Privacy Notice - Isle of Man Nationality Service
The Isle of Man Nationality Service is an office within the Isle of Man Borders Division of the Cabinet Office, which is a Department of the Isle of Man Government as established under the Government Departments Act 1987 (as amended).
Personal information supplied or collected for the purposes of becoming a British citizen will be held and processed by the Cabinet Office, a Department of the Isle of Man Government, Government Office, Bucks Road, Douglas, Isle of Man, IM1 3PN.
Data protection law in the Isle of Man changed on 1 August 2018. This notice reflects your rights under the new laws and lets you know how we will look after and use your personal information. This includes what you tell us about yourself, what we learn about you as you engage with us and what others share with us to fulfil their legal obligations or help prevent abuse and detect crime. It also covers what information we may share with other organisations. This information will be held on our nationality casework system.
The Cabinet Office has appointed a Data Protection Officer (DPO) to help ensure that we fulfil our legal obligations when processing personal information.
Collection and use of personal data
The Isle of Man Nationality Service collects and processes personal information to fulfil its legal and statutory functions for each of the services it is responsible for. We only use, gather and share personal information where we have an appropriate legal basis to do so under the Annex to the Data Protection (Application of the GDPR) Order 2018 (SD 2018/0143) ('Applied GDPR').
The legal basis for the processing of personal data will be Article 6(1)(c) of the Applied GDPR, namely that processing is necessary for compliance with a legal obligation to which the controller is subject.
Personal data may also be processed under or that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller and where the official functions are underpinned by common law or statute.
Or Article 6(1)(e) of the Applied GDPR namely that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller and where the official functions are underpinned by common law or statute.
How we protect your personal information
We have a duty to safeguard and ensure the security of your personal information. We do that by having systems and policies in place to limit access to your information and prevent unauthorised disclosure. Staff who access personal information have appropriate security clearance, a business need for accessing the information and their activity is subject to audit and review.
How we gather and use your personal information
The Cabinet Office collects and processes personal information to fulfil its legal and statutory functions. We only use, gather and share personal information where we have an appropriate legal basis to do so under the Annex to the Data Protection (Application of the GDPR) Order 2018 (SD 2018/0143) ('Applied GDPR').
The legal basis for the processing of your data will be Article 6(1)(c) or Article 6(1)(e) of the Applied GDPR – namely that processing is necessary for compliance with a legal obligation to which the controller is subject or that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller and where the official functions are underpinned by common law or statute.
The British Nationality Act 1981 sets out the statutory obligations to be followed in relation to naturalisation or registration as a British citizen.
The Immigration (Isle of Man) (Amendment) Order 2019 (SI 2019 No. 562) extended sections 20 and 21 of the Immigration and Asylum Act 1999 (1999 c. 33) and provides a statutory basis for the Governor in respect of nationality purposes, to supply information to and receive information from, a public authority, the Secretary of State as well as, but not limited to:
- the Chief Constable, for police purposes
- the Attorney General for use in connection with his prosecution functions
- the Financial Intelligence Unit
- the Treasury or the Collector of Customs and Excise for customs purposes
- The Minister for immigration purposes
On occasion, for example when verifying your identity, we may also process special categories of personal data. In this case we would ensure that our processing was lawful under Article 9 of the Applied GDPR for example, on the basis of Article 9(2)(g) where the processing is necessary for reasons of substantial public interest. This may include information about political beliefs, sexual orientation, religious beliefs and biometrics.
We may also process personal data under the Data Protection (Application of the LED) Order 2018 (SD2018/0144), as applied to the Isle of Man for the purposes of prevention, detection, investigation or prosecution of crime.
