Privacy Notice

The Isle of Man Government, through the Treasury (‘the controller’), is offering a Loan Guarantee Arrangement (‘the Arrangement’) as part of a number of financial measures that are being put in place in order to provide financial assistance to local individuals and businesses that have been affected by the COVID-19 pandemic.

1. The Data Protection Law

The controller acknowledges its obligations pursuant to the Data Protection (Application of GDPR) Order 2018 and the GDPR and LED Implementing Regulations 2018 (‘the Data Protection Law’) which provides a number of requirements in terms of processing activities involving personal data.  The controller further acknowledges the general principles of processing as well as the rights of a data subject, which are contained in the Data Protection Law, at Articles 5 to 22 of the Data Protection (Application of GDPR) Order 2018 in the Annex.

2. Information to be given to Data Subjects

The Data Protection Law outlines the information that must be given to data subjects before or at the time the personal data is collected from the data subject.  This information can be summarised as follows:

The identity and contact details of the controller and data protection team

See the details in section 3 of this notice

Whether any of the personal data is special category data

None of the personal data collected by the controller for the Arrangement constitutes special category data, as defined by the Data Protection Law.

The source of the personal data

None of the personal data processed for the purpose of the Arrangement has been collected from a publically available source.  All of the personal data has been collected directly from the respective lenders (banks and other lending companies) or their professional advisors which collected the personal data directly from the individual(s) requesting financial support via the Arrangement.

The purposes and the legal basis of the processing

The personal data collected for the purposes of the Arrangement is:

• the full name of the applicant and in the case of a body corporate this will include the directors and other significant living individuals who control the applicant’s business
• accompanying financial information including the amount of new loan or overdraft under the Arrangement and the purposes for which it is to be used
• Whether the applicant has previously applied for a loan or overdraft and any information as to why it was refused or approved
• the amount of existing borrowing facilities and current sums advanced or committed
• repayment term of loan (length of period)
• details of any security taken against the new borrowing
• confirmation that the payments on existing borrowings are up to date, or details of any arrears, any holiday period that has been granted and any revised terms during the life of the loan.

The controller may also hold and process personal data belonging to employees of:

• Applicants and their professional advisors
• Lenders and their professional advisors

The lending companies will process applications received from customers, including determining whether the application is eligible for the Arrangement, and will make a decision whether to approve or decline the application.  There may be an automated process for some of the Arrangement which is operated by the lending company, and the applicant will need to review the lending company’s privacy statement to find out if any decisions are subject to automated decision making. 

The lending companies will then provide details of the customer applications, both approved and declined, in order that the controller can monitor and calculate their exposure and therefore future liability under the Arrangement.  Once an application has been approved, the controller will then process the personal data in order to give effect to the support offered by the Arrangement.

The lawful basis for the processing by the controller is that processing is necessary for the exercise of performance by a public authority of a function that is of a public nature, or a task carried out in the public interest (contained in Article 6(e) of the Data Protection (Application of GDPR) Order 2018)).  In provision of the Arrangement, the controller intends to provide for financial assistance in the exceptional circumstances of the COVID-19 pandemic, using powers in the Financial Provisions and Currency Act 2011.

Where the lawfulness of processing is based on the processing being necessary for the legitimate interests of the controller or a third party, the legitimate interests concerned

The controller is not relying on “legitimate interest” as a lawful basis for processing.

The recipients or categories of recipients of the personal data, if any

The personal data may be disclosed to:

• Other Departments, Boards or Offices of the Isle of Man Government; and/or
• Professional advisors of the Isle of Man Government;
• Banks and other financial institutions engaged by the Isle of Man Government in relation to the Arrangement

Personal data transferred to an authorised or an unauthorised jurisdiction

Personal data may be transferred to the following jurisdictions under the Arrangement: 

• Jersey,
• Guernsey,
• United Kingdom. 

Although Isle of Man branches of a bank may administer the application process, certain levels of approvals are often sought, or advice in other jurisdictions from ‘group’ arrangements such that branches in the Isle of Man will locally administer but may transfer data outside of the Isle of Man.

The period for which the personal data is expected to be stored

The personal data will be stored by the controller 6 years following the date of the loan being repaid by the applicant under the Arrangement or written off by the controller.  Full privacy information, including the retention schedule for documents held by the controller which can be found here.

