information. These includes circumstances when there is a legal requirement to keep it; if it is used for freedom of expression: if it is necessary for legal claims; or if it is used for public health purposes.

Right to restrict processing

You have the right to ask us to restrict the use of your personal information. This applies where you have identified inaccurate information and you have told us about it; or where you believe we have no legal reason to use the information and want us to restrict further use (rather than erase) it.

Right to data portability

You are entitled to obtain and reuse your personal information for your own purposes across different services. It is likely that this right will not apply to most services that we offer.  If you think it does apply, you should contact the Data Protection Officer.

This right does not apply to personal information processed for law enforcement purposes.

Right to object

You have the right to object, on grounds relating to your particular situation, to the processing of your personal information in relation to the performance of a task carried out by us in the public interest, or to processing for the purposes of legitimate interests that we are pursuing.

We may continue to process such information if there are compelling and legitimate grounds for processing it which override your rights and freedoms or where the processing is to do with a legal claim.

Every objection will be considered on a case by case basis. This right does not apply to information processed for law enforcement purposes.

Rights related to automated decision making including profiling

Although we are unlikely to carry out any automated decision-taking that does not involve some human element, an individual has the right to require that we ensure that no decision that would significantly affect them is taken by us (or on our behalf) using automated decision-making software.

If you have concerns regarding automated decision making or profiling, please contact the Data Protection Officer.

How long do we keep personal information?

We keep personal information for as long as is necessary for the particular purpose or purposes for which it is held.

In respect of the Police National Computer (PNC), personal information is retained, reviewed and deleted in accordance with agreed national retention periods (which are subject to periodic change). Currently, information is retained on the PNC until the data subject is deemed to be 100 years of age.

Records containing personal information relating to intelligence, custody, crime, firearms, conviction history, child abuse investigations, and domestic violence will be retained in accordance with the Authorised Professional Practice (APP) for Management of Police Information. This can be found on the College of Policing website.

For all other records retention periods are set to meet business requirements. All retention periods are set out in the Force Record Retention Schedule, which can be found on our website:


We may monitor or record and retain telephone calls, texts, emails and other electronic communications (which we make or receive) in order to deter, prevent and detect inappropriate or criminal activity, to ensure security, and to assist the purposes described above.

Right to lodge a complaint with the Information Commissioner (ICO)

Any person has a right to lodge a complaint with the ICO if they believe that they are/have been adversely affected by the handling of personal information by us, or they believe that we are not processing personal information in accordance with the Data Protection Law.  Such requests should be made direct to the Information Commissioner:

Information Commissioners Office
Wycliffe House 
Water Lane 

Telephone: 0303 123 1113 (local rate) or 01625 545745 (national rate). Alternatively, you can visit the ICO website at:

As a general rule, if you have any concerns regarding the way we have handled your personal information (or any other related matter) you are encouraged to raise them with our Data Protection Officer in the first instance.  This will bring the matter to our attention, and gives us the opportunity to try and resolve the matter

Advice and guidance

For independent advice, guidance, updates and resources in relation to data protection matters, including the GDPR and the new Data Protection Act covering law enforcement, you can contact the ICO at:

Wycliffe House
Water Lane

Telephone: 0303 123 1113 (local rate) or 01625 545745 (national rate). Alternatively, you can visit the ICO website at:


This fair processing notice will be reviewed at regular intervals to reflect changes in the way that the Constabulary processes individual’s personal information. It will also be reviewed to reflect an emerging understanding of the legislation in practice and subsequent guidance issued by the ICO.

Page feedback
Was this page useful? *
What best describes the reason for your visit today?