Mark: Fix accidental preformatted-text rendering from leading whitespace

2026-09-25T23:16:01Z

Fix accidental preformatted-text rendering from leading whitespace

Mark: Import privacy policy

2026-09-25T17:08:41Z

Import privacy policy

New page

''Last revised 25 May 2026. This policy describes how misconductinpublicoffice.org
processes personal data. It is written to be read by visitors, by data subjects
whose information appears on the site, and by anyone who contacts the campaign.
It is intended to comply with the United Kingdom General Data Protection
Regulation (the "UK GDPR"), the Data Protection Act 2018, and the Privacy and
Electronic Communications Regulations 2003 ("PECR").''

== Who we are ==

For the purposes of UK data protection law, the data controller for this site is
the editor of the campaign, contactable at <code>editor@misconductinpublicoffice.org</code>.
The campaign is not a registered company and is not part of any larger
organisation. It is an independent project operated by an identified individual
in the public interest.

Correspondence about data protection matters may be addressed to the editor at
the above email, or by post via the address set out at [[Project:Contact]].

== Categories of personal data we process ==

We process personal data in three distinct contexts. Each is described below
together with its lawful basis under Article 6 of the UK GDPR, the purpose, the
retention period, and the rights of the data subject.

=== 1. Personal data of subjects of editorial content ===

The site publishes pages about identified individuals and public bodies in the
context of conduct in public office. Where an identified natural person is the
subject of, or is referenced on, a published page, that constitutes processing
of personal data.

'''Categories of data processed''': name; role, office, or capacity in which
the person is referenced; conduct alleged or documented; documentary evidence
in support; the person's response or non-response under our right-of-reply
policy.

'''Lawful basis''': Article 6(1)(f) of the UK GDPR — legitimate interests
pursued by the controller and by the public in receiving information on matters
of public concern. The legitimate interests are: the prevention and exposure of
misconduct in public office, the right of the public to scrutinise the exercise
of public functions, and freedom of expression and information protected by
Article 10 of the European Convention on Human Rights.

The processing also engages the journalistic exemption at paragraph 26 of
Schedule 2 to the Data Protection Act 2018, in that it is undertaken with a
view to the publication of journalistic, academic, or literary material and
the controller reasonably believes that publication would be in the public
interest.

'''Special category data''': where a page references information disclosed in
public court proceedings or in public registers, special category data (for
example, criminal allegations or court findings) may be processed under
Article 9(2)(g) of the UK GDPR (substantial public interest in the publication
of information about misconduct in public office) and Schedule 1 Part 2 of
the Data Protection Act 2018.

'''Retention''': pages and their associated audit records are retained
indefinitely as part of the public record of the campaign, subject to the
corrections, takedown, and right-of-reply policies. Where the person ceases to
hold the public office in connection with which they are named, the page is
retained but updated to reflect that change. Where a person whose conduct is
documented dies, the page is reviewed for whether continued publication remains
in the public interest, but it is not automatically removed.

'''Rights''': as a data subject named in editorial content, you have the right
to: (a) request a copy of the personal data we hold about you; (b) request
rectification of any factual inaccuracy in that data; (c) submit a response
through the right-of-reply policy, which will be published verbatim on the page
that names you; (d) submit a complaint under the [[Project:Complaints and
takedown policy|complaints and takedown policy]]; and (e) complain to the
Information Commissioner's Office.

Where the journalistic exemption applies, certain other rights (notably the
right to erasure under Article 17) are restricted to the extent necessary to
secure the legitimate purpose of publication.

=== 2. Personal data of correspondents and contributors ===

When you contact the campaign — through the [[Project:Contact|contact form]],
by email, by post, by encrypted communication, or by submitting a response to
a notice — we process the personal data you provide.

'''Categories of data processed''': name (where given); email address (where
given); the content of your message; any attachments you provide; the date and
time of your correspondence.

'''Lawful basis''': Article 6(1)(b) of the UK GDPR (processing necessary to
take steps at your request) for processing your correspondence and replying to
it; Article 6(1)(f) (legitimate interests in maintaining the integrity of the
editorial process) for retaining a record of correspondence relevant to
published content.

