Suspicious Email Reporting Service (SERS)
The Department of Home Affairs (DHA) (‘the controller), through the Office of Cyber Security & Information Assurance (OCSIA), is offering a Suspicious Email Reporting Service (SERS). The SERS will allow Isle of Man residents and businesses to forward any emails they consider to be suspicious to SERS@OCSIA.IM where they will be reviewed and form part of the intelligence used by the UK’s National Cyber Security Centre (NCSC) and National Crime Agency (NCA) to disrupt criminal activity.
How and why we process your personal information
We collect and process information, including personal information, to provide an effective and efficient service;
- To allow suspicious emails to be reported
- Protecting Isle of Man residents and businesses from potential criminal activity
- To support the NCSC and the NCA in their attempts to disrupt criminal activity
We use your personal data in line with the rules set out in the Data Protection (Application of GDPR) Order 2018 and the related implementing regulations for the following reasons:
- To allow this office to communicate with you
- Identify the sources of suspicious emails
- Work with partner agencies, NCSC/NCA to disrupt criminal activity
- Assist law enforcement agencies
- Monitor and improve our service
- Conduct research/collate statistics for publication and/or for the purposes of policy formulation
Our legal basis for processing your information
As reporting to SERS is voluntary, our legal basis for processing your personal information is based on your consent for us to do so.
You may withdraw your consent at any time by contacting the Office of Cyber-Security & Information Assurance (OCSIA) by email ocsia@gov.im or telephone +44 1624 685557
Types of personal information we collect about you
Depending on how you interact with us, we may process different information about you. There is no requirement to provide us with any personal information.
By virtue of this service, we will record your email address, however, further personal information may be included in the contents of the suspicious email submission. This may include:
| Category of information | Examples |
|---|---|
| Personal details | Name, email address, telephone number, address |
| Personal identification information | Date of birth, nationality, gender |
| Other information | Partial bank details |
Information we collect automatically
Information about you may be recorded automatically by the email system such as your IP address.
How long do we keep your personal information?
We will only keep your information for the minimum time necessary to process your suspicious email submission.
Where further investigation is required we will only keep your personal information for as long as it is required to complete the investigation.
Where possible, your personal information will be redacted and deleted from any communication received. This includes cases where further investigation is required.
How we keep your personal information secure
The security and confidentiality of your information is very important to us.
We will ensure that:
- Safeguards are in place to make sure your personal information is kept securely.
- Only authorised staff are able to view your information.
- Assurances are acquired from the service provider storing your information is in line with the ISO 27001 standard.
- We comply with the requirements of the Information Commissioner.
Who we share personal data with
Your suspicious email submission will be shared with the UK National Cyber Security Centre (NCSC).
Where legally obliged to do so, your personal information will be shared with law enforcement for the purposes of the prevention and detection of crime.
Will this privacy notice change?
This Privacy Notice may change. We will not reduce your rights under this Privacy Notice without your consent if we still hold your data. If any significant change is made to this Privacy Notice we will provide a prominent notice on the following webpage, www.gov.im/sers so that you can review the updated Privacy Notice.
