Westmorland and Furness Council privacy notice

Overview

 

When processing your personal, special category personal or criminal/law enforcement data, Westmorland and Furness Council (‘the Council’) is required under Articles 13 and 14 of the UK General Data Protection Regulation (UKGDPR) to provide you with the information contained in this Privacy Notice.

This notice explains what the Council will collect, who it will be shared with, why we need it and how we will use it. The Council will continually review and update this Privacy Notice to reflect service changes, feedback from customers and changes in the law.

The Council is also required to comply with the data protection principles as laid out in the UKGDPR, to ensure that personal data is:

  • processed lawfully, fairly and in a transparent manner
  • collected for specific, explicit, and legitimate purposes
  • adequate, relevant, and limited to the purposes for which it was collected
  • accurate and up to date
  • kept for no longer than is necessary for the purpose(s) for which it was collected
  • secured using appropriate technical or organisational measures

Registration

As an organisation that processes large amounts of personal, special category personal or criminal/law enforcement data, referred to in legislation as a data controller, the Council is required to register with the Information Commissioner’s Office (ICO).

Name: Westmorland and Furness Council

Address: 
South Lakeland House
Lowther Street
Kendal
Cumbria
LA9 4DQ

Registration number: ZB512761

Information Commissioner's Office: Westmorland and Furness Council Registration Certificate

Data controller arrangements

In most cases Westmorland and Furness Council is the data controller, however there may be instances where data is shared with another party as joint Data Controllers, or where the Council is operating as a data processor for another party.

Personal data

UKGDPR Article 4 defines personal data as: any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Special category personal data

UKGDPR Article 9 defines special category personal data as: racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Criminal/law enforcement data

The Council is a competent authority as described in Schedule 7 of the Data Protection Act 2018 and is permitted to process data for law enforcement purposes that include: the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

What information we collect

 

The Council will only collect personal, special category personal or criminal/law enforcement data where it is required to:

  • deliver a service 
  • make robust recommendations and decisions
  • meet a statutory requirement

In general, the Council collects the following types of personal data (dependent on the nature of the service(s) you are applying for or receiving):

  • business activities
  • case file information
  • date of birth
  • education and qualifications
  • email address (personal/work)
  • employment history
  • family details such as next of kin
  • finance/bank/payment details
  • housing needs
  • identifiers such as NHS Number
  • licenses or permits
  • lifestyle and social circumstances
  • name
  • physical description, appearance and behaviour
  • postal address
  • services received
  • telephone numbers (mobile/landline)
  • visual images such as photographs, CCTV

The Council will also collect information which is not unique to you such as your gender and postcode.

The Council may also collect special category personal data that includes:

  • biometrics such as fingerprints, facial recognition
  • criminal record including offences (including alleged offences), proceedings, outcomes and sentences
  • ethnic origin
  • physical or mental health
  • political affiliation/opinions
  • race
  • religious or other beliefs
  • sex life
  • sexual orientation
  • trade union membership

 Less often, the Council may collect criminal/law enforcement data, that includes: 

  • criminal convictions
  • offences

Personal, special category personal or criminal/law enforcement data being collected and processed at service-level will be laid out in specific Privacy Notices.

How we collect data

In general, the Council will collect personal, special category personal or criminal/law enforcement data from you in the following ways: 

  • on a paper or online form
  • by telephone
  • by email
  • recorded by CCTV cameras, or
  • in person by a member of our staff or one of our partners

Why we collect personal data

 

Where there is a lawful reason to do so the Council may share personal, special category personal or criminal/law enforcement data with: 

  • business associates and other professional advisers
  • courts, prisons and tribunals
  • credit reference agencies
  • current, past and prospective employers
  • customers
  • customs and excise
  • data processors
  • debt collection and tracing agencies
  • educators and examining bodies
  • employees and agents of the data controller
  • family, associates or representatives of the person whose personal data we are processing, e.g., next of kin, Power of Attorney, Guardians
  • financial organisations
  • fire authorities
  • healthcare, social and welfare organisations and professionals
  • housing associations and landlords
  • international law enforcement agencies and bodies
  • law enforcement and prosecuting authorities
  • legal representatives
  • licensing authorities
  • local and central government departments, specifically Department of Work and Pensions
  • Local Government Ombudsman/Information Commissioner
  • partner agencies, approved organisations and individuals working with the police
  • persons making an enquiry or complaint
  • police complaints authority
  • police forces
  • political organisations
  • press and the media
  • private investigators
  • professional advisers and consultants
  • professional bodies
  • providers of goods and services
  • regulatory bodies
  • religious organisations
  • security companies
  • service providers
  • students and pupils including their relatives, guardians, carers or representatives
  • survey and research organisations
  • the disclosure and barring service
  • trade unions
  • voluntary and charitable organisations
  • other departments within the Council to allow us to provide efficient and effective services

We will also comply with requests for specific personal, special category personal or criminal/law enforcement data from other Local Authorities or regulatory and law enforcement bodies where this is necessary and proportionate.  Before sharing we will always ensure that our partners have sufficient measures in place to protect your information in the same way we do.

