Shore-netting voluntary catch returns: privacy notice

Before registering for shore‑netting voluntary catch returns, please read our privacy notice. It tells you how we use your personal data.

Voluntary Catch Recording System for Shore‑Based Netting in Wales

Welsh Government takes your privacy seriously. This privacy notice explains how we collect, use and protect personal data associated with the Voluntary Catch Recording System (VCRS) for shore‑based netting in Wales.
For information about how personal data is handled more widely across Welsh Government, please see our corporate privacy notice.

Who we are and how our fisheries functions operate

Welsh Ministers are the data controllers for the information collected through the VCRS. Welsh Government carries out fisheries functions through separate teams with different purposes. The purpose of the processing determines whether the UK General Data Protection Regulation (UK GDPR) or Part 3 of the Data Protection Act 2018 (DPA 2018) applies.

• policy: to develop and deliver fisheries policy, legislation and operational programmes such as the VCRS. For this work, the Welsh Ministers are the data controller, and the UK GDPR & Part 2 DPA 2018 applies
• compliance and enforcement: if information indicates possible non‑compliance, it may be referred to enforcement officials (including Marine Enforcement Officers). Their role is to prevent, detect and investigate fisheries offences. For this processing, the Welsh Ministers act as a “competent authority”, and Part 3 DPA 2018 applies
• prosecution decisions and proceedings: where appropriate, enforcement cases may be referred for a prosecution decision. These decisions and the conduct of any criminal proceedings are the responsibility of the Counsel General for Wales, who is a “competent authority” for this purpose. Proceedings are usually carried out by external solicitors or counsel acting on the Counsel General’s behalf. Part 3 DPA 2018 applies

What the VCRS is and why we collect information

The VCRS is a voluntary system designed to collect catch‑related information from individuals using shore‑based nets in Wales. The data helps Welsh Government understand patterns in fishing activity, bycatch risks and potential impacts on migratory fish, supporting evidence‑based fisheries policy and conservation measures.

General purposes processing (UK GDPR and Part 2 DPA 2018)

Processing of personal data collected under the VCRS is carried out to support fisheries management and policy development principally undertaken in line with functions under the Fisheries Act 2020. In particular, the data gathered through this VCRS will be used to help determine whether additional regional or national protections are needed to prevent migratory fish bycatch by shore-based nets in Wales. 

What personal information we collect

During registration:

• email address only: after you register, the system generates a customer reference number (CRN) for your account. All catch‑return information is linked to this CRN, so policy officials access data using the CRN rather than your email address. Your email address is held separately from the policy data, and officials analysing VCRS returns do not have access to your contact information. No special category data is intentionally collected

How we control access to your contact details

There are limited situations where your email may be accessed. This would occur only if:

• a catch return appears to indicate a potential offence, and
• Welsh Government decides that it is necessary, proportionate and lawful for enforcement officers to link the return back to your identity

This is not the purpose of the system, but it may be required in specific enforcement cases.

Legal basis for processing (UK GDPR)

Welsh Ministers exercise a range of devolved functions relating to fisheries management, policy and regulation. These functions are delivered under the statutory frameworks that apply to fisheries in Wales, including the Fisheries Act 2020, international agreements such as the Trade and Cooperation Agreement (TCA), and the wider duties and powers of Welsh Ministers under the Government of Wales Act 2006.

In undertaking these public functions, Welsh Ministers may collect and process the information necessary to carry them out. This includes information required for fisheries management programmes such as the VCRS.

Data collection and processing for these purposes is carried out under the lawful basis of Article 6(1)(e) UK GDPR (public task), read with the relevant statutory functions and the Welsh Ministers’ ancillary powers (such as section 58A Government of Wales Act 2006) where required.

Where data is used for scientific or research purposes, processing is carried out in line with UK GDPR Chapter 8 (Articles 84A–84D). Data used for research is anonymised and, where appropriate, aggregated.

Law‑enforcement purposes (DPA 2018, Part 3)

Welsh Government is also generally responsible for the enforcement of fisheries legislation in Wales. If any information submitted to Welsh Government is relevant to the prevention, investigation, detection or prosecution of criminal offences, that information may need to be passed to Welsh Government's enforcement officials for further consideration for those purposes.

Legal basis for law‑enforcement processing (DPA 2018, Part 3)

• Welsh Ministers and the Counsel General act as a competent authority where it is necessary to process data for law enforcement purposes
• processing takes place under Section 35(2)(b) of the DPA 2018 – the processing is necessary for the performance of a task carried out for a law enforcement purpose by a competent authority
• processing is carried out only when necessary and proportionate to prevent, detect, investigate or prosecute offences

Examples include:

• reviewing information that may indicate a breach of fisheries regulatory requirements
• sharing information with other enforcement bodies where legally required
• supporting investigations where the Welsh Ministers act as the enforcement authority

How your data is stored

Personal data is stored on:

• secure Welsh Government systems
• secure systems operated by CEOX (as a data processor), where relevant

How long we keep your data

We retain personal data associated with the VCRS for 5 years from the date of collection, in line with Welsh Government retention schedules for fisheries‑related evidence, audit, and operational support. Anonymised research data may be retained for longer, as it is no longer personal data.

Data sharing

We may share information only where legally permitted or required.

Data may be shared with:

• other UK fisheries authorities
• marine and environmental regulators
• law‑enforcement bodies and prosecuting authorities
• marine licensing and system‑management bodies
• CEOX (as a processor)
• search and rescue organisations
• contracted analysts or inspectors working on behalf of Welsh Government

We do not share your data for marketing.

We do not intend to transfer your personal data outside the United Kingdom. 

Is participation mandatory?

No. Participation in the VCRS is entirely voluntary.

Your rights

Under UK GDPR, you have the right to:

• be informed about how your data is used
• access your personal data
• have inaccurate data corrected
• request erasure or restriction of processing
• object to processing
• data portability (where applicable)
• not be subject to automated decision‑making

Under Part 3 of the DPA 2018 (law‑enforcement processing), you have similar rights, except where restrictions apply for the purposes of preventing, detecting, investigating or prosecuting a crime.

You may also lodge a complaint with the Information Commissioner’s Office (ICO).

Freedom of Information

Information you provide may be subject to a Freedom of Information (FOI) request.
Personal data will not be released where an exemption applies under the Freedom of Information Act 2000 (FOIA) or the DPA 2018. You will be consulted if information relating to you is considered for disclosure.

Changes to this notice

We may update this privacy notice periodically. Any changes will be published on the Welsh Government website.