We read the privacy notices published across central government, councils, tax and benefits offices, health bodies and policing. These are the patterns that repeat. A public body is not a company and you are not its customer: it holds your record because a law lets it, which changes what you can ask for and what you can expect back.
Authoritative identity data across agencies. Keep the record.
Public records and immigration or policing files are held for years to permanently.
Public services verify identity with official documents.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
A government file is the authoritative version of you, and the identifiers in it are the hardest of all to change. It also names the people recorded around you, who never dealt with the department at all.
Consent was never the deal
A government file does not rest on your agreement. Notices commonly say your consent is not required, even where they ask for it: the ground is the law and the department's own job. With some records, not giving what they ask is itself an offence.
The file exists whether or not you engage
Much of it never came from you. Departments collect from employers, banks, other departments and the people you live with, and a council tax file covers the household. You do not have to have filled anything in for the record to exist.
The law decides who gets it, and it can change
Your record passes between departments, councils, tax and benefit offices and fraud teams whenever a law allows, and it is matched against other databases as standing practice. The list of who can receive it grows with new legislation, while the notice you read stays the same.
It outlasts you, and you cannot always see it
How long is deferred to a schedule the notice never prints, often with no figure at all. Some basic data can stay for as long as your National Insurance number exists, and police and immigration files run to lifetimes. Seeing or erasing stops where it would get in the way of tax collection or crime detection.
Worked out from the industry, not from any one public body. What you actually handed over is yours to record.
The list understates it for police or borders: fingerprints, DNA and convictions sit in those files, and they are the hardest records of all to have changed.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Passport and ID photos feed facial systems.
Benefits and services can reveal conditions.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the public body grants itself.
Policing and immigration records carry very long statutory retention.
Health-records law sets long minimum retention for clinical data.
Tax and company law makes them keep billing and payment records.
They can keep records to defend a live or possible legal claim.
Some government records have a market the law itself allows. Driver and vehicle details are sold to private investigators, insurers and parking firms, under the same law meant to protect them, and in England and Wales councils sell the open electoral register to anyone who asks. Health bodies sit in a different market: access to patient records is licensed for research and commercial analysis, and a medical file is what extortion is built on.
A public body does not sell you, though data is shared across agencies.
Records feed fraud, risk, and facial-recognition systems.
There is little to anonymise: government records are built to identify you, and biometric photos match you for life.
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the Crowd: The privacy bounds of human mobility (Scientific Reports 3, 1376, 2013)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)
Clauses that recur across this industry, and what each one actually permits.
“necessary for the performance of a task carried out in the public interest, or the exercise of our official functions”
Your data can be used without your consent for anything within the body's official job. There is no consent to take back, an objection can be overridden, and the right to erase does not apply while the record serves that job.
THE MOVE Which of its functions covers your record is theirs to answer. Their reply goes on your record.
“required or allowed by law”
Your record can be handed to any body a law reaches, without asking you first. The law, not you, decides who qualifies, and new legislation can add more receivers while the notice stays the same.
THE MOVE A request asks where your record has gone, and under which law. Their reply goes on your record.
“likely to prejudice the prevention or detection of crime”
The same wording that grants your rights to see, correct, and erase can also switch them off: where answering might get in the way of tax collection, crime detection, or a fraud check, the body can refuse, and you cannot see whether the test was really met.
THE MOVE A request asks for the record anyway. The reply, or the silence, goes on your record.
Their own notice is the one that binds them. Pin it down with a request, and keep the reply. Start your record →