ECB General Privacy Notice
The Enforcement Conduct Board (“ECB”, “we”, “us”, or “our”) is a data controller under the UK General Data Protection Regulation (UK GDPR). The ECB is committed to protecting your personal information and working in accordance with all relevant data protection legislation.
This statement explains how the ECB processes and uses the personal information we collect, use and store about you. If you have any questions or concerns, please contact us on contact@enforcementconductboard.org.
Who we are
The Enforcement Conduct Board is the independent oversight body for the debt enforcement sector in England and Wales. Our mission is to ensure that everyone experiencing enforcement action is treated fairly and protected from poor practice. Our company number is 13907897.
The type of personal information we collect
Personal information is any information that relates to an individual. It does not include information where the identity of the individual has been fully and effectively removed (anonymous data).
The personal information that we collect will depend on our relationship with you.
If you contact the ECB to make a complaint about an enforcement agent or enforcement firm: please see the specific notice [HYPERLINK] concerning the information you share with us at the end of this document.
Most of the personal information we process is provided to us directly by you. We currently collect and process the following information:
• If you are an enforcement agent or work at an enforcement firm that we oversee: names, contact details and any further personal information provided as part of your correspondence with us
• If you are part of the media or a journalist: names and contact details
• If you are a stakeholder with whom we work: names and contact details
• If you are a member of the public and you contact us, for example to make an enquiry or complaint: names, contact details and any further personal information provided as part of your correspondence with us
• If you subscribe to ECB online content and communications: names and contact details, as well as details about your contact preferences
• Job applicants: information provided in the application process and from third parties, such as references.
In some cases, we may also collect personal information about you from third parties:
• We are required to ensure that personal information we hold about you is as accurate as possible and therefore, we may update your details based on reliable publicly available sources. For example, we may update your address or business details.
• We use a wide variety of sources either directly or via internet search engines, some on a subscription basis, to augment, update and validate the data we hold. These include:
o Parliamentary and personal websites
o Representative bodies and trade associations
o Reliable news and press reports
o Companies House and other business-related websites
o Media subscription websites
• We receive information in connection with our handling of complaints about enforcement agents and enforcement firms, our oversight and monitoring of compliance by enforcement firms with our standards and our sanctions process to address non-compliance. This includes:
o Members of the public or other people who make a complaint
o Witnesses and others who provide us with information to enable us to deal with the complaint, including Body Worn Video footage
o Responses and representations concerning complaints from enforcement firms and enforcement agents
o Technical experts who we may approach to provide specialist insight or knowledge
o Other bodies with which we may liaise in connection with the complaint, for example
• Some information is provided to us through trusted third parties including:
o By enforcement firms: such as details of enforcement cases
o By research partners: personal information relating to enforcement agents and members of the public, including video footage, details of enforcement cases and research findings, processed for the purposes of research undertaken, for example, concerning compliance by enforcement firms with our standards.
o By debt advice organisations: anonymised case studies of enforcement
Sensitive personal information
Under data protection legislation, certain personal information is considered more ‘sensitive’ and therefore subject to extra protections (for example, information relating to race, religion, political affiliation and health). Similar protections apply to personal information relating to criminal offending.
We do not routinely collect sensitive personal information, but it may be provided to us in connection with complaints received concerning an enforcement agent or enforcement firm, our oversight and monitoring of compliance by enforcement firms with our standards and our sanctions process to address non-compliance.
We may also process sensitive personal information as part of our research, for example, our research partners may review footage from enforcement agents’ Body Worn Video cameras and research findings are shared with the ECB. Where processing sensitive data, such as Body Worn Video footage, for the purposes of research, we ensure we only process data insofar as it is necessary for the research and we will put in place appropriate measures with respect to the security and confidentiality of the material, including anonymising or pseudonymising information.
Body Worn Video footage may also be processed within the context of complaints, oversight and monitoring, including insofar as it is relevant to investigations concerning complaints or other non-compliance with our standards.
How do we use your personal information?
We may process your information for a number of different purposes, including:
• maintaining up to date business records
• research and statistical projects concerning our oversight and monitoring of compliance with our standards
• considering, investigating and adjudicating upon complaints, including our decision review process
• monitoring and oversight of compliance by enforcement firms with our standards and our sanctions process to address non-compliance, including our appeal process sending requests for levy payments
• sending you information you have requested, and relevant updates
• communicating with you, including responding to your enquiries and otherwise engaging with you about our work
• managing our employment relationships
• processing your job application
• complying with our legal and regulatory obligations
What are the lawful bases for processing your personal information?
We will only use personal information where the law allows us to (i.e. where we have a ‘lawful basis’). Most commonly, we will use your personal information in the following circumstances:
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. For example, we have a legitimate interest to ensure that we can effectively carry out our oversight role with respect to enforcement firms and enforcement agents and there is a wider public interest in ensuring that we are able to do this;
• Where it is necessary for the performance of a contract with you;
• Where it is necessary to comply with a legal obligation on us, for example, reporting to HM Revenue and Customs or Companies House, or in order to comply with a court order.
