Privacy Notice - Isle of Man Nationality Service

The Isle of Man Nationality Service collects and processes personal information to fulfil its legal and statutory functions for each of the services it is responsible for. We only use, gather and share personal information where we have an appropriate legal basis to do so under the Annex to the Data Protection (Application of the GDPR) Order 2018 (SD 2018/0143) ('Applied GDPR').

The legal basis for the processing of personal data will be Article 6(1)(c) of the Applied GDPR, namely that processing is necessary for compliance  with a legal obligation to which the controller is subject.

Personal data may also be processed under, or that the processing is necessary for, the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller and where the official functions are underpinned by common law or statute.

Or Article 6(1)(e) of the Applied GDPR namely that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller and where the official functions are underpinned by common law or statute.

We have a duty to safeguard and ensure the security of your personal information. We do that by having systems and policies in place to limit access to your information and prevent unauthorised disclosure. Staff who access personal information have appropriate security clearance, a business need for accessing the information and their activity is subject to audit and review.

The Cabinet Office collects and processes personal information to fulfil its legal and statutory functions. We only use, gather and share personal information where we have an appropriate legal basis to do so under the Annex to the Data Protection (Application of the GDPR) Order 2018 (SD 2018/0143) ('Applied GDPR').

The legal basis for the processing of your data will be Article 6(1)(c) or Article 6(1)(e) of the Applied GDPR – namely that processing is necessary for compliance with a legal obligation to which the controller is subject or that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller and where the official functions are underpinned by common law or statute.

The British Nationality Act 1981 sets out the statutory obligations to be followed in relation to naturalisation or registration as a British citizen.  

The Immigration (Isle of Man) (Amendment) Order 2019 (SI 2019 No. 562) extended sections 20 and 21 of the Immigration and Asylum Act 1999 (1999 c. 33) and provides a statutory basis for the Governor in respect of nationality purposes, to supply information to and receive information from, a public authority, the Secretary of State as well as, but not limited to:

• the Chief Constable, for police purposes
• the Attorney General for use in connection with his prosecution functions
• the Financial Intelligence Unit
• the Treasury or the Collector of Customs and Excise for customs purposes
• The Minister for immigration purposes

On occasion, for example when verifying your identity, we may also process special categories of personal data. In this case we would ensure that our processing was lawful under Article 9 of the Applied GDPR for example, on the basis of Article 9(2)(g) where the processing is necessary for reasons of substantial public interest. This may include information about political beliefs, sexual orientation, religious beliefs and biometrics.

We may also process personal data under the Data Protection (Application of the LED) Order 2018 (SD2018/0144), as applied to the Isle of Man for the purposes of prevention, detection, investigation or prosecution of crime.

Examples of ways in which we may gather your personal information include when:

• You enter the Common Travel Area by crossing the UK border e.g. an airport
• You make an application (via United Kingdom Visas & Immigration (UKVI), on paper or in person to this office)
• You attend an interview
• We seek to verify your information, documents or identity
• You supply biometric information (for example, fingerprints or a facial photograph)
• We receive information from a third party in relation to your application
• We receive allegations or intelligence from law enforcement agencies and others involved in preventing abuse, crime and fraud
• We are notified of a relevant criminal conviction

We may also request information from third parties. For example, this might be for the purposes of verifying information you supplied in support of an application, obtaining information needed for a safeguarding purpose, obtaining new address details of people we are trying to trace, or undertaking other enforcement actions. This may involve, for example:

• Contacting any linked applicant
• Obtaining information from other government departments both on and off the Island – these may include, but are not restricted to the Cabinet Office, The Secretary of State for the UK Home Office, The Treasury, The Department of Health and Social Care, The Department for Enterprise, The Isle of Man Constabulary
• Seeking to verify documents, information, or identity in relation to your application. This may include private and public authorities in other countries
• Local authority services

The main ways we process personal information are given in the table below.

Please note: we will not share any of your information with authorities in your country of origin if this would put you or your family at risk

Article 22 of the Applied GDPR provides the right not to be subject to a decision made solely on the basis of automated processing which produces legal or other significant effects. Parts of our processing may involve degrees of automation, but complex or adverse decisions will always be taken by a trained officer or caseworker.

We may use personal information, for example from previous applicants, to develop tools that allow us to assess and then process applications in a particular way. This helps us to target our resources and ensure our processing is efficient, allowing us to minimise costs while protecting the public effectively. However, a case officer would still decide these cases. Any profiling must comply with our wider obligations under equality legislation.

We may transfer personal information to authorities or organisations in countries outside the European Economic Area, via UKVI. When we do, this will be for specific purposes. These may include, for example, validating aspects of your application, preventing or detecting crime, including fraud, supporting returns or helping to identify or prevent those seeking to enter or remain in the UK who may not comply with the conditions attached to their leave to enter or remain. When we do this, we seek to take appropriate steps to safeguard your information, for example by agreeing the method and purpose of sharing by way of written Agreements. We may rely on the derogations in Article 49(1) of the Applied GDPR where necessary.

Beyond the normal processing of your application, we may use your personal information (for example, email address and mobile number) to send you prompts. For example, to inform you of any changes that will affect the processing of your application or when documents are ready for collection. In addition, we may use your details to seek feedback on the handling of your application to help us improve our services.

We will keep your personal information for as long as it is necessary for permitted purposes. Personal data will typically be retained for 25 years after a decision to grant citizenship and for 15 years after the last action in other cases. We continue to keep retention periods under review.

Under the Applied GDPR at Article 15 you have a right of access to your personal data and to check the accuracy of that data by making a Subject Access Request.

A subject access request is made by contacting the Cabinet Office Data Protection Officer (DPO) as follows:

In writing to:

The Data Protection Officer,
Cabinet Office,
Government Office,
Buck's Road,
Douglas,
Isle of Man,
IM1 3PN

By Email:  DPO-CabOff@gov.im
By telephone: +44 1624 686779

Subject access requests must be responded to promptly and in any event within a maximum of 1 month.

Under the GDPR you also have the right to object to and ask to restrict our use of your personal information, and to ask us to rectify or delete your personal information. However, there may be a number of legal or other official reasons why we need to continue to keep or use your data. If you want to exercise these rights please write to us at the above address.

The Information Commissioner is the independent authority responsible for upholding the public's information rights and promoting and enforcing compliance with the Island's information rights legislation. You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Isle of Man’s data protection legislation.

You also have the right to complain to the Information Commissioner’s Office about the way we handle your information or respond to your requests for access to your personal information or the exercise of your other rights under the Applied GDPR or any of the other data protection legislation in force on the Isle of Man.

Further information can be found on the Information Commissioner's website.