Privacy notice - ‘Report packaging data’ service

This privacy notice explains what personal data is collected through the ‘report packaging data’ service and how that personal data is used.

Who collects your personal data

Defra is acting as the ‘data processor’ for the personal data being collected through the ‘report packaging data’ service.

As the data processor, we collect and share data on behalf of the four environmental regulatory bodies. These are:

  • the Environment Agency (EA)
  • the Scottish Environment Protection Agency (SEPA)
  • Natural Resources Wales (NRW)
  • the Northern Ireland Environment Agency (NIEA)

Defra’s main address for correspondence is:

Department for Environment, Food and Rural Affairs

Seacole Building
2 Marsham Street
London
SW1P 4DF

If you need further information about how Defra uses your personal data and your associated rights you can contact the Defra data protection manager at data.protection@defra.gov.uk or using the address above.


The data protection officer for Defra is responsible for checking that Defra complies with legislation. You can contact them at defragroupdataprotectionofficer@defra.gov.uk or using the address above.


What personal data we collect and how it is used

We will collect your:

  • name
  • telephone or mobile number
  • email address
  • address if used for business purposes, including postcode
  • Internet Protocol (IP) address, and details of which version of web browser you used
  • information on how you use the site, using cookies and page tagging techniques
  • questions, queries or feedback you leave

We collect this data and:

  • share it with the environmental regulators so they know who has submitted organisation and packaging data, and so they can approve or refuse a request to be an ‘approved person’ or someone with ‘delegated authority’
  • share it with the scheme administrator so they can work out disposal costs
  • share with a third party organisation contracted to manage the invoicing of organisations for disposal cost obligations
  • calculate waste disposal fees
  • calculate administrative fees
  • gather feedback to improve our services
  • respond to any feedback you send us
  • monitor the performance and security of the online service

Lawful basis for processing your personal data

The lawful basis for processing your personal data is that it is necessary:

  • to perform a task in the public interest as part of the Collection & Packaging Reforms (CPR) programme
  • to do our work as a government department as part of the Collection & Packaging Reforms (CPR) programme, introduced in support the Government’s 25 Year Environment Plan, which is underpinned by the Environment Act 2021

Consent to process your personal data

The processing of your personal data is not based on consent. You cannot withdraw it.

Who we share your personal data with

We will share the personal data collected under this privacy notice with the environmental regulators and the scheme administrator. We do this to provide a digital service as part of the Collection & Packaging Reforms (CPR) programme.

The environmental regulators are controllers in their own right. You can learn more about how your personal data is processed by the environmental regulators at the following websites:

Defra respects your personal privacy when responding to access to information requests, but we may have to share information when necessary to meet the statutory requirements of the Environmental Information Regulations 2004 and the Freedom of Information Act 2000.

How long we hold personal data

We will keep your personal data for 7 years in line with the requirements of the Collection & Packaging Reforms (CPR) programme.

What happens if you do not provide the personal data

If you do not provide the personal data required you will not be able to participate in the service.

Use of automated decision making or profiling

The personal data you provide is not used for:

  • automated decision making (making a decision by automated means without any human involvement)
  • profiling (automated processing of personal data to evaluate certain things about an individual)

Transfer of your personal data outside of the UK

Defra will only transfer your personal data to another country that is deemed adequate for data protection purposes.

Your rights

Find out about your individual rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

Complaints

You have the right to make a complaint to the Information Commissioner’s Office at any time.

Defra’s personal information charter

Defra’s personal information charter explains more about your rights over your personal data.

Changes to this policy

We may change this privacy policy.

In that case, the ‘last updated’ date at the bottom of this page will also change.

Any changes to this privacy policy will apply to you and your data immediately. If these changes affect how your personal data is processed, we will let you know.

Last updated: 22 November 2023