'''Retention''': correspondence is retained for as long as it is necessary for
the purposes for which it was provided. Routine correspondence is retained for
12 months. Correspondence relevant to a published page (for example,
documentary material provided in support of a published assertion) is retained
as part of the audit record for that page, indefinitely, for the same period
as the page itself.

'''Source protection''': where you have identified yourself as a confidential
source, your identity is held in confidence by the editor and is not voluntarily
disclosed to any third party. The campaign maintains a journalistic-privilege
posture in respect of source-identifying material. Production orders served on
the campaign in respect of such material will be resisted through proper legal
process. We give no guarantees that such resistance will succeed but we
undertake that it will be made.

'''Rights''': you have the right to: (a) request a copy of the personal data we
hold about you; (b) request rectification of inaccurate data; (c) request
erasure of your data (subject to source-related exceptions where the data is
linked to published content that remains in the public interest); (d) withdraw
any consent you previously gave; and (e) complain to the Information
Commissioner's Office.

=== 3. Personal data of visitors to the site ===

When you visit a page on misconductinpublicoffice.org we process limited data
about your visit for operational purposes.

'''Categories of data processed''': IP address, in transient form only, for
rate-limiting and security purposes; user-agent string; the page accessed; the
time of the access. We do not use third-party analytics. We do not use
tracking cookies. We do not use advertising networks.

'''Lawful basis''': Article 6(1)(f) — legitimate interests in maintaining the
security and operational integrity of the site.

'''Retention''': IP addresses are retained in our server logs for a maximum of
72 hours, after which they are purged. Aggregate page-view counts (with no
personal data) are retained indefinitely.

'''Cookies''': the site sets a single session cookie for visitors who log in to
edit the wiki. No cookies are set for read-only visitors. We use no third-party
cookies, no advertising cookies, and no tracking cookies. The session cookie is
a strictly-necessary cookie within the meaning of regulation 6(4) of PECR and
does not require consent.

== Recipients of personal data ==

We do not share personal data with third parties other than:

* '''Hosting and infrastructure providers''', who host the site and the
correspondence systems on our behalf. Our hosting provider is identified at
[[Project:About]]. Infrastructure providers process data under contractual
obligations including obligations to maintain confidentiality and to
implement appropriate security measures.
* '''Legal advisers''', where the editor obtains legal advice in connection
with the site.
* '''Law enforcement and regulators''', where required by law or by a binding
court order. We resist demands that are not legally binding or that exceed
what is required. We publish information about such requests in our
transparency reporting at [[Project:Transparency]] except where prohibited
from doing so by law.
* '''The subject of the relevant content''', in respect of the publication
itself (publication is the disclosure).

We do not sell personal data. We do not transfer personal data to any party
for marketing or commercial purposes. We do not transfer personal data outside
the United Kingdom or the European Economic Area except to providers who
participate in adequacy mechanisms recognised by the UK government.

== Security ==

We implement appropriate technical and organisational measures to protect
personal data, including: end-to-end encryption of correspondence channels
where possible; encryption of personal data at rest in our storage; multi-factor
authentication on all administrative accounts using hardware security keys;
regular backups maintained in encrypted form and stored across multiple
jurisdictions; restricted access to systems containing personal data on the
basis of necessity. Source-identifying material is held with additional
operational security commensurate with the journalistic-privilege posture
described above.

No security measures are perfect. We do not represent that they are. We do
represent that the measures applied are appropriate to the nature of the data
and the risks of processing it.

== Your rights and how to exercise them ==

Under the UK GDPR you have the following rights, subject to the exceptions
identified above:

* '''The right to be informed''' — through this policy.
* '''The right of access''' — to obtain confirmation that we process your data
and a copy of the data we hold.
* '''The right to rectification''' — to have inaccurate data corrected.
* '''The right to erasure''' — to have your data deleted in certain
circumstances. This right is restricted where the data forms part of
published content protected by the journalistic exemption.
* '''The right to restrict processing''' — to limit how we use your data in
certain circumstances.
* '''The right to data portability''' — to receive your data in a structured,
commonly-used machine-readable form.
* '''The right to object''' — to object to processing based on legitimate
interests. Where the processing is for journalistic purposes the right to
object is restricted.
* '''Rights relating to automated decision-making''' — we do not make decisions
about you using automated processing.

