Privacy Notice - Passport, Immigration and Nationality Office

The information you provide to the Passport, Immigration and Nationality Office in relation to a passport application is used to:

• make a decision on your passport application
• help prevent and detect crime
• provide statistical analysis
• to assist with the training of Passport Officers

Sharing your information

The power to issue Isle of Man variant British passports is derived from the Royal Prerogative. The Passport Office has an obligation to check and verify the information you provide in your application. This may include checks of publicly available information but in some cases, where it is necessary and relevant, information you provide may be shared with third parties. This will only be done where there is an obligation to do so in accordance with Her Majesty's Passport Office policy.

We will do this to allow us to:

• process and make a decision on your application
• verify the information and documentation you have provided is correct
• help prevent and detect crime (for example fraud, immigration offences)

Third parties include, for example:

• UK Home Office
• law enforcement agencies
• fraud prevention agencies
• the countersignatory you named on your application
• people linked to your passport application e.g. your partner/family
• people who can verify the information in your application

 Information shared with third parties may not be used for any other purpose.

Protecting your information

The Isle of Man Passport Office will:

• keep your information safe and secure in line with our retention periods
• only share your information as detailed above
• only ask for what is needed

Your information will not be used for any purpose that is not connected to your passport application.

Get more details on data protection for individuals including how to request your information or how to complain about how your data has been handled.

Retention Periods

Introduction

Personal information supplied or collected for the purposes of entering or leaving the UK/Isle of Man, securing the border, making an application for a visa, settlement, or other immigration service, claiming asylum or other form of protection, or gathered as part of the process of securing the border or enforcing immigration laws will be held and processed by the Cabinet Office, a Department of the Isle of Man Government, Government Office, Bucks Road, Douglas, Isle of Man, IM1 3PN. The Cabinet Office is the controller for this information. This includes when the information is collected or processed by third parties on our behalf.

Data protection law in the Isle of Man changed on 1 August 2018. This notice reflects your rights under the new laws and lets you know how we will look after and use your personal information. This includes what you tell us about yourself, what we learn about you as you engage with us and what others share with us to fulfil their legal obligations or help prevent abuse of the immigration system and/or prevent and detect crime. It also covers what information we may share with other organisations. This information will be held on our immigration casework system.

The Cabinet Office has appointed a Data Protection Officer (DPO) to help ensure that we fulfil our legal obligations when processing personal information.

The DPO can be contacted by emailing DPO-CabOff@gov.im  

How we protect your personal information

We have a duty to safeguard and ensure the security of your personal information. We do that by having systems and policies in place to limit access to your information and prevent unauthorised disclosure. Staff who access personal information have appropriate security clearance, a business need for accessing the information and their activity is subject to audit and review.

How we gather and use your personal information

The Cabinet Office collects and processes personal information to fulfil its legal and statutory functions. We only use, gather and share personal information where we have an appropriate legal basis to do so under the Annex to the Data Protection (Application of the GDPR) Order 2018 (SD 2018/0143) ('Applied GDPR').

The legal basis for the processing of your data will be Article 6(1)(c) or Article 6(1)(e) of the Applied GDPR – namely that processing is necessary for compliance with a legal obligation to which the controller is subject or that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller and where the official functions are underpinned by common law or statute.

The statutory obligations to be followed in relation to immigration functions are set out in the legislation page of  the Immigration's website. 

The Immigration (Isle of Man) (Amendment) Order 2019 (SI 2019 No. 562) extended sections 20 and 21 of the Immigration and Asylum Act 1999 (1999 c. 33) and provides a statutory basis for the Minister in respect of immigration purposes to supply information to and receive information from, a public authority, the Secretary of State as well as, but not limited to:

• the Chief Constable, for police purposes
• the Attorney General for use in connection with his prosecution functions
• the Financial Intelligence Unit
• the Treasury or the Collector of Customs and Excise for customs purposes
• The Governor for nationality purposes

On occasion, for example in considering asylum claims and verifying your identity, we may also process special categories of personal data. In this case we would ensure that our processing was lawful under Article 9 of the Applied GDPR for example, on the basis of Article 9(2)(g) where the processing is necessary for reasons of substantial public interest. This may include information about political beliefs, sexual orientation, religious beliefs and biometrics.

