PRIVACY

COP26 is the 26th Conference of the Parties (CoP) of the signatories of The United Nations Framework Convention on Climate Change.  It will be held in Glasgow in November 2021. It is hosted by the UK, jointly with Italy. 

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR). 

We also receive and act on public correspondence. Where we do so the relevant privacy notice is here. 

We also share data and engagement via social media. Where we do so the relevant privacy notice is here. 

YOUR DATA

Purpose

The purposes for which we are processing your personal data are: 

  • to organise and hold the events, including registering delegates and attendees, ensuring accessibility and providing services and catering at events
  • to accredit staff, delegates, exhibitors and attendees
  • to involve and inform stakeholders about COP26 activities and events, including operating a mailing list
  • to manage UK and foreign country delegations and their bookings
  • to ensure the safety and security of delegates and to cooperate with law enforcement agencies and medical professionals
  • to perform testing and exercising of plans to hold the events
  • to monitor media coverage of the events and to promote and raise awareness of COP26 and UK government policies on climate change
  • to bring or defend legal proceedings relating to the events
  • to operate our website providing news and updates, monitoring web traffic and providing email alerts to those who sign up
  • to invite and assess proposals for events and activities at COP26 put forward by interested parties on our proposals platform
  • in certain circumstances, to offer and provide delegates with access to COVID-19 vaccines

The data

We will process the following personal data: 

In relation to delegates and attendees: name, address, contact details, date of birth, gender,  passport numbers, nationality, photo ID, job titles, organisation, country of delegation, hotel bookings, duration of stay, disabilities requirements, whether they are green or blue zone attendees, dietary requirements, CCTV recordings, and data about positive covid tests where we are notified of these by you or your delegation. 

In relation to exhibitors: name, address, contact details, organisation

In relation to all members of the UK delegation including attendees, delegates, exhibitors and individuals at COP26: health data including individuals vaccination status. 

In relation to stakeholders: name, contact details, organisation, job title, gender, interests relating to COP26, proposals submitted. 

In relation to our website, mailing list, and media and advertising: images, video, website usage analytics, marketing cookies, and email addresses. 

In relation to proposals submitted: names, contact details (telephone, email, address), job title, organisation/company name, and websites associated with you, your proposal. We also collect staff names, employers and email addresses to manage access to our proposals platform. 

In relation to accreditation / vetting of staff, delegates, exhibitors and attendees: information about criminal convictions, sanctions, or investigations relating to breaches of the law. 

Legal basis of processing

The legal basis for processing your personal data is: 

In relation to vaccination data, web analytics or marketing cookies: because you consent. 

In relation to all other data: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case that is the UK’s responsibility as host nation to hold the COP26 events. 

And in relation to UK staff: it is necessary for the performance of a contract to which the data subject is a party. In this case that is their employment terms. 

Sensitive (special category) personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. 

The legal bases for processing your sensitive personal data, and for data relating to criminal convictions, are: 

  • It is necessary for the purposes of performing or exercising our obligations or rights as the controller, or your obligations or rights, under employment law, social security law or the law relating to social protection (reasonable adjustments) (paragraph 1, schedule 1, Data Protection Act 2018)
  • processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department (paragraph 5, schedule 1, Data Protection Act 2018). 
  • It is necessary for the establishment, exercise or defence of legal claims, or in relation to a court acting in its judicial capacity (paragraph 33, schedule 1, Data Protection Act 2018).

In relation to vaccination data: 

  • because you have explicitly consented

Recipients

Your personal data will be shared by us with: 

  • the United Nations where necessary to discharge our obligations under the Host Country Agreement
  • the United Nations Framework Convention on Climate Change Secretariat, where necessary to run and manage the events
  • the booking platform managed by the UNFCCC Secretariat
  • country delegations and attending countries (to manage their attendance)
  • the Foreign, Commonwealth and Development Office, who are a joint controller with us, and their vetting provider National Accreditation Team (Greater Manchester Police), who will vet staff and exhibitors. The National Accreditation Team are the data processors of the Foreign, Commonwealth and Development Office.
  • our event production companies, Glasgows and Identity
  • The Aventri platform operated by the Department for International Trade, who are acting as our data processor
  • hotels and transport providers (to enable attendees to book)
  • MCI, our accommodation booking provider, who are the data processor of the Foreign, Commonwealth and Development Office
  • hotels and transport providers where you book
  • Police Scotland, to ensure the event is safe and secure
  • UK government departments and public bodies, where necessary
  • The High level champions team who form part of the UK Presidency 
  • Scottish Multi-Agency Resilience Training & Exercise Unit, our training and exercising partners
  • Law enforcement agencies and medical professionals where necessary
  • Civil society groups where necessary to facilitate events
  • Our legal representatives and courts or tribunals in relation to legal proceedings relating to the events
  • To individuals making requests via statutory information access regimes, but only where doing so would not breach your data protection right to privacy
  • The National Archives for data that will form part of the UK historic record
  • Between the Joint Controllers of COP26 Data (the Cabinet Office, the Foreign, Commonwealth and Development Office, the United Nations and the United Nations Framework on Climate Change Secretariat). A copy of the Joint Controllers Agreement between these parties can be found here.

As your personal data will be stored on our IT infrastructure it will also be shared with our data processors who provide email, document management and storage services, and website hosting services. For those on our mailing list, your personal data will be shared by us with our IT supplier that provides mailing list management service.

Retention

Your personal data will be kept by us for up to six months after COP26 takes place, unless your data is considered to be a public record that must be preserved under the Public Records Act 1958. 

Data relating to criminal activity or legal proceedings will be retained until those matters are concluded. 

We will keep website analytics data for 26 months. 

Where personal data have not been obtained from you

If you did not provide your data it was obtained by us from the UNFCCC Secretariat, the UN, or from your country or country delegation. 

We may obtain data about criminal convictions and investigations from our vetting provider or Police Scotland. 

For media monitoring, your data may have been obtained from public media reporting or social media.

We may obtain your data from other UK government departments

YOUR RIGHTS

You have the right to request information about how your personal data are processed, and to request a copy of that personal data. 

You have the right to request that any inaccuracies in your personal data are rectified without delay. 

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement. 

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed. 

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted. 

You have the right to object to the processing of your personal data.

Where we are relying on consent: 

You have the right to withdraw consent to the processing of your personal data at any time.

INTERNATIONAL TRANSFERS

As your personal data is stored on our IT infrastructure, and shared with our data processors, it may be transferred and stored outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision, reliance on Standard Contractual Clauses, or because the transfer is to an international organisation for important reasons of public interest under Article 49(1) (d) UK GDPR. 

COMPLAINTS

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.  The Information Commissioner can be contacted at:  Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or 0303 123 1113, or casework@ico.org.uk.  Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts. 

CONTACT DETAILS

The data controllers for your personal data are the Cabinet Office, the Foreign, Commonwealth and Development Office, the United Nations Framework Convention on Climate Change Secretariat, and the United Nations, acting jointly. The lead data controller is the Cabinet Office. The contact details for the lead data controller are: Cabinet Office, 70 Whitehall, London, SW1A 2AS, or 0207 276 1234, or publiccorrespondence@cabinetoffice.gov.uk. 

The contact details for the lead data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk. 

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.