To exercise any of these rights, contact the editor at
<code>editor@misconductinpublicoffice.org</code>. We aim to respond within one
calendar month. We do not charge a fee unless the request is manifestly
unfounded or excessive.

If you are dissatisfied with our response, you have the right to lodge a
complaint with the Information Commissioner's Office:

: Information Commissioner's Office
: Wycliffe House
: Water Lane, Wilmslow, Cheshire SK9 5AF
: www.ico.org.uk · 0303 123 1113

We would prefer the opportunity to resolve any concern before you escalate to
the ICO, but you are not required to come to us first.

== Changes to this policy ==

We will update this policy when our processing changes, when the legal regime
changes, or when we identify drafting that can be improved. Material changes
will be flagged at the top of the page and a record of revisions is maintained
in the page history.

== Contact ==

If anything in this policy is unclear, or if you wish to exercise any of the
rights above, please contact <code>editor@misconductinpublicoffice.org</code>.

[[Category:Policies]]
[[Category:Data protection]]

← Older revision		Revision as of 23:16, 25 September 2026
Line 141:		Line 141:

	* '''Hosting and infrastructure providers''', who host the site and the		* '''Hosting and infrastructure providers''', who host the site and the
	correspondence systems on our behalf. Our hosting provider is identified at		correspondence systems on our behalf. Our hosting provider is identified at
	[[Project:About]]. Infrastructure providers process data under contractual		[[Project:About]]. Infrastructure providers process data under contractual
	obligations including obligations to maintain confidentiality and to		obligations including obligations to maintain confidentiality and to
	implement appropriate security measures.		implement appropriate security measures.
	* '''Legal advisers''', where the editor obtains legal advice in connection		* '''Legal advisers''', where the editor obtains legal advice in connection
	with the site.		with the site.
	* '''Law enforcement and regulators''', where required by law or by a binding		* '''Law enforcement and regulators''', where required by law or by a binding
	court order. We resist demands that are not legally binding or that exceed		court order. We resist demands that are not legally binding or that exceed
	what is required. We publish information about such requests in our		what is required. We publish information about such requests in our
	transparency reporting at [[Project:Transparency]] except where prohibited		transparency reporting at [[Project:Transparency]] except where prohibited
	from doing so by law.		from doing so by law.
	* '''The subject of the relevant content''', in respect of the publication		* '''The subject of the relevant content''', in respect of the publication
	itself (publication is the disclosure).		itself (publication is the disclosure).

	We do not sell personal data. We do not transfer personal data to any party		We do not sell personal data. We do not transfer personal data to any party
Line 183:		Line 183:
	* '''The right to be informed''' — through this policy.		* '''The right to be informed''' — through this policy.
	* '''The right of access''' — to obtain confirmation that we process your data		* '''The right of access''' — to obtain confirmation that we process your data
	and a copy of the data we hold.		and a copy of the data we hold.
	* '''The right to rectification''' — to have inaccurate data corrected.		* '''The right to rectification''' — to have inaccurate data corrected.
	* '''The right to erasure''' — to have your data deleted in certain		* '''The right to erasure''' — to have your data deleted in certain
	circumstances. This right is restricted where the data forms part of		circumstances. This right is restricted where the data forms part of
	published content protected by the journalistic exemption.		published content protected by the journalistic exemption.
	* '''The right to restrict processing''' — to limit how we use your data in		* '''The right to restrict processing''' — to limit how we use your data in
	certain circumstances.		certain circumstances.
	* '''The right to data portability''' — to receive your data in a structured,		* '''The right to data portability''' — to receive your data in a structured,
	commonly-used machine-readable form.		commonly-used machine-readable form.
	* '''The right to object''' — to object to processing based on legitimate		* '''The right to object''' — to object to processing based on legitimate
	interests. Where the processing is for journalistic purposes the right to		interests. Where the processing is for journalistic purposes the right to
	object is restricted.		object is restricted.
	* '''Rights relating to automated decision-making''' — we do not make decisions		* '''Rights relating to automated decision-making''' — we do not make decisions
	about you using automated processing.		about you using automated processing.

	To exercise any of these rights, contact the editor at		To exercise any of these rights, contact the editor at

Misconduct in Public Office:Privacy policy - Revision history

Mark: Fix accidental preformatted-text rendering from leading whitespace

Mark: Import privacy policy