We may also process personal data under the Data Protection (Application of the LED) Order 2018 (SD2018/0144) as applied to the Isle of Man for the purposes of prevention, detection, investigation or prosecution of crime.

Examples of ways in which we may gather your personal information include when:

• You travel to the Isle of Man
• You enter the Common Travel Area by crossing the UK border e.g. an airport
• You make an application or claim (via United Kingdom Visas & Immigration (UKVI), on paper or in person to this office)
• You attend an interview
• We seek to verify your information, documents or identity
• You supply biometric information (for example, fingerprints or a facial photograph)
• We receive information from a sponsor or other third party in relation to your application
• We receive allegations or intelligence from law enforcement agencies and others involved in preventing crime and fraud
• We are notified of a relevant criminal conviction

We may also request information from third parties. For example, this might be for the purposes of verifying information you supplied in support of an application, obtaining information needed for a safeguarding purpose, obtaining new address details of people we are trying to trace, or undertaking other enforcement actions.

This may involve, for example:

• Contacting your sponsor or linked applicant
• Obtaining information from other government departments both on and off the Island– these may include, but are not restricted to the Cabinet Office, Secretary of State for the UK Home Office, The Treasury, The Department of Health and Social Care, The Department for Enterprise, The Isle of Man Constabulary
• Obtaining information from, fraud prevention agencies and local authorities
• Seeking to verify documents, information, or identity in relation to your application. This may include private and public authorities in other countries
• Local authority services (for example, social services)

The main ways we process personal information are given in the table below.

Please note: we will not share any of your information with authorities in your country of origin if this would put you or your family at risk

Automated decision-making and profiling

Article 22 of the Applied GDPR provides the right not to be subject to a decision made solely on the basis of automated processing which produces legal or other significant effects. Parts of our processing may involve degrees of automation, but complex or adverse decisions will always be taken by a trained officer or caseworker.

We may use personal information, for example from previous applicants, to develop tools that allow us to assess and then process applications in a particular way. This helps us to target our resources and ensure our processing is efficient, allowing us to minimise costs while protecting the public effectively. However, a case officer would still decide these cases. Any profiling must comply with our wider obligations under equality legislation.

Data transfers outside of the European Economic Area

We may transfer personal information to authorities or organisations in countries outside the European Economic Area via UKVI When we do, this will be for specific purposes. These may include, for example, validating aspects of your application, preventing or detecting crime, including fraud, supporting returns or helping to identify or prevent those seeking to enter or remain in the UK who may not comply with the conditions attached to their leave to enter or remain. When we do this, we seek to take appropriate steps to safeguard your information, for example by agreeing the method and purpose of sharing by way of written Agreements. We may rely on the derogations in Article 49(1) of the Applied GDPR where necessary.

Contacting you using your personal information

Beyond the normal processing of your application, we may use your personal information (for example, email address and mobile number) to send you prompts. For example, to remind you when your grant of leave is coming to an end or when documents are ready for collection. In addition, we may use your details to seek feedback on the handling of your application to help us improve our services.

How long do we keep your personal information?

We will keep your personal information for as long as it is necessary for permitted purposes. In the Immigration Casework System we maintain a long-term record of immigration history and immigration offending to support future decision-making and enforce penalties. Personal data will typically be retained for 25 years after a decision to grant settlement and for 15 years after the last action in other cases. Information on Foreign National Offenders may be retained until the death of the data subject. At the border, passenger name records data is retained for 5 years. Arrest and detention records may be held for 6 years. We continue to keep retention periods under review to ensure they meet our role of securing the Isle of Man and Common Travel Area border and ensuring we can support those who are seeking to enter or remain in the Isle of Man.

How to get a copy of your personal information

Under the Applied GDPR at Article 15 you have a right of access to your personal data and to check the accuracy of that data by making a Subject Access Request.

A subject access request is made by contacting the Cabinet Office Data Protection Officer (DPO) as follows:

In writing to:

DPO
Cabinet Office,
Government Office,
Buck's Road,
Douglas,
Isle of Man,
IM1 3PN.

