Misconduct in Public Office:Privacy policy

Last revised 25 May 2026. This policy describes how misconductinpublicoffice.org processes personal data. It is written to be read by visitors, by data subjects whose information appears on the site, and by anyone who contacts the campaign. It is intended to comply with the United Kingdom General Data Protection Regulation (the "UK GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 ("PECR").

Who we are

For the purposes of UK data protection law, the data controller for this site is the editor of the campaign, contactable at [email protected]. The campaign is not a registered company and is not part of any larger organisation. It is an independent project operated by an identified individual in the public interest.

Correspondence about data protection matters may be addressed to the editor at the above email, or by post via the address set out at Project:Contact.

Categories of personal data we process

We process personal data in three distinct contexts. Each is described below together with its lawful basis under Article 6 of the UK GDPR, the purpose, the retention period, and the rights of the data subject.

1. Personal data of subjects of editorial content

The site publishes pages about identified individuals and public bodies in the context of conduct in public office. Where an identified natural person is the subject of, or is referenced on, a published page, that constitutes processing of personal data.

Categories of data processed: name; role, office, or capacity in which the person is referenced; conduct alleged or documented; documentary evidence in support; the person's response or non-response under our right-of-reply policy.

Lawful basis: Article 6(1)(f) of the UK GDPR — legitimate interests pursued by the controller and by the public in receiving information on matters of public concern. The legitimate interests are: the prevention and exposure of misconduct in public office, the right of the public to scrutinise the exercise of public functions, and freedom of expression and information protected by Article 10 of the European Convention on Human Rights.

The processing also engages the journalistic exemption at paragraph 26 of Schedule 2 to the Data Protection Act 2018, in that it is undertaken with a view to the publication of journalistic, academic, or literary material and the controller reasonably believes that publication would be in the public interest.

Special category data: where a page references information disclosed in public court proceedings or in public registers, special category data (for example, criminal allegations or court findings) may be processed under Article 9(2)(g) of the UK GDPR (substantial public interest in the publication of information about misconduct in public office) and Schedule 1 Part 2 of the Data Protection Act 2018.

Retention: pages and their associated audit records are retained indefinitely as part of the public record of the campaign, subject to the corrections, takedown, and right-of-reply policies. Where the person ceases to hold the public office in connection with which they are named, the page is retained but updated to reflect that change. Where a person whose conduct is documented dies, the page is reviewed for whether continued publication remains in the public interest, but it is not automatically removed.

Rights: as a data subject named in editorial content, you have the right to: (a) request a copy of the personal data we hold about you; (b) request rectification of any factual inaccuracy in that data; (c) submit a response through the right-of-reply policy, which will be published verbatim on the page that names you; (d) submit a complaint under the [[Project:Complaints and takedown policy|complaints and takedown policy]]; and (e) complain to the Information Commissioner's Office.

Where the journalistic exemption applies, certain other rights (notably the right to erasure under Article 17) are restricted to the extent necessary to secure the legitimate purpose of publication.

2. Personal data of correspondents and contributors

When you contact the campaign — through the contact form, by email, by post, by encrypted communication, or by submitting a response to a notice — we process the personal data you provide.

Categories of data processed: name (where given); email address (where given); the content of your message; any attachments you provide; the date and time of your correspondence.

Lawful basis: Article 6(1)(b) of the UK GDPR (processing necessary to take steps at your request) for processing your correspondence and replying to it; Article 6(1)(f) (legitimate interests in maintaining the integrity of the editorial process) for retaining a record of correspondence relevant to published content.

Retention: correspondence is retained for as long as it is necessary for the purposes for which it was provided. Routine correspondence is retained for 12 months. Correspondence relevant to a published page (for example, documentary material provided in support of a published assertion) is retained as part of the audit record for that page, indefinitely, for the same period as the page itself.

Source protection: where you have identified yourself as a confidential source, your identity is held in confidence by the editor and is not voluntarily disclosed to any third party. The campaign maintains a journalistic-privilege posture in respect of source-identifying material. Production orders served on the campaign in respect of such material will be resisted through proper legal process. We give no guarantees that such resistance will succeed but we undertake that it will be made.

