Privacy Statement | Causeway Coast & Glens Borough Council

Your Privacy

effective 25 May 2018

Introduction

Causeway Coast and Glens Borough Council as a data controller, is registered with the Information Commissioner and is committed to protecting your privacy when you use our services.

The Privacy Notice below explains how we use information about you and how we protect your privacy.

As a public authority, Council must have a Data Protection Officer who makes sure we respect your rights and follow the law. If you have any concerns or questions about how we look after your personal information, please contact the Data Protection Officer at dpo@causewaycoastandglens.gov.uk or alternatively, phone 028 70 347 034.

Council’s services fall into the broad headings of:

Leisure and Development
Environment Services
Planning
Corporate Services
Assistive functions of Information Technology, Human Resources and Finance.

Under each service area on the website is more information about the services we provide and who we may share your information with and why. Privacy information for the assistive functions of Finance, Human Resources and Information Technology is available to download.

Further information about local authorities responsibilities within Northern Ireland can be found at government's one stop portal NIDirect.

Why we use your personal information

Do you know what personal information is?

Personal information can be anything that identifies and relates to a living person. This can include information that when put together with other information can then identify a person. For example, this could be your name and contact details.

Did you know that some of your personal information might be ‘special’?

Some information is ‘special’ and needs more protection due to its sensitivity. It’s often information you would not want widely known and is very personal to you. This is likely to include anything that can reveal your:

sexuality and sexual health
religious or philosophical beliefs
ethnicity
physical or mental health
trade union membership
political opinion
genetic/biometric data
criminal history

Why do we need your personal information?

We may need to use some information about you to:

deliver services and support to you;
manage those services we provide to you;
train and manage the employment of our workers who deliver those services;
help investigate any worries or complaints you have about your services;
keep track of spending on services;
check the quality of services; and
to help with research and planning of new services

How the law allows us to use your personal information

There are a number of legal reasons why we need to collect and use your personal information.

Each privacy notice for each service explains which legal reason is being used. Generally we collect and use personal information in the where:

you, or your legal representative, have given consent
you have entered into a contract with us
it is necessary to perform our statutory duties
it is necessary to protect someone in an emergency
it is required by law
it is necessary for employment purposes
it is necessary to deliver health or social care services
you have made your information publicly available
it is necessary for legal cases
it is to the benefit of society as a whole
it is necessary to protect public health
it is necessary for archiving, research, or statistical purposes

If we have consent to use your personal information, you have the right to remove it at any time. If you want to remove your consent, please contact us, telling us which service you’re using so we can deal with your request.

We only use what we need!

Where we can, we’ll only collect and use personal information if we need it to deliver a service or meet a requirement.

If we don’t need personal information we’ll either keep you anonymous if we already have it for something else or we won’t ask you for it. For example in a survey we may not need your contact details we’ll only collect your survey responses.

If we use your personal information for research and analysis, we will keep you anonymous or use a different name unless you’ve agreed that your personal information can be used for that research.

We don’t sell your personal information to anyone else.

What you can do with your information

The law gives you a number of rights to control what personal information is used by us and how it is used by us.

Right to seek a judicial remedy

As an individual you have the right to seek an effective judicial remedy against non-compliance with the GDPR or Parts 2 and 3 of the Data Protection Act 2018

You can ask for access to the information we hold on you

Whenever we assess your needs or provide you with services, we would normally expect to share with you, the nature of the records made.

However, you also have the right to ask for all the information we have about you and the services you receive from us. When we receive a request from you in writing, we must give you access to everything we’ve recorded about you.

However, we can’t let you see any parts of your record which contain:

Confidential information about other people; or
Data a professional thinks will cause serious harm to your or someone else’s physical or mental wellbeing; or
If we think that giving you the information may stop us from preventing or detecting a crime

This applies to personal information that is in both paper and electronic records. If you ask us, we’ll also let others see your record (except if one of the points above applies).

If you can’t ask for your records in writing, please talk with the Data Protection Officer who will assist.

