County Parish Holdings and livestock movements: privacy notice

1.1. This notice informs you about Welsh Government’s use of the information provided in your application for a CRN for the purposes of requesting a new County Parish Holding (CPH) number. It also explains Welsh Government’s processing and use of your personal data and your rights under the General Data Protection Regulation. The data controller for the information is: 

Details of the Data Protection Officer are listed below.

1.2. The information will be processed and managed by the Welsh Government in accordance with its obligations and duties under the following European Regulations:

• Council Regulation 1760/2000
• Council Regulation 21/2004
• Council Directive 2008/71
• General Data Protection Regulation (EU) No 679/2016

The information will primarily be used for the purposes of processing and determining applications for a CPH number, or changes to the land included in a CPH. However, Welsh Government may also make use of the information supplied for the purposes of animal traceability for disease control.

1.3. The lawful basis for the processing is that it is necessary for the performance of a task carried out in the exercise of official authority vested in Welsh Government.

1.4. Welsh Government collects personal data to identify your location and your farm business(es). Welsh Government does not collect any special category data.

1.5. The data is processed through an automated process of business rules that use the Customer Reference Number (CRN) as a primary key for the majority of reports.

1.6. Your information will be held by Welsh Government for as long as your CPH is active. If your CPH is closed, we will hold your information for at least 7 years for disease control and animal traceability purposes. We may extend this if it is necessary to carry out a task that is in the public interest or as is required of the data controller.

Examples include:

• appeal
• audit activity
• complaint
• irregularity
• historic value, as determined by the Public Records Act
• legal action
• a formal request for information
• if it sets a precedent

Where possible personal data will be redacted or access restricted.

2.1. Welsh Government may share information for disease control and traceability purposes with:

• Animal and Plant Health Agency
• Veterinary Medicine Directorate
• Welsh Local Authorities
• Food Standards Agency Wales
• DEFRA
• other UK Government Agriculture Offices

2.2. The information may be used for the following:

• Cross Compliance and cross checking between Governmental organisations to prevent breaches of the Common Agricultural Policy schemes
• the production and publication of maps showing the areas of land that are used for livestock purposes
• compilation of reports of aggregated data and/or summary statistics to be made publicly available
• identification of landowners/users in events of emergencies, e.g. disease control and breach control
• allowing partner organisations to fulfil their legal duties
• publication of certain information and responding to requests for information

3.1. Your information, including your personal information, may be the subject of a request by another member of the public. When responding to such requests Welsh Government may be required to release information, including your personal information.

4.1. The GDPR gives individuals rights in respect of the personal data held on them. These rights include:

• the right to be informed (this notice)
• the right to ask for and receive copies of the personal data that Welsh Government holds about them, although Welsh Government can sometimes withhold some data or not provide copies
• the right, in some circumstances, to prevent or restrict Welsh Government processing personal data
• the right, in some circumstances, to have wrong data rectified
• the right, in some circumstances, to have data erased (to be forgotten)

If you wish to exercise any of your rights under the GDPR, you should contact Welsh Government at the address provided in this notice.

4.2. Individuals also have the right to ask the Information Commissioner, who enforces and oversees the GDPR, to assess whether or not the processing of their personal data is likely to comply with the GDPR. The Information Commissioner can be contacted at:

Welsh Government is committed to handling your personal data safely, securely and only for as long as we need.

If you have any concerns about how we use your personal data, we encourage you to raise them with the relevant team in the first instance.

You can also contact the Data Protection Officer at:

If you wish to make a formal complaint about how Welsh Government has processed your personal data, you can complain about Welsh Government.

We will acknowledge your complaint and respond within an appropriate timescale, in line with data protection legislation and our complaints process.