Rights: you have the right to: (a) request a copy of the personal data we hold about you; (b) request rectification of inaccurate data; (c) request erasure of your data (subject to source-related exceptions where the data is linked to published content that remains in the public interest); (d) withdraw any consent you previously gave; and (e) complain to the Information Commissioner's Office.

3. Personal data of visitors to the site

When you visit a page on misconductinpublicoffice.org we process limited data about your visit for operational purposes.

Categories of data processed: IP address, in transient form only, for rate-limiting and security purposes; user-agent string; the page accessed; the time of the access. We do not use third-party analytics. We do not use tracking cookies. We do not use advertising networks.

Lawful basis: Article 6(1)(f) — legitimate interests in maintaining the security and operational integrity of the site.

Retention: IP addresses are retained in our server logs for a maximum of 72 hours, after which they are purged. Aggregate page-view counts (with no personal data) are retained indefinitely.

Cookies: the site sets a single session cookie for visitors who log in to edit the wiki. No cookies are set for read-only visitors. We use no third-party cookies, no advertising cookies, and no tracking cookies. The session cookie is a strictly-necessary cookie within the meaning of regulation 6(4) of PECR and does not require consent.

Recipients of personal data

We do not share personal data with third parties other than:

• Hosting and infrastructure providers, who host the site and the

correspondence systems on our behalf. Our hosting provider is identified at Project:About. Infrastructure providers process data under contractual obligations including obligations to maintain confidentiality and to implement appropriate security measures.

• Legal advisers, where the editor obtains legal advice in connection

with the site.

• Law enforcement and regulators, where required by law or by a binding

court order. We resist demands that are not legally binding or that exceed what is required. We publish information about such requests in our transparency reporting at Project:Transparency except where prohibited from doing so by law.

• The subject of the relevant content, in respect of the publication

itself (publication is the disclosure).

We do not sell personal data. We do not transfer personal data to any party for marketing or commercial purposes. We do not transfer personal data outside the United Kingdom or the European Economic Area except to providers who participate in adequacy mechanisms recognised by the UK government.

Security

We implement appropriate technical and organisational measures to protect personal data, including: end-to-end encryption of correspondence channels where possible; encryption of personal data at rest in our storage; multi-factor authentication on all administrative accounts using hardware security keys; regular backups maintained in encrypted form and stored across multiple jurisdictions; restricted access to systems containing personal data on the basis of necessity. Source-identifying material is held with additional operational security commensurate with the journalistic-privilege posture described above.

No security measures are perfect. We do not represent that they are. We do represent that the measures applied are appropriate to the nature of the data and the risks of processing it.

Your rights and how to exercise them

Under the UK GDPR you have the following rights, subject to the exceptions identified above:

• The right to be informed — through this policy.
• The right of access — to obtain confirmation that we process your data

and a copy of the data we hold.

• The right to rectification — to have inaccurate data corrected.
• The right to erasure — to have your data deleted in certain

circumstances. This right is restricted where the data forms part of published content protected by the journalistic exemption.

• The right to restrict processing — to limit how we use your data in

certain circumstances.

• The right to data portability — to receive your data in a structured,

commonly-used machine-readable form.

• The right to object — to object to processing based on legitimate

interests. Where the processing is for journalistic purposes the right to object is restricted.

• Rights relating to automated decision-making — we do not make decisions

about you using automated processing.

To exercise any of these rights, contact the editor at [email protected]. We aim to respond within one calendar month. We do not charge a fee unless the request is manifestly unfounded or excessive.

If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office

Wycliffe House

Water Lane, Wilmslow, Cheshire SK9 5AF

www.ico.org.uk · 0303 123 1113

We would prefer the opportunity to resolve any concern before you escalate to the ICO, but you are not required to come to us first.

Changes to this policy

We will update this policy when our processing changes, when the legal regime changes, or when we identify drafting that can be improved. Material changes will be flagged at the top of the page and a record of revisions is maintained in the page history.

Contact

If anything in this policy is unclear, or if you wish to exercise any of the rights above, please contact [email protected].