You can ask to change information you think is inaccurate

You should let us know if you disagree with something written on your file.

We may not always be able to change or remove that information but we’ll correct factual inaccuracies and may include your comments in the record to show that you disagree with it.

You can ask to delete information (right to be forgotten)

In some circumstances you can ask for your personal information to be deleted, for example:

Where your personal information is no longer needed for the reason why it was collected in the first place
Where you have removed your consent for us to use your information (where there is no other legal reason us to use it)
Where there is no legal reason for the use of your information
Where deleting the information is a legal requirement

Where your personal information has been shared with others, we’ll do what we can to make sure those using your personal information comply with your request for erasure.

Please note that we can’t delete your information where:

we’re required to have it by law
it is used for freedom of expression
it is used for public health purposes
it is for, scientific or historical research, or statistical purposes where it would make information unusable
it is necessary for legal claims

You can ask to limit what we use your personal data for

You have the right to ask us to restrict what we use your personal information for where:

you have identified inaccurate information, and have told us of it
where we have no legal reason to use that information but you want us to restrict what we use it for rather than erase the information altogether

When information is restricted it can’t be used other than to securely store the data and with your consent to handle legal claims and protect others, or where it’s for important public interests of the UK.

Where restriction of use has been granted, we’ll inform you before we carry on using your personal information.

You have the right to ask us to stop using your personal information for any council service. However, if this request is approved this may cause delays or prevent us delivering that service.

Where possible we’ll seek to comply with your request, but we may need to hold or use information because we are required to by law.

You can ask to have your information moved to another provider (data portability)

You have the right to ask for your personal information to be given back to you or another service provider of your choice in a commonly used format. This is called data portability.

However this only applies if we’re using your personal information with consent (not if we’re required to by law) and if decisions were made by a computer and not a human being.

It’s likely that data portability won’t apply to most of the services you receive from the Council.

You can ask to have any computer made decisions explained to you, and details of how we may have ‘risk profiled’ you.

You have the right to question decisions made about you by a computer, unless it’s required for any contract you have entered into, required by law, or you’ve consented to it.

You also have the right to object if you are being ‘profiled’. Profiling is where decisions are made about you based on certain things in your personal information, e.g. your health conditions.

If and when Council uses your personal information to profile you, in order to deliver the most appropriate service to you, you will be informed.

If you have concerns regarding automated decision making, or profiling, please contact the Data Protection Officer who’ll be able to advise you about how we using your information.

Who do we share your information with?

We use a range of organisations to either store personal information or help deliver our services to you. Where we have these arrangements there is always an agreement in in place to make sure that the organisation complies with data protection law.

Where required, Council will have to complete a privacy impact assessment (PIA) before we share personal information to make sure we protect your privacy and comply with the law.

Sometimes we have a legal duty to provide personal information to other organisations. This is often because we need to give that data to courts, including if the court orders that we provide the information.

We may also share your personal information when we feel there’s a good reason that’s more important than protecting your privacy. This doesn’t happen often, but we may share your information:

in order to find and stop crime and fraud; or if there are serious risks to the public, our staff or to
other professionals; or
to protect a child.

For all of these reasons the risk must be serious before we can override your right to privacy.

If we’re worried about your physical safety or feel we need to take action to protect you from being harmed in other ways, we’ll discuss this with you and, if possible, get your permission to tell others about your situation before doing so.

We may still share your information if we believe the risk to others is serious enough to do so.

There may also be rare occasions when the risk to others is so great that we need to share information straight away.

If this is the case, we’ll make sure that we record what information we share and our reasons for doing so. We’ll let you know what we’ve done and why if we think it is safe to do so.

How do we protect your information?