We do not routinely rely upon consent in the course of our activities overseeing the enforcement industry. In limited circumstances, we may ask for your consent to use your personal information for a specific purpose, for example, before we send you any email marketing, newsletters or other information about the ECB which we think might interest you.
You can unsubscribe from our email communications by following the instructions at the foot of any email that we send you, or you can withdraw your consent at any time by emailing us at contact@enforcementconductboard.org.
We will process ‘sensitive’ data and criminal offending information, including Body Worn Video footage, in the specific circumstances permitted by law, most commonly where processing is necessary:
• for the purposes of protecting the public from dishonesty, malpractice or seriously improper conduct
• for the prevention or detection of crime
• to safeguard children or other vulnerable adult
• with respect to legal claims and proceedings
• for the purposes archiving, research or statistical purposes.
How will we share your data?
We may share your personal information with third parties, including:
• with organisations and partners directly engaged in carrying out work with or for the ECB
• with contractors, suppliers or other third parties that provide services on our behalf (such as website host providers and cloud storage)
• as part of a sale, merger or acquisition, or other transfer of all of part of our assets including as part of a bankruptcy proceeding
• with our professional advisers, such as lawyers, accountants and auditors
• in very limited circumstances, with law enforcement agencies, for example, in connection with reports or investigations concerning criminal offences
• pursuant to a court order or other legal process or as otherwise required or requested by law, regulation, or government authority programmes, or to protect our rights or the rights or safety of third parties
• with your listed references as part of a job application process
We may share personal information in connection with our handling of complaints about enforcement agents and enforcement firms, our oversight and monitoring of compliance by enforcement firms with our standards and our sanctions process to address non-compliance. This includes with:
• Members of the public or complainants
• Witnesses and others who provide us with information
• Enforcement firms and enforcement agents
• Technical experts
We will never share your personal information with anyone to enable other organisations to send marketing to you or other individuals. The ECB does not sell personal information to third parties or allow third parties to sell on personal information that is shared.
International transfers of personal information
We do not routinely transfer personal information outside the UK. If we do so, we will take steps to ensure that your personal information is protected in accordance with appropriate legal requirements, including where the destination country is considered to have adequate data protection purposes, appropriate safeguards such as international transfer agreements have been put in place, or specific exceptions apply.
How do we protect your data?
We have appropriate technical and organisational security measures in place to protect your personal information. The ECB ensures that appropriate data sharing agreements and appropriate systems are in place prior to sharing your personal information with our service providers, research partners and other third parties.
Where we share any personal information, including sensitive data such as Body Worn Video footage, with third parties, we will put in place appropriate measures with respect to the security and confidentiality of the material, including anonymising or pseudonymising information.
How long do we retain your data?
We will not keep your personal information for longer than necessary, and the appropriate retention period will vary according to the intended purpose for which we collected the personal information. The criteria we use to determine the retention period of personal information are: (i) the respective statutory retention period; (ii) our contractual and/or business relationships with you; (iii) (potential) disputes; and (iv) any formal guidelines. After expiration of that period, the relevant may be retained if necessary for the fulfilment of a contract, the initiation of a contract or to protect or defend out position or that of a third party.
Your rights and preferences
Under UK GDPR, you have rights relating to your personal information. In particular, you have the right to:
• to request access to the personal information we hold about you;
• to request that we rectify or erase your personal information;
• to request that we restrict the processing of your personal information;
• to object to our processing of your personal information in certain circumstances;
• under certain circumstances, to ask us to port personal information about you that you have provided to us to you or to a third party; and
• where we previously obtained your consent, to withdraw consent to processing your personal information.
To exercise these rights, please contact us using the details set out in the “Contact us” section below. Please be aware that we may be unable to provide these rights to you under certain circumstances, for example, if we are legally prevented from doing so or can rely on exemptions.
Use of our website and other websites
Our website and materials may contain links to other websites. Please note that when you click on one of these links, you are entering another website for which we have no responsibility (even if you access the website via a link on our website). We encourage you to read the privacy notices or policies on all such websites.
Questions, concerns and contact
If you have any questions, or you are unhappy with how we have handled your personal information, please contact the ECB’s Data Protection Officer on contact@enforcementconductboard.org
You can also contact us by post at:
10 Queen Street Place
London
EC4R 1BE
In the event we are not able to suitably resolve any concerns you have, you may also contact the Information Commissioner’s Office.
The Information Commissioner
Wycliffe House, Water Lane Wilmslow, Cheshire SK9 5AF
Phone: 08456 30 60 60 Website: www.ico.gov.uk
Updates
This Policy will be kept under review and may be amended from time to time – for example, to take into account changes at the ECB or to reflect changes in regulation or legislation. Any changes will be updated on our website – please check back from time to time.