We will never share your personal, special category personal or criminal/law enforcement data for marketing purposes, without your express consent.

How we use the data

Learn about how Westmorland and Furness uses personal data.

Where the Council identifies the requirement to process personal, special category/sensitive or criminal/law enforcement data, depending on the specific data being shared, it must have at least one of the following:

If we are relying on consent to process your personal, special category personal or criminal/law enforcement data, you have the right to object at any time by contacting the service or officer the data was provided to.

CCTV and surveillance

We operate surveillance equipment within some of our services for the purpose of either, public and staff safety, or the prevention and detection of crime. CCTV is also installed on the outside of some of our buildings for the purposes of monitoring building security and crime prevention and detection.

Read more about our use of CCTV and how to request footage

Automated decision making and profiling

Automated individual decision-making is a decision made by automated means without any human involvement. Automated individual decision-making does not have to involve profiling, although in some cases it might.

Find a definition of Profiling on uk-gdpr.org 

Read more information about your rights related to automated decision making on ico.org.uk

We do not use your information for automated decision-making or profiling purposes.

National Fraud Initiative and data matching

The Council is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing, administering public funds or where undertaking a public function, in order to prevent and detect fraud.

The Council is required to participate in the Cabinet Office's National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud. The Council is obliged to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise. The Cabinet Office is responsible for carrying out data matching exercises in accordance with the code of data matching practice.

Learn about the code of data matching practice on GOV.UK

Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

For further information on the Cabinet Office exercise please see:

•   public sector data requirements on GOV.UK 
•    information about fair processing on GOV.UK

For further information please contact us

Cabinet Office's National Fraud Initiative
Email: nfi.WAF@westmorlandandfurness.gov.uk

Refer to our services privacy notices

Elected Members

In order for Elected Members to act on your behalf and resolve the issues you have raised they may need to collect some personal, special category personal or criminal/law enforcement data.  This could include your name and address, and/or sensitive personal data, which could be concerning your health or ethnic origin.

In some circumstances your explicit consent may be needed to allow for the processing of your data.  If this is needed the relevant Elected Member will contact you directly.

Elected Members will:

  • only share data with the organisations necessary to deal with your enquiry such as different council departments, and to resolve any issues you have raised
  • not share your data with third parties, unless it is required for law enforcement purposes to prevent or detect crime, to protect public funds or where required or permitted to share data under other legislation
  • keep your data secure using the Council's secure IT and email systems
  • retain/destroy your data in accordance with the Council's Retention and Disposal Schedule

You have the right to access your personal, special category personal or criminal/law enforcement data and to rectify mistakes, erase, restrict, object or move your data in certain circumstances.

You can withdraw your consent for your personal, special category personal or criminal/law enforcement data to be processed as described above at any time.  If you would like this to happen or you have a complaint about how your data is handled, please contact your Elected Member.

If you are not satisfied with the response or believe the Elected Member is not processing your personal, special category personal or criminal/law enforcement data in accordance with the law you can complain to the Information Commissioner's Office (ICO) using ICO Data protection and personal information complaints tool.

Data transfers

It may sometimes be necessary to transfer personal, special category personal or criminal/law enforcement data beyond the UK to comply with legal or other obligations.

Where data is required to be transferred to the European Union or other adequate countries the Council will ensure that all relevant safeguards are in place before this takes place and that all aspects of the UKGDPR/Data Protection Act 2018 are complied with.

Data requested for transfer to non-adequate countries will be subject to a Transfer Impact Assessment, that includes the identification of appropriate safeguards prior to data being authorised for transfer.

Data security and retention

The Council is required by UKGDPR Article 32 to ensure that appropriate organisational and security measures are in place to protect your personal, special category personal or criminal/law enforcement data. 

Security measures include: anonymisation, pseudonymisation, encryption, access controls on systems, regular testing of our systems, security training for all employees. You can find further information in the following documents:

If you access information online, the Council website does not store or capture personal information, but merely logs a number called your IP address which is automatically recognised by the system. The system will record personal information if you:

  • subscribe to or apply for services that require personal information
  • report a fault and give your contact details for us to respond
  • contact us and leave your details for us to respond

See our cookie policy

Westmorland and Furness Council will only store your information for as long as is legally required or in situations where there is no legal retention period established best practice will be followed. In accordance with our Retention and Disposal Schedule (XLSX, 339KB).

To help you understand the Schedule the Council has published a Retention Schedule quick user guide (PDF, 598KB).