We’ll do what we can to make sure we hold records about you (on paper and electronically) in a secure way, and we’ll only make them available to those who have a right to see them. Examples of our security include:

Encryption, meaning that information is hidden so that it cannot be read without special knowledge (such as a password). This is done with a secret code or what’s called a ‘cypher’. The hidden information is said to then be ‘encrypted’
Pseudonymisation, meaning that we’ll use a different name so we can hide parts of your personal information from view. This means that someone outside of the Council could work on your information for us without ever knowing it was yours
Controlling access to systems and networks allows us to stop people who are not allowed to view your personal information from getting access to it
Training for our staff allows us to make them aware of how to handle information and how and when to report when something goes wrong
Regular testing of our technology and ways of working including keeping up to date on the latest security updates (commonly called patches)

Where in the world is your information?

The majority of personal information is stored on systems in the UK. But there are some occasions where your information may leave the UK either in order to get to another organisation or if it’s stored in a system outside of the EU.

We have additional protections on your information if it leaves the UK ranging from secure ways of transferring data to ensuring we have a robust contract in place with that third party.

We’ll take all practical steps to make sure your personal information is not sent to a country that is not seen as ‘safe’ either by the UK or EU Governments.

If we need to send your information to an ‘unsafe’ location we’ll always seek advice from the Information Commissioner first.

How long do we keep your personal information?

There’s often a legal reason for keeping your personal information for a set period of time, and we try to include all of these in our retention and disposal schedule. This ranges from months for some records to decades for more sensitive records. The retention and disposal schedule was laid before the Northern Ireland Assembly in 2016.

How can I submit a request?

A form for use with submission of a request is available to download here and complete.

Comments, compliments and complaints

When the Council receives a complaint it makes up a file containing the details of the complaint. This normally contains the identity and contact details of the complainant and any other individuals involved in the complaint. The Council will only use the personal information it collects to process the complaint and to check on the level of service it provides. The Council does keep statistics showing information like the number of complaints it receives, but not in a form which identifies anyone. Further information on our Policy or how to submit a comments, compliments and complaints policy is available on the website.

Similarly, where enquiries are submitted to the Council it will only use the information supplied to deal with the enquiry and any subsequent issues and to check on the level of service we provide.

Where can I get advice?

If you have any worries or questions about how your personal information is handled please contact our Data Protection Officer at dpo@causewaycoastandglens.gov.uk or by calling 028 70 352352.

For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.

Alternatively, visit www.ico.org.uk or email casework@ico.org.uk.

Cookies, Google Analytics and how you use this website

For further information see: https://www.causewaycoastandglens.gov.uk/footer-information/privacy-and-cookie-statement

Further guidance on the use of personal information can be found at www.ico.org.uk

Name and Contact Details of the organisation

Causeway Coast and Glens Borough Council

Civic Headquarters

Cloonavin,

66 Portstewart Road

Coleraine, BT52 1EY

Co Londonderry. N. Ireland.

Phone: 028 70 347 034

Email: info@causewaycoastandglens.gov.uk

Introduction

privacy notice up to 25 May 2018.

This document explains how Causeway Coast and Glens Borough Council obtains, holds, uses and discloses information about people (their personal data[1]), the steps we take to ensure that it is protected, and also describes the rights individuals have in regard to their personal data handled by the Council[2]. This document does not include data captured through use of Council’s website which has a separate privacy statement.

The use and disclosure of personal data is governed in the United Kingdom by the Data Protection Act 1998 (‘the Act’). The Council is registered with the Information Commissioner as a ‘data controller’ for the purposes of the Act. As such Council is obliged to ensure that Council handles all personal data in accordance with the Act.

Council takes that responsibility very seriously and takes great care to ensure that personal data is handled appropriately in order to secure and maintain individuals’ trust and confidence in the Council.

