Data protection considerations for the provision of nationality information
Data protection considerations for the provision of nationality information
Data protection legislation does not affect the requirement for nationality information to be provided on an application. However nationality data is classed as special category of personal data because it may reveal an individual’s racial or ethnic origin.
Data protection legislation prohibits the processing of special categories of personal data unless an additional lawful basis beyond those for the main purposes of processing data are met. The appropriate lawful basis for processing special categories of personal data for electoral purposes would be that it is necessary for reasons of substantial public interest and with a basis in UK law.
Additionally, the Data Protection Act 2018 requires that in order to process nationality data – whether as part of an application to register, or in relation to staff appointments – you must have in place a ’Policy Document’ which, amongst other things, must explain:
the procedures for complying with the data protection principles
the policies for retention and erasure
Your policy document will need to reflect your local procedures and policies for the processing, retention and erasure of personal data.
This policy document must be:
kept until six months after the processing ceases
reviewed and updated at appropriate times
made available to the ICO on request
Our data protection guidance for EROs and ROs contains further information on special categories of data and the need for a policy document. The guidance also highlights the need to ensure that a Privacy Notice is published on your website before carrying out any collection of data.