The data subject rights under the Data Protection Law

For more information in relation to the data subject rights:

• Visit the controller’s privacy notice
  
• Contact the Data Protection Officer for the controller by e-mail
• Find an explanation of data protection law, and privacy information for other organisations within the Isle of Man Government; or
• Visit the website for the office of the Isle of Man Information Commissioner.
• Review the Data Protection Law:
  • Data Protection (Application of GDPR) Order 2018 (see Articles 5-22 of the Annex to the Order)
  • GDPR and LED Implementing Regulations 2018

Where the lawfulness of processing is based on consent, the existence of the right to withdraw consent at any time

When applying for financial support under the Arrangement, individuals provide their consent to processing until such a time as their application is approved by the controller.  Individuals can withdraw their consent at any time and their application will be withdrawn.  Once an application has been approved, the lawful basis for processing relates to the contractual agreement in place between the controller/lender, and the applicant.

The right to complain to the Information Commissioner

Please see section 3 of this notice

Decisions made based on automated processing

No processing decisions will be based on automated processing.

3. Contact Details

The contact details of the controller are as follows:

Financial Governance Division
Treasury
First Floor
Central Government Office
Bucks Road
Douglas
Isle of Man
IM1 3PX 

The contact details for the controller’s Data Protection Officer are as follows:

Email:DPO-Treasury@gov.im
Website: www.gov.im/about-the-government/departments/the-treasury/privacy-notice/
Telephone: +44 1624 686791

The contact details for the Isle of Man Information Commissioner are as follows:

The Office of the Information Commissioner
Prospect Hill
Douglas
Isle of Man
IM1 1ET

E-mail ask@inforights.im
Website: www.inforights.im 
Telephone: +44 1624 693260

 Isle of Man Disruption Loan Guarantee Scheme

The Isle of Man Government, through the Treasury (‘the controller’), is offering a Working Capital Loan Guarantee Arrangement (‘the Arrangement’) as part of a number of financial measures that are being put in place in order to provide financial assistance to local individuals and businesses that have been affected by the COVID-19 pandemic.

1.     The Data Protection Law

The controller acknowledges its obligations pursuant to the Data Protection (Application of GDPR) Order 2018 and the GDPR and LED Implementing Regulations 2018 (‘the Data Protection Law’) which provides a number of requirements in terms of processing activities involving personal data. The controller further acknowledges the general principles of processing as well as the rights of a data subject, which are contained in the Data Protection Law, at Articles 5 to 22 of the Data Protection (Application of GDPR) Order 2018 in the Annex.

2.     Information to be given to Data Subjects

The Data Protection Law outlines the information that must be given to data subjects before or at the time the personal data is collected from the data subject. This information can be summarised as follows:

• The identity and contact details of the controller and data protection team

See the details in section 3 of this notice

• Whether any of the personal data is special category data

None of the personal data collected by the controller for the Arrangement constitutes special category data, as defined by the Data Protection Law.

• The source of the personal data

None of the personal data processed for the purpose of the Arrangement has been collected from a publically available source. All of the personal data has been collected directly from the respective lenders (banks and other lending companies) or their professional advisors which collected the personal data directly from the individual(s) requesting financial support via the Arrangement.

• The purposes and the legal basis of the processing

The personal data collected for the purposes of the Arrangement is:

• the full name of the applicant and in the case of a body corporate this will include the directors and other significant living individuals who control the applicant’s business
• accompanying financial information including the amount of new loan  under the Arrangement and the purposes for which it is to be used
• Whether the applicant has previously applied for a loan  and any information as to why it was refused or approved
• the amount of existing borrowing facilities and current sums advanced or committed
• repayment term of loan (length of period)
• details of any security taken against the new borrowing
• confirmation that the payments on existing borrowings are up to date, or details of any arrears, any holiday period that has been granted and any revised terms during the life of the loan.

The controller may also hold and process personal data belonging to employees of:

• Applicants and their professional advisors
• Lenders and their professional advisors

The lending companies will process applications received from customers, including determining whether the application is eligible for the Arrangement, and will make a decision whether to approve or decline the application. There may be an automated process for some of the Arrangement which is operated by the lending company, and the applicant will need to review the lending company’s privacy statement to find out if any decisions are subject to automated decision making. 

The lending companies will then provide details of the customer applications, both approved and declined, in order that the controller can monitor and calculate their exposure and therefore future liability under the Arrangement. Once an application has been approved, the controller will then process the personal data in order to give effect to the support offered by the Arrangement.

