Westmorland and Furness Council privacy notice Data Protection

This privacy notice relates to data breaches and cyber incidents. 

What information we collect

We need some personal data from you. This includes your:

  • name 
  • email address 
  • telephone number
  • location

We need some special category data from you. This includes:

  • incident description 
  • health and social care 
  • education 
  • family circumstances 
  • finance 

We need some criminal and law enforcement data from you. This includes:

  • legal proceedings
  • allegations
  • offences 

How we collect your data 

We’ll collect data from you through:

  • an online data breach reporting form
  • email 
  • telephone
  • in person

Why we collect your data

We're legally required under the UK General Data Protection Regulation (UKGDPR) to ensure the security and confidentiality of the data it holds. The UKGDPR provides a regulatory framework for the processing of personal data and Article 5 requires that: “personal data is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures”.

As the use of data and technology becomes more embedded in our daily lives, the likelihood of security incidents and/or data breaches (“incidents”) increases if adequate controls are not in place. Incidents will vary in impact and risk depending on the content, the quantity of data and number of individuals involved, therefore prompt action is required in all instances.  

We're required to have an effective Data Breach Reporting Procedure (DBRP) in place to not only identify, log, manage and respond to incidents, but also meet its wider obligations as a Data Controller.

Who we share your personal data with

Where there is a lawful reason to do so, we may share your data with:

  • the Information Commissioner’s Office (ICO)
  • the National Cyber Security Centre
  • local authorities
  • contractors such as ICT 
  • the NHS 
  • the police 

We process personal data by selecting at least one legal basis from:

  • UKGDPR Article 6(1) (c) Legal Obligation
  • UKGDPR Article 6(1) (e) Public Task/Public Interest/Official Authority 

Where we're relying on UKGDPR Article 6(1)(c), all Relevant Legislation is listed below. 

We process special category personal data under the condition of UKGDPR Article 9(2) (f) Necessary for the establishment, exercise or defence of legal claims.

We process criminal and law enforcement data under the condition of UKGDPR Schedule 8(6) Legal Claims. 

Relevant legislation

The relevant legislation includes UK General Data Protection Regulation (UKGDPR) - Article 33.