The Independent Monitoring Authority for the Citizens’ Rights Agreements Privacy Notice
3rd Floor Swansea Civic Centre
This privacy notice sets out the standards that you can expect from the Independent Monitoring Authority for the Citizens’ Rights Agreements (IMA) when we request or hold personal information (‘personal data’) about you; how you can get access to a copy of your personal data; and what you can do if you think the standards are not being met.
The IMA is an Arm’s Length Body of the Ministry of Justice (MoJ). The IMA collects and processes personal data for the exercise of its own and associated public functions. These include monitoring the legislation which implements the rights of EU and EEA EFTA citizens, and monitoring the delivery by relevant public authorities of these rights.
The IMA website IMA-citizensrights.org.uk is provided by the IMA.
About personal information
Personal data is information about you as an individual. It can be your name, address or telephone numbers, nationality, date of birth, email address and your national insurance number. The IMA may subsequently request further information, on a case-by-case basis, where relevant to pursuing an inquiry.
We know how important it is to protect the public’s privacy and to comply with data protection laws. We will safeguard your personal data and will only disclose it where it is lawful to do so, or with your consent.
How we get personal information and why we have it
Most of the personal information we process is provided to us directly by you for one of the following reasons:
- you would like to make a complaint about a concern regarding public authorities’ compliance with the citizens right agreement
- you provide us with intelligence about the experience of EU and EEA EFTA citizens
- you have a concern regarding the implementation of citizens’ rights
- you believe you are being denied your citizens’ rights
We also may receive personal information indirectly from organisations who act on your behalf such as advice bodies.
Purpose of processing and the lawful basis for the process
Under the General Data Protection Regulations (GDPR), the lawful bases we rely on for processing this information are:
- we need it to perform a public task.
Who the information may be shared with
We sometimes need to share the personal information we process with the individual themselves and also with other organisations. Where this is necessary we will comply with all aspects of the data laws.
We use Google Analytics software to collect information about how you use the IMA website. This includes IP addresses. The data is anonymised before being used for analytics processing.
Google Analytics processes anonymised information about:
- the pages you visit
- how long you spend on each page
- how you got to the site
- what you click on while you’re visiting the site
We do not store your personal information through Google Analytics (for example your name or address).
We will not identify you through analytics information, and we will not combine analytics information with other data sets in a way that would identify who you are.
We continuously test and monitor our data protection controls to make sure they’re effective and to detect any weaknesses.
How we store your personal information
Information will be retained in line with the IMA’s record retention schedule, which sets out that information relating to complaints and investigations will be kept for seven years before being destroyed.
Access to personal information
You can find out if we hold any personal data about you by making a ‘subject access request’. If you wish to make a subject access request please contact:
We will respond to your requests in line with timelines set out in data protection legislation.
If you consider that your information has been handled incorrectly, you can contact the Information Commissioner for independent advice about data protection. You can contact the Information Commissioner at:
Information Commissioner’s Office
Tel: 0303 123 1113