1. Why do we handle personal data?

The Causeway Coast and Glens Borough Council obtains, holds, uses and discloses personal data for two broad purposes:

1.1 The Council purpose which includes the following services areas and any duty or responsibility of the Council arising from common or statute law.

waste collection and disposal
recycling and waste management
local planning functions
civic amenity provision
grounds maintenance
street cleaning
public conveniences
food safety
health and safety
environmental protection
environmental improvement
estates management - building design and maintenance
building control-inspection and regulation of new buildings
dog control
licensing, such as entertainment licensing
enforcement byelaws such as those around litter
sports, leisure services and recreational facilities
parks, open spaces and playgrounds
community centres
arts, heritage and cultural facilities
registration of births, deaths and marriages
off-street parking (except park and ride)
local economic development

Council also has a role in the following areas:

community planning
community development
community safety
sports development
summer schemes
tourism

1.2 The provision of services to support the Council Purpose – which include:

Staff administration, occupational health and welfare
Management of public relations, journalism, advertising and media
Management of finance to and from council including payments and grants
Internal review, accounting and auditing
Training
Property management
Insurance management
Vehicle and transport management
Payroll and benefits management
Management of complaints
Management of information & communications technology systems
Legal services
Information provision
Licensing and registration
Pensioner administration
Research, including surveys which may be carried out by an external agent on our behalf[3]
Performance management
Procurement
System testing
Security
Health and safety management

2. Whose personal data do we handle?

In order to carry out the purposes described under section 1 above Council may obtain, use and disclose (see section 7 below) personal data relating to a wide variety of individuals including the following:

Staff including volunteers, agents, temporary and casual workers
Suppliers
Complainants, correspondents and enquirers
Advisers, consultants and other professional experts
Witnesses
Former and potential members of staff
Other individuals necessarily identified in the course of Council enquiries and activity

Council will only use appropriate personal data necessary to fulfil a particular purpose or purposes. It will collect the minimum information necessary to fulfil that purpose. Anyone working for the Council may only use information which is necessary to carry out their official duties.

Personal data could be information which is held on a computer, in a paper record i.e. a file, as images, but it can also include other types of electronically held information i.e. CCTV images.

3. What types of personal data do we handle?

In order to carry out the purposes described under section 1 above the Causeway Coast and Glens Borough Council may obtain, use and disclose (see section 7 below) personal data relating to or consisting of the following:

Personal details such as name, address and biographical details
Family, lifestyle and social circumstances
Education and training details
Employment details, including performance and development
Financial details
Goods or services provided
Racial or ethnic origin
Political opinions
Religious or other beliefs of a similar nature
Trade union membership
Physical or mental health or condition
Sexual life
Offences (including alleged offences)
Criminal proceedings, outcomes and sentences
Sound and visual images
Other digital media
Licenses or permits held
References to manual records or files
Information relating to health and safety
Complaint, incident and accident details.

Causeway Coast and Glens Borough Council will only use appropriate personal data necessary to fulfil a particular purpose or purposes. Personal data could be information which is held on a computer, in a paper record i.e. a file, as images, but it can also include other types of electronically held information i.e. CCTV images.

4. Where do we obtain personal data from?

In order to carry out the purposes described under section 1 above Council may obtain personal data from a wide variety of sources, including the following:

Central government, governmental agencies and departments
Footage from CCTV and Body Worn Cameras
Emergency services
Individuals themselves
Current, past or prospective employers of the individual
Healthcare, social and welfare advisers or practitioners
Education and training establishments
Business associates and other professional advisors
Employees and agents of Council
Suppliers, providers of goods or services
Persons making an enquiry or complaint
Legal representatives
Prosecuting authorities
Courts
Public Protection Multi Agency Sharing Hubs
Auditors
Financial organisations and advisors
Credit reference agencies
Survey and research organisations
Trade, employer associations and professional bodies
Voluntary and charitable organisations
Ombudsmen and regulatory authorities
The media
Openly available information from the internet
Data Processors working on behalf of the Council.

Council may also obtain personal data from other sources such as its own CCTV systems, or correspondence.

5. How do we handle personal data?

In order to achieve the purposes described under section 1 Council will handle personal data in accordance with the Act. In particular we will ensure that personal data is handled fairly and lawfully with appropriate justification. We will strive to ensure that any personal data used by us or on our behalf is of the highest quality in terms of accuracy, relevance, adequacy and non-excessiveness, is kept as up to date as required, is protected appropriately, and is reviewed, retained and securely destroyed when no longer required. We will also respect individuals’ rights under the Act (see section 8 below).