If you have any questions about the Schedule or the Quick User Guide, please contact us:

Email: recordsmanagement@westmorlandandfurness.gov.uk

If you experience any problems in relation to your personal data or you see something that doesn't look right, contact us:

Email: dataassurance@westmorlandandfurness.gov.uk 

Contacting the Council 

Emails

If you email us, we may keep a record of your contact and your email address and the email for our record keeping of the transaction. We suggest that you keep the amount of confidential information you send to us via email to a minimum and use our secure online forms and services. Where available, you can sign up for email alerts for selected services using an external service from GovDelivery, with control over your preferences.

Telephone calls

The Council will inform you if your telephone calls are being recorded or monitored and will not record any financial card details if you make payments by telephone.

Your rights: Data Subject Access

Learn about your rights when making a Subject Access Request.

What is a Subject Access Request?

Individuals have the right to access and receive a copy of their personal data, and other supplementary information held by Westmorland and Furness Council. This is commonly referred to as a Subject Access Request or ‘SAR’.

Subject Access Requests can be made verbally or in writing, including via social media. Please see ‘Submitting Subject Access Requests’ below for information.

Data Subjects can make requests themselves, or ask another person to do it on their behalf, such as a child (under 12), attorney, litigation friend. In these circumstances the Council will need to see evidence of permission to request the data of another person and it should be emailed at the same time as the request is submitted. Failure to provide evidence may result in delays with handling your request or it being declined.

In most cases the Council does not charge a fee for handling Subject Access Requests, it can however charge a fee:

  • where a request is repeated to cover administrative costs
  • where a request is manifestly unfounded or excessive
  • in some circumstances, we may refuse to handle Subject Access Requests where they are vexatious, manifestly unfounded or excessive

Please be aware that the Council may seek evidence of your identity and clarification of your request to assist with the identification of relevant information.

Once your request has been accepted, the Council will:

  • provide a response within one calendar month (where possible)
  • inform you if your request cannot be responded to within one calendar month, as it is complex or you have submitted more than one request (the deadline for providing a response can be extended by up to a further two months)
  • conduct reasonable searches for the requested information
  • inform you if information is exempt from disclosure
  • provide a response via secure email unless an alternative format has been requested

Submit a Subject Access Request

If you would like to submit a request or you would like assistance with submitting a request, please contact us:

Post: Westmorland and Furness Council, PO Box 304, Kendal, LA9 9GY
Email: subjectaccess@westmorlandandfurness.gov.uk

If you have any concerns about how your personal data is being used by the Council please contact us:

Data Protection Officer
Email: dataassurance@westmorlandandfurness.gov.uk 

Your Rights: Other

In addition to your right of access the UKGDPR gives you the following rights:

  • the right to be informed via the Council's Privacy Notice
  • the right to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point
  • the right of rectification, we must correct inaccurate or incomplete data within one month
  • the right to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information. Where your personal data has been shared with others, we will ensure those using your personal data comply with your request for erasure
  • the right to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future
  • the right to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked
  • the right to object. You can object to your personal data being used for profiling, direct marketing or research purposes
  • you have rights in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention

Unless otherwise stated above you can exercise any of these rights by contacting:

Data Protection Officer
Email: dataassurance@westmorlandandfurness.gov.uk 
Post: Westmorland and Furness Council, PO Box 304, Kendal, LA9 9GY

Where our processing of your personal, special category personal or criminal/law enforcement data is based on your consent, you have the right to withdraw your consent at any time. 

If you do decide to withdraw your consent, we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on - in which case, we will let you know. 

If you withdraw your consent, it won't impact any of our processing up to that point but may affect the services you are eligible for in future.

If you’d like to discuss withdrawing your consent in relation to data processing please contact us:

Data Protection Officer
Email: dataassurance@westmorlandandfurness.gov.uk 
Post: Westmorland and Furness Council, PO Box 304, Kendal, LA9 9GY

Verifying Your Identity

When exercising the rights mentioned above, please be aware that under UKGDPR Article 12(6) additional information can be requested to verify that you are the data subject if your identity is unconfirmed. Please note that:

  • additional documentation is only required when the Council cannot verify your identity using internal council systems that relate to the service you are requesting information about
  • the Council will contact you for this documentation prior to processing your request
  • the statutory deadline for responding to your request will start when you have provided the additional documentation
  • failure to provide additional documentation may lead to the Council rejecting your request

Complaints

If you have concerns about the way the Council has processed your data, please contact:

Data Protection Officer
Email: dataassurance@westmorlandandfurness.gov.uk 
Post: Westmorland and Furness Council, PO Box 304, Kendal, LA9 9GY

If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you can complain to the Information Commissioner's Office (ICO).

Make a complaint on ico.org.uk