The lawful basis for the processing by the controller is that processing is necessary for the exercise of performance by a public authority of a function that is of a public nature, or a task carried out in the public interest (contained in Article 6(e) of the Data Protection (Application of GDPR) Order 2018)). In provision of the Arrangement, the controller intends to provide for financial assistance in the exceptional circumstances of the COVID-19 pandemic, using powers in the Financial Provisions and Currency Act 2011.

• Where the lawfulness of processing is based on the processing being necessary for the legitimate interests of the controller or a third party, the legitimate interests concerned

The controller is not relying on “legitimate interest” as a lawful basis for processing.

• The recipients or categories of recipients of the personal data, if any

The personal data may be disclosed to:

• Other Departments, Boards or Offices of the Isle of Man Government; and/or
• Professional advisors of the Isle of Man Government;
• Banks and other financial institutions engaged by the Isle of Man Government in relation to the Arrangement
• Personal data transferred to an authorised or an unauthorised jurisdiction

Personal data may be transferred to the following jurisdictions under the Arrangement: 

• • Jersey,
  • Guernsey,
  • United Kingdom. 

Although Isle of Man branches of a bank may administer the application process, certain levels of approvals are often sought, or advice in other jurisdictions from ‘group’ arrangements such that branches in the Isle of Man will locally administer but may transfer data outside of the Isle of Man.

The period for which the personal data is expected to be stored

The personal data will be stored by the controller 6 years following the date of the loan being repaid by the applicant under the Arrangement or written off by the controller.  Full privacy information, including the retention schedule for documents held by the controller which can be found here.

• The data subject rights under the Data Protection Law

For more information in relation to the data subject rights:

• Visit the controller’s privacy notice
• contact the Data Protection Officer for the controller by e-mail
• Find an explanation of data protection law, and privacy information for other organisations within the Isle of Man Government ; or
•  Visit the website for the office of the Isle of Man Information Commissioner.
• Review the Data Protection Law:
• Data Protection (Application of GDPR) Order 2018 (see Articles 5-22 of the Annex to the Order)
• GDPR and LED Implementing Regulations 2018
• Where the lawfulness of processing is based on consent, the existence of the right to withdraw consent at any time

When applying for financial support under the Arrangement, individuals provide their consent to processing until such a time as their application is approved by the controller.  Individuals can withdraw their consent at any time and their application will be withdrawn.  Once an application has been approved, the lawful basis for processing relates to the contractual agreement in place between the controller/lender, and the applicant.

• The right to complain to the Information Commissioner

Please see section 3 of this notice

• Decisions made based on automated processing

No processing decisions will be based on automated processing.

3.     Contact Details

The contact details of the controller are as follows:

Financial Governance Division
Treasury
First Floor
Central Government Office
Bucks Road
Douglas
Isle of Man
IM1 3PX

The contact details for the controller’s Data Protection Officer are as follows:

Email: DPO-Treasury@gov.im
Website: www.gov.im/about-the-government/departments/the-treasury/privacy-notice/
Telephone: +44 1624 686791

The contact details for the Isle of Man Information Commissioner are as follows:

The Office of the Information Commissioner
Prospect Hill
Douglas
Isle of Man
IM1 1ET

E-mail ask@inforights.im
Website: www.inforights.im 
Telephone: +44 1624 693260

We collect and process information, including personal data, to provide effective and efficient services and so that we may carry out our lawful functions.

We use your personal data in line with the rules set out in the Manx Data Protection Legislation for the following reasons:

• Where you have agreed to the process
• To allow Treasury to communicate with you
• To process payments you make to Treasury
• To make payments to you
• To provide access to other services provided by Treasury
• To analyse the use and quality of our services and to make improvements

Treasury holds your information for the following purposes:

• Assessment and collection of tax, national insurance contributions, rates, VAT, customs and excise duties and other indirect taxes;
• Making refunds and repayments of tax, national insurance contributions, rates, VAT, customs and excise duties and other indirect taxes
• Assessing entitlement to social security benefits, state pensions and other payments out of the national insurance fund, and making payments as appropriate
• Enforcing import and export legislation and financial sanctions
• Administering the national minimum wage, grants and loans, the legal aid system, courts (civil, family, summary and high court), tribunals and discharge of court business, criminal injuries compensation panel, government debts including factoring of debts and international tax exchange agreements
• Prevention and detection of crime
• Carrying out research and statistical analysis including insurance risk management, economic and social research in relation to residents and visitors
• General administration, staff administration, education and training, accounts and records and advertising, marketing and public relations.
• Giving advice or rendering professional services and provision of services of an advisory, consultancy or intermediary nature, including Isle of Man job centre careers advice
• The provision of any service to others, including disability employment services register of local disabled people looking for employment and monitoring of employed disabled people