By Email: DPO-CabOff@gov.im
By telephone: +44 1624 686779

Subject access requests must be responded to promptly and in any event within a maximum of 1 month.

Under the GDPR you also have the right to object to and ask to restrict our use of your personal information, and to ask us to rectify or delete your personal information. However, there may be a number of legal or other official reasons why we need to continue to keep or use your data. If you want to exercise these rights please write to us at the following address: DPO, Cabinet Office, Government Office, Buck's Road, Douglas, Isle of Man, IM1 3PN.

How to complain

The Information Commissioner is the independent authority responsible for upholding the public's information rights and promoting and enforcing compliance with the Island's information rights legislation. You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Isle of Man’s data protection legislation.

You also have the right to complain to the Information Commissioner’s Office about the way we handle your information or respond to your requests for access to your personal information or the exercise of your other rights under the Applied GDPR or any of the other data protection legislation in force on the Isle of Man.

Further information can be found on the Information Commissioner's website.  

Introduction

Personal information supplied or collected for the purposes of becoming a British citizen will be held and processed by the Cabinet Office, a Department of the Isle of Man Government, Government Office, Bucks Road, Douglas, Isle of Man, IM1 3PN. The Lieutenant Governor is the controller of this information. This includes when the information is collected or processed by third parties on behalf of the Lieutenant Governor.

Data protection law in the Isle of Man changed on 1 August 2018. This notice reflects your rights under the new laws and lets you know how we will look after and use your personal information. This includes what you tell us about yourself, what we learn about you as you engage with us and what others share with us to fulfil their legal obligations or help prevent abuse and detect crime. It also covers what information we may share with other organisations. This information will be held on our nationality casework system.

The Cabinet Office has appointed a Data Protection Officer (DPO) to help ensure that we fulfil our legal obligations when processing personal information.

The DPO can be contacted by emailing DPO-CabOff@gov.im  

How we protect your personal information

We have a duty to safeguard and ensure the security of your personal information. We do that by having systems and policies in place to limit access to your information and prevent unauthorised disclosure. Staff who access personal information have appropriate security clearance, a business need for accessing the information and their activity is subject to audit and review.

How we gather and use your personal information

The Cabinet Office collects and processes personal information to fulfil its legal and statutory functions. We only use, gather and share personal information where we have an appropriate legal basis to do so under the Annex to the Data Protection (Application of the GDPR) Order 2018 (SD 2018/0143) ('Applied GDPR').

The legal basis for the processing of your data will be Article 6(1)(c) or Article 6(1)(e) of the Applied GDPR – namely that processing is necessary for compliance with a legal obligation to which the controller is subject or that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller and where the official functions are underpinned by common law or statute.

The British Nationality Act 1981 sets out the statutory obligations to be followed in relation to naturalisation or registration as a British citizen.  

The Immigration (Isle of Man) (Amendment) Order 2019 (SI 2019 No. 562) extended sections 20 and 21 of the Immigration and Asylum Act 1999 (1999 c. 33) and provides a statutory basis for the Governor in respect of nationality purposes, to supply information to and receive information from, a public authority, the Secretary of State as well as, but not limited to:

• the Chief Constable, for police purposes
• the Attorney General for use in connection with his prosecution functions
• the Financial Intelligence Unit
• the Treasury or the Collector of Customs and Excise for customs purposes
• The Minister for immigration purposes

On occasion, for example when verifying your identity, we may also process special categories of personal data. In this case we would ensure that our processing was lawful under Article 9 of the Applied GDPR for example, on the basis of Article 9(2)(g) where the processing is necessary for reasons of substantial public interest. This may include information about political beliefs, sexual orientation, religious beliefs and biometrics.

We may also process personal data under the Data Protection (Application of the LED) Order 2018 (SD2018/0144), as applied to the Isle of Man for the purposes of prevention, detection, investigation or prosecution of crime.

