Notifying data subjects about how their personal data is used
Data protection legislation sets out requirements for notifying data subjects about how their personal data is used.
When data is collected directly from the data subject, the notice must be given at the point of collection. For example, a notice needs to be included:
in letters requesting documentary evidence under the exceptions process
on application forms for the appointment of election staff
When data is not collected directly, the notice must be given to the data subject within one month or at the first point of contact. But this is not necessary if the data subject was notified of the terms of the privacy notice when the data was originally collected by the primary data controller (for example, if you use personal data collected by council tax to verify an applicant for registration, a notice is not required if one was given to the applicant by the council tax department when the personal data was originally collected).
It is not necessary to provide a link to a privacy notice on poll cards. Poll cards do not collect personal information, they contain information from the electoral register and absent vote lists which are publicly available under electoral law. Your privacy notice should set out that personal data contained in the electoral register and absent voting lists will be used to issue poll cards in advance of an election.