Privacy Notice

Introduction

This notice is for members, pensioners, beneficiaries and other individuals whose personal data is processed in connection with the Local Government Pension Scheme (LGPS) and Public Sector Pension Schemes administered by Local Pensions Partnership Administration Limited (LPPA).

LPPA provides pension administration services on behalf of the following administering authorities.

Data Controllers

The following organisations are the Data Controllers for the pension schemes administered by LPPA:

• Lancashire County Pension Fund
• Lancashire Fire and Rescue Service
• Lancashire Constabulary
• Cumbria County Council
• Cumbria Fire and Rescue Service
• Merseyside Fire and Rescue Service
• Bexley Pension Fund
• Hackney Pension Fund
• Hammersmith & Fulham
• Havering Pension Fund
• Hertfordshire Pension Fund
• Hertfordshire Fire and Rescue Service
• London Pensions Fund Authority
• Newham Pension Fund
• Brent Pension Fund
• Ealing Pension Fund
• Bedfordshire Fire and Rescue Service
• Kent Fire and Rescue Service
• London Fire Brigade

Where LPPA administers a pension fund on behalf of an administering authority, the relevant administering authority is the Data Controller and LPPA acts as a Data Processor, processing personal data in accordance with that authority’s instructions.

LPPA’s primary role is to provide pension administration services to these pension schemes. In carrying out these services, LPPA processes personal data on behalf of the relevant Data Controller.

In limited circumstances, LPPA may act as an independent Data Controller. These circumstances are identified throughout this notice and may include activities such as fraud prevention, service improvement and product development.

For further information about how your personal data is used for pension administration purposes, including the lawful basis for processing, retention periods and your data protection rights, please refer to the privacy notice of the relevant administering authority.

Where you have subsequently left your employer, references to “employer” in this notice also include your former employer.

Where do we get your data from?

The pension scheme managers or your employer provide us with details of pension scheme members and provide regular updates to enable us to maintain accurate records.

We administer pension schemes on behalf of the relevant Administering Authority under the applicable contractual arrangements in place for that scheme.

We may also obtain information directly from you when you contact us through our communication channels, including:

• Telephone
• Email
• PensionPoint
• Online forms on the LPPA website
• Postal correspondence

Where you are a beneficiary of a pension scheme, information may be obtained as a consequence of the member’s participation in the scheme and from other sources, including public records and government services such as:

• Register of Births, Deaths and Marriages
• Tell Us Once

Your data may also be provided to us by government departments, regulatory bodies and other organisations listed within this notice.

How is your data used?

Your personal data is processed in accordance with our agreements with the Administering Authorities and only where necessary to deliver pension administration services.

We use personal data for the following purposes:

• To contact you.
• To assess eligibility for benefits.
• To calculate and pay pension benefits.
• To administer beneficiaries’ benefits following a member’s death.
• For statistical, actuarial and financial modelling purposes.
• To comply with legal and regulatory obligations on behalf of the Administering Authorities.
• To respond to queries from members and beneficiaries.
• To identify and authenticate users accessing PensionPoint and other digital services.
• To manage and resolve complaints, disputes and pension administration issues.

For the purposes described above, LPPA acts as a Data Processor on behalf of the relevant Administering Authority.

Product Development and Service Improvement

In limited circumstances, LPPA may use personal data for product development, service improvement and the development of machine-learning technologies.

Only pseudonymised data will be used for these purposes and appropriate technical and organisational controls are in place to ensure that such data is processed securely.

Subject to agreement with the relevant pension schemes, pseudonymised member data may also be included within wider datasets for analysis activities, including:

• Demographic studies
• Mortality studies
• Longevity modelling
• Service improvement and planning

For these activities, LPPA acts as a Data Controller and relies upon its legitimate interests in developing and improving its systems, software and services.

What information do we need and why?

Your information is provided to us by the pension scheme, your employer, or by you directly.

We may request additional information where required to administer your pension benefits.

The types of personal data we may process include:

• Contact details, including your name, address, telephone number and email address.
• Identifying information, including date of birth, National Insurance number, employee number and membership number.
• Employment information used to calculate pension benefits, such as service history and salary information.
• Financial information relevant to pension payments, including bank account and tax details.
• Information about your family, dependants and personal circumstances, including marital status and beneficiary details.
• Health information where relevant to pension administration.

What lawful basis do we apply to processing your personal data?