We may also process certain special categories of information for specific and limited purposes such as detecting and preventing crime. We will only process special categories of information where we have obtained your explicit consent or are otherwise lawfully permitted to do so. This may include:

• Information about racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data, biometric data
• Data concerning health
• Criminal proceedings, outcomes and sentences;
• Details of Civil, Family and Tribunal cases
• Offences (including alleged offences)

Treasury will only process your personal data if it is lawful to do so. We may rely on:

• Your consent – if we rely on your consent to process your data you may withdraw your consent at any time by contacting the Data Protection Officer for the Treasury
• The need to meet a legal obligation in carrying out our statutory functions
• The need to meet a request you have made for information or a service
• The need to prevent or investigate suspected or actual violations of law
• The need to protect the public interest
• The need to retain information for historical or archiving purposes by the Public Record Office under the Public Records Act 1999

We will only keep your information for the minimum time necessary in accordance with Treasury’s retention periods.

This may be to:

• Respond to an enquiry from you
• To meet a legal obligation in carrying out our statutory functions
• Conclude financial end of year processing
• Review an award of a Social Security benefit or a state pension

The default standard retention period for Treasury records is 6 years plus current year, otherwise known as 6 years +1. This is defined as 6 years after the last entry in a record followed by first review and/or destruction to be carried out in the additional current (+1) accounting year.

Records are only retained beyond the default Treasury retention period if their retention can be justified for statutory, regulatory, legal or security reasons or for their historic value.

The security and confidentiality of your information is very important to us.

Treasury will:

• Ensure safeguards are in place to make sure personal data is kept secure in compliance with our information security policy and standards;
• Ensure that your data remains under the control of our authorised controllers and processors with adequate safeguards to protect your rights
• Ensure only authorised staff are able to view your data
• Not make your information available for commercial use
• Only ask you for what is needed

We may share your information with third parties, such as:

• Other IoM Government Departments, Boards and Offices to provide a service or information you have requested, or where it is otherwise lawful to do so
• UK Government Departments, such as HMRC, the Home Office, HM Treasury and the Department for Work and Pensions, for taxation, National Insurance, benefits and state pension purposes
• Foreign tax and customs authorities; state pensions and benefits purposes
• TV Licensing on behalf of the BBC, in relation to an age-related concession
• Medical practitioners and other health care professionals, in connection with claims for certain Social Security benefits
• The police or law enforcement agencies in any country to meet international obligations, e.g. for the prevention or detection of crime;
• Fraud prevention agencies
• Advocates and lawyers, if it is required in connection with legal proceedings or prospective legal proceedings
• The Courts and tribunals
• IoM Post, for mailing and benefit payment purposes
• External contractors, who maintain and development our information and communications infrastructure

We will not sell your personal data to other companies, organisations or individuals.

Treasury will only share your personal data with other companies, governments, competent authorities, organisations or individuals where it is fair and lawful for us to do so.

Your personal information will not be disclosed to any third party not mentioned above without your prior consent or where Treasury is required to do so by law.

To ask if we hold personal information about you

You can ask to see any information we hold about you by making a Subject Access Request.

You can review your personal information and ensure it is accurate

Where possible we will provide you with access to the information we hold about you so that you can view this information and provide a means for you to have this information changed if it is not accurate.

To remove your personal information

In certain circumstances you can ask for your information to be deleted. Please note that as part of the Treasury’s statutory functions some information may need to be retained.

To make a complaint

If you are unhappy with the way we deal with your personal information you can submit a complaint to the Data Protection Officer for the Treasury who will work with you to resolve any issues.

Email: DPO-Treasury@gov.im
Telephone: +44 1624 686791

Financial Governance Division,
First Floor,
Central Government Offices,
Bucks Road,
Douglas,
IM1 3PX,
Isle of Man

The Isle of Man’s Information Commissioner is the independent authority responsible for upholding the public's information rights and promoting and enforcing compliance with the Island's information rights legislation.

You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Manx Data Protection Legislation .

This Privacy Notice may change. We will not reduce your rights under this Privacy Notice without your consent. If any significant change is made to this Privacy Notice we will provide a prominent notice on the Treasury Privacy Notice webpage so you can review changes.