Privacy policy

Privacy Policy

The Enforcement Conduct Board (“ECB”, “we”, “us”, or “our”) is a data controller under the UK General Data Protection Regulation (GDPR). The ECB is committed to protecting your personal information and working in accordance with all relevant data protection legislation.

This statement explains how the ECB processes and uses the personal information we collect, use and store about you in various contexts as well as how you can let us know if you would like us to change how we manage that information.

Who we are
The Enforcement Conduct Board is the independent oversight body for the debt enforcement sector in England and Wales. Our mission is to ensure that everyone experiencing enforcement action is treated fairly and protected from poor practice. Our company number is 13907897.

The type of personal information we collect
Personal information is any information that relates to an individual. It does not include information where the identity of the individual has been fully and effectively removed (anonymous data).

The personal information that we collect will depend on our relationship with you.

Most of the personal information we process is provided to us directly by you. We currently collect and process the following information:

If you work at an enforcement firm that we oversee: names and contact details
If you are part of the media or a journalist: names and contact details
If you are a stakeholders with whom we work: names and contact details
If you are a member of the public and you contact us, for example to make an enquiry: names, contact details and any further personal information provided as part of your correspondence with us
If you subscribe to ECB online content and communications: names and contact details, as well as details about your contact preferences
Staff and Board members: HR related information
Job applicants: information provided in the application and from third parties in the form of references.

In some cases, we may also collect personal information about you from third parties, including as follows:

We are required to ensure that personal information we hold about you is as accurate as possible and therefore, we may update your details based on reliable publicly available sources. For example, we may update your address or business details.
We use a wide variety of sources either directly or via internet search engines, some on a subscription basis to augment, update and validate the data we hold. These include:
- Parliamentary and personal websites
- Representative bodies
- Reliable news and press reports
- Companies House and other business-related websites
- Media subscription websites
Some information is provided to us through trusted third parties including:
By enforcement firms: details of enforcement cases
By research partners (if carrying out research): anonymised findings following research, which may include the review and anonymisation by our research partners of personal information relating to enforcement agents and members of the public that are subject to enforcement action, including video footage and details of enforcement cases
By debt advice organisations: anonymised case studies of enforcement

Sensitive personal information

Under data protection legislation, certain personal information is considered more ‘sensitive’ and therefore subject to extra protections (e.g., information relating to race, religion, political affiliation and health). Similar protections apply to personal information relating to criminal convictions.

We do not typically collect sensitive personal information, but may process this information as part of our research, as part of which our research partners may review footage from enforcement agents’ Body Worn Video cameras that is held by the enforcement firms we oversee. However, note that the ECB does not typically directly see or store this personal information – it is usually provided to us in anonymised form (except in very limited cases of gross misconduct or criminal activity that needs further action).

How do we use your data?
We may process your information for a number of different purposes, including:

to send you ECB-related information. Communications are usually by email but we will consider alternative forms of communication on request
keeping business records
ensuring that we have up to date records
research and statistical projects
considering and adjudicating on complaints
sending requests for levy payments
sending you information you have requested
sending you relevant updates
responding to your enquiries
engaging with you about our work
managing our employment relationships
processing your job application

What are our lawful bases?
We will only use personal information where the law allows us to (i.e. where we have a ‘lawful basis’). Most commonly, we will use your personal information in the following circumstances:

Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. For example, we have a legitimate interest to ensure that we can effectively carry out our role in holding enforcement firms and agents to account (and there is a wider public interest in ensuring that we are able to do this so that enforcement agents do not abuse their powers when carrying out enforcement actions);
Where it is necessary for the performance of a contract with you;
Where it is necessary to comply with a legal obligation on us (for example, reporting to HM Revenue and Customs or Companies House).

In some circumstances, we may ask for your consent to use your personal information for a specific purpose. In particular, we may obtain your consent before we send you any email marketing, newsletters or other information about the ECB which we think might interest you. You can unsubscribe from our email communications by following the instructions in any email that we send you, or you can withdraw your consent at any time by emailing us at contactus@enforcementconductboard.org.

When carrying out research, we may process data that is regarded as ‘special category’ data and criminal convictions data, both of enforcement agents and members of the public who are e.g. captured in footage taken by body worn video footage.