This policy was last updated on: December 2024
Privacy Notice: What happens to the information you give us during the complaints process
Where you have made a complaint to the ECB, this section of our privacy notice explains how we use and look after information about you, or that could identify you, specifically during our complaints process.
Please refer to our main privacy notice [link] for general information concerning the processing of your data, including our contact details. If you have any further queries, please email us at contact@enforcementconductboard.org.
What information do we collect about you?
When you first contact us, we will record your name, address, telephone number, email address and details of your complaint along with any other information you choose to tell us about yourself, or the person affected by the complaint. We will collect further information from you in the course of considering, investigating and adjudicating upon your complaint.
If you contact us by telephone, we may create an audio recording of the call we have with you and retain a copy of this. You will be told if the call is audio recorded, and you will be able to request a copy of the recording.
Why we collect this information
We consider complaints about enforcement agents and enforcement firms where you believe they have not acted properly or fairly or have provided a poor service. So that we can do this we need to collect and use information about you and your complaint.
Sharing your information when you first contact us
We will treat your information considerately and confidentially. However, we will need to share some information about your complaint with the firm and agent you have complained about.
If you do not want us to share the information you have given us with the firm or agent you have complained about, please tell us straight away. Please be aware, however, that this is likely to limit our ability to investigate your complaint.
Why we share your information
We may talk to the firm and agent that you have complained about so we can learn more about what happened and how they responded to your complaint to them. As you will have had to complain first to the enforcement firm, we will want to understand the history of your complaint which will help us decide how to handle your complaint. We may also share information with witnesses or others who have provided with us information in order to conduct an appropriate investigation into your complaint.
Sharing your information if we do not investigate your complaint
Sometimes we can help to put things right without an investigation. There might be other reasons why we cannot help you further with your complaint. If so, we will write to you explaining why we are not investigating your complaint.
We may send details of this final letter to the firm you complained about. This is to help them learn from the complaint and to consider if they need to do things differently or better.
Sharing your information so we can investigate your complaint
If we decide to investigate your complaint, we must tell the firm and the agent complained about. We will need to share your name and the details of your complaint and any documents or information which you provide us. We may also liaise with legal representatives of the firm and the agent.
At the same time, we will usually ask the firm for more information (including relevant papers, computer records and Body Worn Video footage).
We can also ask for information from anyone who we think can help us with your investigation. We might ask for advice about your complaint from someone with specialist knowledge (for example a technical expert in High Court Enforcement) or it could be someone who can tell us more about what happened and the impact it had on you (such as a relative, employer or social worker).
Sharing provisional decisions and final decisions on an investigation
Towards the end of our investigation, we will send you and the firm, and any agent complained about, a copy of our provisional decision. This gives you both a chance to comment on our draft findings.
Our provisional decision is confidential. It will contain all the information from you and others that we have contacted. You and the firm may share the provisional decision with people who can help you comment on its accuracy and content (for example, a family member or professional adviser), but you and the firm complained about must not make the contents public.
After we receive comments on the provisional decision, we may send a final decision, summary or part of the decision to you, along with the firm and agent complained about. The final decision sent to the firm will be suitably drafted to exclude any unnecessary personal or sensitive data.
Once you and the firm have received the final decision, you should be aware that it contains personal information of you and others, along with potentially sensitive information. You should handle it with care.
If we think that your complaint provides insight into how services or organisations can improve or is in the public interest, we may share anonymised or summarised information from the process with other appropriate organisations that may benefit from what has been learned.
Unless we decide to publish the decision, we will not normally discuss its contents with anyone other than those involved in the investigation.
Our investigations resolve complaints on an individual basis, but they also provide an overview of issues other organisations can learn from. We share this learning by preparing reports about particular subjects and publish them on our website. Other than in exceptional circumstances, we always remove any information that identifies you.
Using your information for surveys, training and monitoring purposes
We want to make sure we provide a good service, so we may use your complaint for training, monitoring and evaluation purposes or invite you to meetings where we explain more about the ECB’s roles and responsibilities, and ask for your feedback. We will only share any information you provide with our staff or people acting on our behalf.
If you do not want to take part, please tell your caseworker. Any feedback can also be anonymised on request.
How long will we keep your information?
We will keep the information about you and your complaint for six years after making our final decision, including at the conclusion of any decision review process. This is whether we investigate your case or not. At that point, we will delete most of your information except the following, which we keep for as long as it is necessary to retain them for their specific purpose:
• the final decision as a record of the resolution of the complaint;
• complaints subject to ongoing legal proceedings;
• so we have a record of complaints made, enough information to be able to identify you if you re-open your complaint or make a further complaint. This includes your name, your address, the name of the firm you complained about, what you complained about, and the outcome. This is so we do not answer the same complaint twice (held for a maximum of six years).
How we can process your information
The UK GDPR requires us to have a lawful basis to process your personal data. This is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to carry out our work.
Please see the General Privacy notice for further information.