The Social Security Division processes lots of personal information, including sensitive information. We take data protection very seriously and understand how important it is that you can trust us with your information.
This privacy notice tells you what to expect us to do with your personal information and will explain:
- Who is collecting it
- How it will be used
- Why it is being collected
- What information is collected
- Who it will be shared with
- How long it will be kept
- Your choices, including how to access and update information
- How it is collected
The name and contact details of our organisation:
The Treasury is the data controller for the personal information we process, unless otherwise stated.
You can contact the Social Security Division by:
Telephone: +44 1624 685656
Post: Social Security, Markwell House, Market Street, Douglas, IM1 2RZ
The contact details of our Data Protection Officer:
You can contact our Data Protection Officer by:
Telephone: +44 1624 686791
Post: Financial Governance Division, First Floor, Central Government Offices, Bucks Road, Douglas, IM1 3PX
The purposes of the processing
We collect and process information, including personal data, to provide effective and efficient services and so that we may carry out our lawful functions.
We use your personal data for the following reasons:
- Administer, assess entitlement and make payments as appropriate for Social Security benefits, pensions, grants, loans, Legal Aid, National Insurance credits, redundancy, insolvency and compensation claims
- Provision of advice, guidance and employment support & schemes, including further study opportunities and work placements, as well as the Disability Employment Service
- Investigation or prosecution of offences relating to benefits
- Prevention and detection of crime
- Employee administration and training
- Public and employee safety
- Review and improve Social Security’s services
The lawful basis for the processing
When Social Security collect and use people’s personal data we must have a valid lawful basis to do so.
We rely on the lawful basis Public Task to process most of the personal data that we collect and use. Other lawful bases that we rely on include legal obligation, legitimate interests, contract and consent. These are described by the Information Commissioner as follows:
- Public Task - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller which is laid down by Manx law or European Union law as it is applied to the Island
- Legal Obligation - processing is necessary for compliance with a legal obligation laid down by Manx law or European Union law as it is applied to the Island to which the controller is subject
- Legitimate Interests - processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
- Contract - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
- Consent – the data subject has given clear consent to process their personal data for a specific purpose
We also collect and use special category data including health and ethnic origin information, as well as criminal offence information. Special category data needs more protection because it is sensitive and to lawfully process this data we must identify a specific condition in addition to the lawful basis. The specific conditions identified for processing the special category are:
- For employment, social security and social protection purposes
- Reasons of substantial public interest and preventing or detecting unlawful acts
- Statutory etc. and government purposes
- Legal Claims
- Judicial Acts
The legitimate interests for the processing
Legitimate interests is a lawful basis for processing personal data. This includes our own interests, individual interests, interests of third parties or broader societal benefits.
We rely on legitimate interests to process some of the personal information that we collect and these interests are:
- Public and employee safety
- Prevention and detection of crime
- Service standards
The categories of personal data obtained (if the personal data is not obtained from the individual it relates to)
When we collect and process personal data so that we may carry out our lawful functions, some of the information obtained is not from the individual that it relates to. The categories of personal data that we collect are:
|Category of data||Examples of that type of data|
|Personal details||Name, address, telephone number|
|Personal details of third parties, including members of your family, spouse, civil partner, your children and anyone else who lives with you||Their name, address, date of birth|
|Personal identification data||Name, title, date of birth,|
|Government identifiers||National Insurance number|
|Financial details||Income and expenditure details, bank account details, National Insurance contributions, tax details, debts, pensions|
|Employment details||Past, current and prospective employers, amounts paid, dates of employment, position held|
|Family, lifestyle and social circumstances||Marital status, child care arrangements, living arrangements, property ownership,|
|Medical data||Illness, injuries, disabilities, diagnosis medical reports|
|Other information||Vehicle details, utility usage for a property, criminal convictions including alleged offences|
The categories of recipients and sources of the personal data
Depending on the purpose of processing personal information we share information with and get it from other organisations such as:
- Advocates and lawyers
- Charitable and welfare organisations
- Claimants/applicants representatives
- Close Circuit Television (CCTV)
- Courts and tribunals
- Employers - past, current and potential
- Emergency services
- Energy suppliers
- External contractors
- Financial institutions
- Isle of Man Post Office
- Landlords/housing providers
- Medical practitioners and other health care professionals including nursing homes
- Other Isle of Man Government Departments, Boards and Offices
- Schools/child care providers
- Telephone recordings
- TV Licencing
- UK Department for Work and Pensions and HMRC
We do this for a number of reasons, including to:
- Administer appeals and compensation claim hearings
- Assess entitlement to and pay benefits, state pensions and civil legal aid
- Check and update tax and National Insurance contributions
- Check the accuracy of information
- Deductions from benefits for repayment of loans, payment of court fines or payment to third parties i.e. landlords/housing providers
- Employee safety
- Enable the transfer of awards of benefits or state pensions to/from the UK Department for Work and Pensions or HMRC
- Enrolment for a MiCard in order to collect benefit payments
- Gather additional information to support claims/applications
- Help people to find employment, study opportunities or work placements
- Inform TV Licensing who is eligible for a free TV licence
- Investigate or prosecute offences relating to benefits
- Prevent or detect crime
- Process claims/applications on behalf of individuals
- Protect you or others in an emergency
We will never sell your personal data to other companies, organisations or individuals.
We will only share your personal data with businesses, employers, government departments, organisations or individuals where it is fair and lawful for us to do so.
Your personal information will not be disclosed to any third party not mentioned above without your prior consent unless we are required to do so, or otherwise authorised to do so, by law.
The retention periods for the personal data
We will only keep personal information as long as is necessary for the particular purpose for which it is held. The personal information collected and held by us will be deleted in accordance with our retention schedule.
The default standard retention period for Social Security records is 6 years plus the current year, otherwise known as 6 years + 1. This is defined as 6 years after the last entry in your record plus the current financial year.
There are some records held which do not fall into the default standard retention period and are either kept for a shorter or longer period of time, depending on why the information is held. Full details of how long we keep your personal information are included in our retention schedule which can be provided on request.
The rights available to individuals in respect of the processing
You have various rights about how we use your data. The rights available to you depend on our reason for processing your information.
Your right of access
You have the right to ask us for copies of your personal information. This is commonly referred to as a Subject Access Request. This right always applies. There are some exemptions, which means you may not always receive all the information we process.
If you agree, we will try to deal with your request informally, for example by providing you with specific information you need over the telephone, or we can securely email this to you where you have given us an email address.
Your right to rectification
You have the right to ask us to rectify information we hold about you if you think is inaccurate. You also have the right to ask us to complete information about you if you think is incomplete. This right always applies.
Your right to erasure
You have the right to ask us to erase your personal information in certain circumstances. This is sometimes referred to as the ‘right to be forgotten’.
Your right to restriction of processing
You have the right to ask us to restrict the processing of your information in certain circumstances.
Your right to object to processing
You have the right to object to processing of your personal information in certain circumstances.
Your right to data portability
You have the right, where you have supplied information to us, to ask that we transfer that information to another organisation or service provider, or give it to you in certain circumstances.
The right to withdraw consent
If we rely on your consent to process your information you may withdraw your consent at any time by contacting us via post, email or telephone.