Examples of ways in which we may gather your personal information include when:

• You enter the Common Travel Area by crossing the UK border e.g. an airport
• You make an application (via United Kingdom Visas & Immigration (UKVI), on paper or in person to this office)
• You attend an interview
• We seek to verify your information, documents or identity
• You supply biometric information (for example, fingerprints or a facial photograph)
• We receive information from a third party in relation to your application
• We receive allegations or intelligence from law enforcement agencies and others involved in preventing abuse, crime and fraud
• We are notified of a relevant criminal conviction

We may also request information from third parties. For example, this might be for the purposes of verifying information you supplied in support of an application, obtaining information needed for a safeguarding purpose, obtaining new address details of people we are trying to trace, or undertaking other enforcement actions. This may involve, for example:

• Contacting any linked applicant
• Obtaining information from other government departments both on and off the Island – these may include, but are not restricted to the Cabinet Office, The Secretary of State for the UK Home Office, The Treasury, The Department of Health and Social Care, The Department for Enterprise, The Isle of Man Constabulary
• Seeking to verify documents, information, or identity in relation to your application. This may include private and public authorities in other countries
• Local authority services

The main ways we process personal information are given in the table below.

Please note: we will not share any of your information with authorities in your country of origin if this would put you or your family at risk

Automated decision-making and profiling

Article 22 of the Applied GDPR provides the right not to be subject to a decision made solely on the basis of automated processing which produces legal or other significant effects. Parts of our processing may involve degrees of automation, but complex or adverse decisions will always be taken by a trained officer or caseworker.

We may use personal information, for example from previous applicants, to develop tools that allow us to assess and then process applications in a particular way. This helps us to target our resources and ensure our processing is efficient, allowing us to minimise costs while protecting the public effectively. However, a case officer would still decide these cases. Any profiling must comply with our wider obligations under equality legislation.

Data transfers outside of the European Economic Area

We may transfer personal information to authorities or organisations in countries outside the European Economic Area, via UKVI. When we do, this will be for specific purposes. These may include, for example, validating aspects of your application, preventing or detecting crime, including fraud, supporting returns or helping to identify or prevent those seeking to enter or remain in the UK who may not comply with the conditions attached to their leave to enter or remain. When we do this, we seek to take appropriate steps to safeguard your information, for example by agreeing the method and purpose of sharing by way of written Agreements. We may rely on the derogations in Article 49(1) of the Applied GDPR where necessary.

Contacting you using your personal information

Beyond the normal processing of your application, we may use your personal information (for example, email address and mobile number) to send you prompts. For example, to inform you of any changes that will affect the processing of your application or when documents are ready for collection. In addition, we may use your details to seek feedback on the handling of your application to help us improve our services.

How long do we keep your personal information?

We will keep your personal information for as long as it is necessary for permitted purposes. Personal data will typically be retained for 25 years after a decision to grant citizenship and for 15 years after the last action in other cases. We continue to keep retention periods under review.

How to get a copy of your personal information

Under the Applied GDPR at Article 15 you have a right of access to your personal data and to check the accuracy of that data by making a Subject Access Request.

A subject access request is made by contacting the Cabinet Office Data Protection Officer (DPO) as follows:

In writing to:
DPO,
Cabinet Office,
Government Office,
Buck's Road,
Douglas,
Isle of Man,
IM1 3PN

By Email:  DPO-CabOff@gov.im
By telephone: +44 1624 686779

Subject access requests must be responded to promptly and in any event within a maximum of 1 month.

Under the GDPR you also have the right to object to and ask to restrict our use of your personal information, and to ask us to rectify or delete your personal information. However, there may be a number of legal or other official reasons why we need to continue to keep or use your data. If you want to exercise these rights please write to us at the following address: DPO, Cabinet Office, Government Office, Buck's Road, Douglas, Isle of Man, IM1 3PN.

How to complain

The Information Commissioner is the independent authority responsible for upholding the public's information rights and promoting and enforcing compliance with the Island's information rights legislation. You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Isle of Man’s data protection legislation.

You also have the right to complain to the Information Commissioner’s Office about the way we handle your information or respond to your requests for access to your personal information or the exercise of your other rights under the Applied GDPR or any of the other data protection legislation in force on the Isle of Man.

Further information can be found on the Information Commissioner's website.