The Administering Authorities and LPPA process personal data to ensure the effective administration of pension schemes and the payment of benefits.

The legal basis for processing will generally be one or more of the following:

a. Legal Obligation

Processing is necessary to comply with legal obligations relating to pension administration.

b. Public Task

Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

c. Legitimate Interests

Processing is necessary for the legitimate interests of administering pension schemes, calculating and paying benefits, and exercising rights and discretions relating to the schemes.

d. Contract

Processing is necessary to fulfil contractual obligations or to take steps at your request before entering into a contract, such as arrangements relating to Additional Voluntary Contributions (AVCs).

e. Product Development and Service Improvement

Where LPPA acts as a Data Controller for product development and service improvement activities, processing is based on LPPA’s legitimate interests in developing and improving its services, software and systems.

Who do we share your information with?

Your data may be shared with approved suppliers and service providers who support the delivery of pension administration services.

These include suppliers providing:

• Printing and mailing services
• Document management services
• Data storage services
• Pension administration systems
• Information technology support
• Hosting services

We may also be required to share information with:

• Law enforcement agencies where legally required
• Fraud prevention agencies
• Regulatory bodies, including The Pensions Regulator
• Other organisations identified in the relevant pension scheme privacy notice

In some circumstances, LPPA acts as a Data Controller when processing information for fraud prevention and investigation.

Organisations we may share your personal data with

Where necessary, personal data may be shared with:

• Administering Authorities
• Employers, their subsidiaries or prospective purchasers
• Software providers and technology suppliers
• Printing and mailing providers
• Tracing agencies
• Overseas payment providers
• Actuaries
• Internal and external auditors
• The Department for Work and Pensions
• The Government Actuary’s Department
• The Cabinet Office (for the National Fraud Initiative)
• HM Revenue & Customs (HMRC)
• Money and Pensions Service for the Pensions Dashboard Programme
• The Courts of England and Wales
• The Pensions Regulator
• Investment managers, insurers and other pension scheme providers

We do not use your information for marketing purposes and will not share your personal data for marketing.

International Transfers

Where possible, your personal data will not be processed outside the United Kingdom.

However, in limited circumstances some organisations that provide services to LPPA may process personal data outside the UK.

Where this occurs, LPPA and the Administering Authorities will ensure that an appropriate level of protection is applied by using one or more of the following safeguards:

• A country subject to a UK adequacy regulation.
• An International Data Transfer Agreement (IDTA) together with any necessary supplementary measures.
• The UK-US Data Bridge, where applicable.

How long do we keep your personal data?

We may retain your personal data for as long as pension benefits remain payable and thereafter for:

• 15 years after benefits cease; or
• 100 years from your date of birth; or
• 100 years from the date of birth of any beneficiary receiving benefits following your death, whichever period is longer.

In practice, this means pension records may be retained for a significant period due to the long-term nature of pension entitlements.

Your rights

Under UK data protection law, you have the following rights:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to object to processing
• Right to restrict processing
• Right to data portability
• Rights relating to automated decision-making
• Right to withdraw consent where processing is based on consent

LPPA does not carry out automated decision-making that produces legal or similarly significant effects.

How to exercise your rights

You will not normally be required to pay a fee to exercise your rights. However, a reasonable fee may be charged, or a request may be refused, where it is manifestly unfounded or excessive.

To exercise any of your rights, please contact the Data Protection Officer using the details at the end of this notice.

We may need to verify your identity before responding. We will normally respond within one month, although complex requests may take longer. If this happens, we will keep you informed.

Complaints

If you believe that your personal data has been handled unlawfully or unfairly, you have the right to make a complaint.

Please contact LPPA first using the details below. We will acknowledge receipt of your complaint, investigate the matter without undue delay and keep you informed of the outcome.

If you remain dissatisfied, you may lodge a complaint with the Information Commissioner’s Office (ICO):

Website: https://ico.org.uk
Telephone: 0303 123 1113

Updates

We may update this privacy notice from time to time.

Where material changes are made, we will inform members and publish an updated version of the notice, including the date on which the changes take effect.

Contacting Us and the Data Protection Officer

FAO: Data Protection Officer
Local Pensions Partnership Administration (LPPA)
Level 2 Christ Church Precinct
County Hall Complex
Preston
PR1 8XJ

Email: LPPA.DPO@localpensionspartnership.org.uk