Analysis of Social Media for Investigations - Privacy Notice

Social media interrogations involve the detailed analysis of an organisation or individual’s social media accounts. The data gathered through tools may include social media handles and content from posts, which are publicly available, to provide information relevant to an investigation, court case or background checks e.g.  where there is a website advertising the services of a local business and there is evidence that this business is engaging in illegal activity, there are IT tools available that can track who is responsible for setting up that website, and so can be a good starting point when trying to link potential offenders to the offending business. See our Policy for Interrogating Social Media for Investigative Purposes.

Processing activity - in order to undertake our statutory enforcement functions, we may:

• use different platforms (social media, video sharing sites etc.) to gather information that are publicly available;
• use information posted on a public profile without a RIPA authorisation;
• use social media for surveillance with a RIPA authorisation, where the investigation is unusual and/or is likely to capture confidential information and the risks to privacy have been assessed as being proportionate and justified.

In general, we process personal information relating to:

• the investigation and detection of an offence
• the instigation of legal proceedings

Information requirements - our processing activities may include information:

• provided by social media monitoring providers
• obtained from public sources

Lawful bases[1] – our lawful bases for processing your personal information under the UK GDPR and our legal gateways are:

• UK GDPR Article 6(1)(c) - our legal obligation(s) (as applicable) under the:

• Control of Pollution Act 1974 (environmental crime)
• Refuse Disposal (Amenity) Act 1978 (environmental crime)
• Road Traffic Regulation Act 1984 (as amended)
• Children Act 1989 (safeguarding children & young persons)
• Environmental Protection Act 1990 (environmental crime)
• Town and Country Planning Act 1990 (environmental crime)
• Criminal Justice and Public Order Act 1994
• Criminal Procedure and Investigations Act 1996 (prosecutions)
• Crime and Disorder Act 1998 (duty to consider crime & disorder)
• Regulation of Investigatory Powers Act 2000
• Anti-Social Behaviour Act 2003 (tackle anti-social behaviour in local communities)
• Children Act 2004 (safeguarding children and young persons at risk)
• Clean Neighbourhoods and Environment Act 2005 (environmental crime)
• Mental Capacity Act 2005 and associated Code of Practice 2007 (safeguarding)
• Protection of Freedoms Act 2012 & Protection of Freedoms Act 2012 (Code of Practice for Surveillance Camera Systems and Specification of Relevant Authorities) Order 2013 & Surveillance Camera Code of Practice Section 29 Protection of Freedoms Act 2012
• Anti-Social Behaviour Crime and Policing Act 2014 (anti-social behaviour)
• Care Act 2014 (safeguarding adults at risk)
• Immigration Act 2014
• Counter-Terrorism and Security Act 2015
• Modern Slavery Act 2015 (trafficking & slavery offences)
• Serious Crime Act 2015 (fraud)

• where processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in us under the legislation referred to above (UK GDPR Article 6(1)(e) and DPA 2018, section 8(c)) in accordance with the legislation referred to above

We do not actively collect the following personal data, but we may process such data when analysing social media data where such data is included in social media posts. Our lawful basis for processing such personal data is:

• special category personal data - where processing is necessary for the reasons of substantial public interest (UK GDPR Article 9(2)(g) and DPA 2018, Schedule 1, para.6(1) & (2)(a))
• criminal convictions and offences - where processing is necessary for reasons of substantial public interest (UK GDPR Article 10 as supplemented by DPA 2018 section 10(5) & Schedule 1, Part 2, paras. 6(1) and (2)(a))

We have a Data Protection Policy that sets out how this information will be handled.

Data sharing - to aid with the detection and prevention of criminal acts, we may collect from and share your information with: 

• council department(s)
• councillor(s)
• local authorities
• courts/tribunals
• Kent Police
• Kent County Council
• Crown Prosecution Service
• Border Force
• HM Revenue & Customs
• Trading Standards
• NHS
• Registered Social Landlords

HMRC: Where we detect suspicious behaviours of fraud and/or crime across our functions, we may receive from and share information with HMRC (Customer Compliance Group – RIS Intelligence, Volume Intelligence, Intelligence Exchange).

We may also rely on a number of exemptions, which allow us to share information without needing to comply with all the rights and obligations under the Data Protection Act 2018. Please refer to the Kent & Medway Information Agreement for further details on our sharing arrangements.

Retention period - we keep your personal information for the minimum period necessary. The information outlined in this Privacy Notice will be kept in accordance with the retention period(s) referred to in the Information Asset Registers unless exceptional circumstances require longer retention e.g. a pending court case. All information will be held securely and disposed of confidentially.

Right to object – where processing your personal information is required for the performance of a public interest task (see our lawful bases above), you have the right to object on ‘grounds relating to your particular situation’. We will have to demonstrate why it is appropriate for us to continue to use your personal data.

Changes to this Privacy Notice – we review this Privacy Notice regularly and will place updates on our website.

Please refer to our Corporate Privacy Notice for further details of how we process your personal information and your rights.