Examples of ways in which we may gather your personal information include when:
- You enter the Common Travel Area by crossing the UK border e.g. an airport
- You make an application (via United Kingdom Visas & Immigration (UKVI), on paper or in person to this office)
- You attend an interview
- We seek to verify your information, documents or identity
- You supply biometric information (for example, fingerprints or a facial photograph)
- We receive information from a third party in relation to your application
- We receive allegations or intelligence from law enforcement agencies and others involved in preventing abuse, crime and fraud
- We are notified of a relevant criminal conviction
We may also request information from third parties. For example, this might be for the purposes of verifying information you supplied in support of an application, obtaining information needed for a safeguarding purpose, obtaining new address details of people we are trying to trace, or undertaking other enforcement actions. This may involve, for example:
- Contacting any linked applicant
- Obtaining information from other government departments both on and off the Island – these may include, but are not restricted to the Cabinet Office, The Secretary of State for the UK Home Office, The Treasury, The Department of Health and Social Care, The Department for Enterprise, The Isle of Man Constabulary
- Seeking to verify documents, information, or identity in relation to your application. This may include private and public authorities in other countries
- Local authority services
The main ways we process personal information are given in the table below.
What we process and hold personal information for
Examples of how we may use your data
To process applications
To enforce Isle of Man laws
To safeguard and promote the welfare of children and adults
Please note: we will not share any of your information with authorities in your country of origin if this would put you or your family at risk
Automated decision-making and profiling
Article 22 of the Applied GDPR provides the right not to be subject to a decision made solely on the basis of automated processing which produces legal or other significant effects. Parts of our processing may involve degrees of automation, but complex or adverse decisions will always be taken by a trained officer or caseworker.
We may use personal information, for example from previous applicants, to develop tools that allow us to assess and then process applications in a particular way. This helps us to target our resources and ensure our processing is efficient, allowing us to minimise costs while protecting the public effectively. However, a case officer would still decide these cases. Any profiling must comply with our wider obligations under equality legislation.
Data transfers outside of the European Economic Area
We may transfer personal information to authorities or organisations in countries outside the European Economic Area, via UKVI. When we do, this will be for specific purposes. These may include, for example, validating aspects of your application, preventing or detecting crime, including fraud, supporting returns or helping to identify or prevent those seeking to enter or remain in the UK who may not comply with the conditions attached to their leave to enter or remain. When we do this, we seek to take appropriate steps to safeguard your information, for example by agreeing the method and purpose of sharing by way of written Agreements. We may rely on the derogations in Article 49(1) of the Applied GDPR where necessary.
Contacting you using your personal information
Beyond the normal processing of your application, we may use your personal information (for example, email address and mobile number) to send you prompts. For example, to inform you of any changes that will affect the processing of your application or when documents are ready for collection. In addition, we may use your details to seek feedback on the handling of your application to help us improve our services.
How long do we keep your personal information?
We will keep your personal information for as long as it is necessary for permitted purposes. Personal data will typically be retained for 25 years after a decision to grant citizenship and for 15 years after the last action in other cases. We continue to keep retention periods under review.
How to get a copy of your personal information
Under the Applied GDPR at Article 15 you have a right of access to your personal data and to check the accuracy of that data by making a Subject Access Request.
A subject access request is made by contacting the Cabinet Office Data Protection Officer (DPO) as follows:
In writing to:
The Data Protection Officer,
Isle of Man,
By Email: DPO-CabOff@gov.im
By telephone: +44 1624 686779
Subject access requests must be responded to promptly and in any event within a maximum of 1 month.
Under the GDPR you also have the right to object to and ask to restrict our use of your personal information, and to ask us to rectify or delete your personal information. However, there may be a number of legal or other official reasons why we need to continue to keep or use your data. If you want to exercise these rights please write to us at the above address.
How to complain
The Information Commissioner is the independent authority responsible for upholding the public's information rights and promoting and enforcing compliance with the Island's information rights legislation. You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Isle of Man’s data protection legislation.
You also have the right to complain to the Information Commissioner’s Office about the way we handle your information or respond to your requests for access to your personal information or the exercise of your other rights under the Applied GDPR or any of the other data protection legislation in force on the Isle of Man.
Further information can be found on the Information Commissioner's website.