The ECB relies on the following conditions to process such data:

Research (paragraph 4 Schedule 1 Data Protection Act 2018) – In some cases, the processing is necessary for us to carry out scientific or historical research or statistical purposes and is in the public interest.
Protecting the public (paragraph 11 Schedule 1 Data Protection Act 2018) – we may process special category/criminal convictions data where this is necessary to protect the public against dishonesty, malpractice or other seriously improper conduct.

How long do we retain your data?
We will not keep your personal information for longer than necessary, and the appropriate retention period will vary according to the intended purpose for which we collected the personal information. The criteria we use to determine the retention period of personal information are: (i) the respective statutory retention period; (ii) our contractual and/or business relationships with you; (iii) (potential) disputes; and (iv) any guidelines issued by relevant regulators. After expiration of that period, the relevant information is routinely deleted, as long as it is no longer necessary for the fulfilment of a contract, the initiation of a contract or to protect or defend out position or that of a third party.

How will we share your data?
We may share your personal information with third parties:

with organisations and partners directly engaged in carrying out work with or for the ECB
with contractors, suppliers or other third parties that provide services on our behalf (such as website host providers)
as part of a sale, merger or acquisition, or other transfer of all of part of our assets including as part of a bankruptcy proceeding;
pursuant to a subpoena, court order or other legal process or as otherwise required or requested by law, regulation, or government authority programmes, or to protect our rights or the rights or safety of third parties;
with our professional advisers, lawyers, accountants and auditors;
in very limited circumstances, with law enforcement agencies, if we feel that we need to report a criminal offence.

We will never share your personal information with anyone to enable other organisations to send marketing to you or other individuals. The ECB does not sell personal information to third parties or allow third parties to sell on personal information that is shared.

Where personal information is processed for research purposes, any data shared outside of the ECB (for example, in a report) is anonymised or pseudonymised unless you explicitly give us permission otherwise.

We do not currently transfer personal information we hold to a country outside the UK. If we do so, we will take steps to ensure that your personal information if protected in accordance with appropriate safeguards, especially where the recipient country is not considered to be adequate for data protection purposes under UK law. In particular, we will rely on the appropriate safeguards under data protection legislation, such as standard contractual clauses approved by the UK Government to protect your personal information.

How do we protect your data?
Your data is held securely on the ECB’s IT system.

The database is accessible to a limited number of ECB staff and directly engaged consultants who need to access it to perform their roles. The ECB ensures that appropriate data sharing agreements and proper systems are in place prior to sharing your personal information with any partners. Where we have any personal information or special category data reviewed or otherwise processed by our research partners, this will be anonymised or pseudonymised meaning it will be unidentifiable to any other individuals. While we seek to use appropriate organisational, technical and administrative measures to protect personal information within our organisation, unfortunately no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contact us” section below.

Your rights and preferences Under certain data protection legislation, you have rights relating to your personal information. In particular, you have the right to:

to request access to the personal information we hold about you;
to request that we rectify or erase your personal information;
to request that we restrict the processing of your personal information;
to object to our processing of your personal information in certain circumstances;
under certain circumstances, to ask us to port personal information about you that you have provided to us to you or to a third party; and
where we previously obtained your consent, to withdraw consent to processing your personal information.

To exercise these rights, please contact us using the details set out in the “Contact us” section below. Please be aware that we may be unable to provide these rights to you under certain circumstances, for example, if we are legally prevented from doing so or can rely on exemptions.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office at www.ico.org.uk/make-a-complaint.

Other websites
Our website and materials may contain links to other websites. Please note that when you click on one of these links, you are entering another website for which we have no responsibility (even if you access the website via a link on our website). We encourage you to read the privacy notices or policies on all such websites.

Updates
This Policy will be kept under review and may be amended from time to time – for example, to take into account changes at the ECB or to reflect changes in regulation or legislation. Any changes will be updated on our website – please check back from time to time. We will also use reasonable efforts to communicate any significant changes to you as appropriate.

Contact us
The ECB’s Chief Executive is responsible for monitoring compliance with relevant legislation in relation to personal information and can be contacted at contactus@enforcementconductboard.org  

You can also contact us by post at:
10 Queen Street Place

London

EC4R 1BE

This policy was last updated on: March 2024