Details
- Name of service - National Trading Standards Scams Team
- Directorate - Community Protection and Emergencies
- Date of issue - 14 January 2020
- Date of current version - 15 September 2026
- Review date - 31 March 2027
Notice
The reasons why we use your personal data
This privacy notice applies to the functions of the National Trading Standards (NTS) Scams Team. The NTS Scams Team is hosted by Surrey County Council (SCC) and helps tackle mass marketing scams and disrupts the operations of perpetrators behind mail scams. It works in partnership with agencies across the country to identify and support victims of mass marketing fraud. The team provides guidance, best practice and establishes a centre of excellence to assist local authorities in supporting local victims and taking local enforcement action.
What processing of personal data is undertaken by the team
Your personal data is collated in order to carry out our functions in relation to law enforcement on one or more of the following bases:
- You have given your consent to the processing of your data for a law enforcement purpose which has been communicated to you; or
- The processing is necessary for the performance of a task carried out for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
What information do we collect?
Name, address, contact details, health details (in some instances), date of birth or age, financial details, family details such as names of relatives, lifestyle and social circumstances details and conviction data.
How we are allowed to use your personal data
SCC is a competent authority processing personal data for law enforcement purposes as set out in part 3 of the Data Protection Act 2018 (DPA18).
Our legal basis for processing law enforcement data is that it is necessary for the performance of functions contained in:
- Consumer Rights Act 2015
- Consumer Protection from Unfair Trading Regulations 2008
- Enterprise Act 2002
Consent
In some circumstances SCC may obtain your consent. If consent is required to process your personal data, we will explain to you what we are asking you to agree to and why. If we have consent to use your personal data, you have the right to remove it at any time. If you want to remove your consent, please contact us at the following email address: scamsteamadmin@surreycc.gov.uk and we will deal with your request.
Your Rights
It is important to note that subject access rights and the rights to rectification, erasure and restriction do not apply to the processing of 'relevant personal data' in the course of a criminal investigation or criminal proceedings.
Who we share your personal data with
Local Authority Trading Standards services, law enforcement agencies and data processors who act on our behalf, and in some instances Cifas.
Automated decision making (when computers make any decisions about you)
We do not use automated decision making
Personal data being sent or processed outside of the UK and European Union (EU)
SCC uses third-party suppliers to support document management and other services. Some of these suppliers may process personal data outside the UK. SCC takes appropriate steps to ensure that personal data remains secure and is processed in accordance with applicable data protection legislation.
The NTS Scams Team uses suppliers located in the European Economic Area (EEA), the United States (US), Gibraltar, and other countries, territories or sectors that are recognised by UK adequacy regulations as providing an adequate level of protection for personal data. Where a supplier is located in a country that is not covered by UK adequacy regulations, SCC will only transfer personal data where appropriate safeguards are in place.
For transfers to organisations located in the EEA, Gibraltar and other jurisdictions covered by UK adequacy regulations, SCC relies on those adequacy regulations. For transfers to organisations in the United States, SCC relies on the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge) and only transfers personal data to organisations that are certified under that framework.
SCC also works with international law enforcement partners, some of whom are located outside the UK.
Personal data may be shared for law enforcement purposes with organisations in EEA member states, Switzerland and Gibraltar where the requirements of the Data Protection Act 2018 and applicable adequacy arrangements are met. Personal data may also be shared with other international law enforcement partners in accordance with sections 75 and 76 of the Data Protection Act 2018, which provide safeguards for individuals and are subject to oversight by the Information Commissioner's Office.
Retention of data
Data will be retained for six years plus current year. After this date data is then anonymised or erased from the NTS Scams Team's systems.
Other information
For further information on our privacy notices, please see information and privacy.