6. How do we ensure the security of personal data?

Council takes the security of all personal data under our control very seriously. We will comply with the relevant parts of the Act relating to security and seek to comply with the Government standards.

We will ensure that appropriate policy, training, technical and procedural measures are in place, including audit and integrity monitoring, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so, and then under strict guidelines as to what use may be made of any personal data contained within them. These procedures are continuously managed and enhanced to ensure up-to-date security.

7. Who do we disclose personal data to?

When you provide information you will be told what it will be used for and whom it will be shared with. In order to carry out the purposes described under section 1 above Council may disclose personal data to a wide variety of recipients, including those from whom personal data is obtained (as listed above) between different sections of the council and with other agencies to help reduce crime or investigate fraud. This may include disclosures to bodies or individuals working on our behalf such as Animal Welfare Officers based in Mid and East Antrim Council or survey organisations. However, the council will not supply these organisations with your information unless it is satisfied that equal measures are in place to protect the information from unauthorised access. We may also disclose to other bodies or individuals where necessary to prevent harm to individuals. Disclosures of personal data will be made on a case-by-case basis, using the personal data appropriate to a specific purpose and circumstances, and with necessary controls in place.

The council has a responsibility to work in partnership with other councils and agencies such as the Police, Fire and Rescue Service, the voluntary services and the Health Service in order to preserve life, reduce accidents, reduce crime and disorder and improve health.

Where monies are due or outstanding the council reserves the right to use all the available information at its disposal to protect public funds.

The council will also not supply your information to any organisation for marketing purposes without your prior consent.

With the exception of using bulk mail systems e.g. MailChimp and MyEmma, which includes name and email address only Council does not disclose personal data to organisations based outside of the European Union. If in exceptional legitimate circumstances, personal data is transferred to such territories outside the European Union, Council will take proper steps to ensure that it is adequately protected as required by the Act. Council periodically undertake survey through online survey systems e.g. surveymonkey. Respondents should satisfy themselves re the privacy notices associated with any third party software provider.

Council will also disclose personal data to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and by court order. This may include disclosures to the Police, HMRC, Child Maintenance Service, the National Fraud Initiative and to the Courts. Council may also disclose personal data on a discretionary basis for the purpose of, and in connection with, any legal proceedings or for obtaining legal advice.

8. What are the rights of the individuals whose personal data is handled by the Causeway Coast and Glens Borough Council?

Individuals have various rights enshrined in the Act:

8.1 Subject Access

The most commonly exercised right is that used by individuals to obtain a copy, subject to exemptions, of their personal data processed by Causeway Coast and Glens Borough Council. Details of the application process, known as a ‘Subject Access’ request is available to download.

Alternatively individuals may contact the Information Governance Officer (see section 11 below).

8.2 Right to prevent processing likely to cause damage or distress

Under Section 10 of the Act an individual is entitled, in limited circumstances, to write to Council requiring that Council do not handle their personal data in a manner that was causing or would be likely to cause unwarranted substantial damage or substantial distress to themselves or another person.

Requests under Section 10 must describe the personal data involved; describe the handling to which the individual objects; state that the handling was causing or would be likely to cause substantial damage or substantial distress to him/her or another; describe the damage or distress; state that the damage or distress was/would unwarranted; and give reasons why the handling was causing/would cause such distress and was/would be unwarranted.

All requests of this nature may be sent in writing to the Council Information Governance Officer (see section 11 below). It is worth noting that the Act includes certain provisions which may mean in a particular case Council can continue to handle the personal data as intended despite the objection.

8.3 Right to Prevent Processing for the Purposes of Direct Marketing

Although Council engages in limited direct–marketing, under Section 11 of the Act and subject to certain exemptions, an individual has the right to request in writing that Council stops within a reasonable time, or does not start, using their personal data for direct marketing purposes. This includes the communication by any means (e.g. mail, email, telephone, door-to-door canvassing) of any advertising or marketing material directed at particular individuals.

Any requests under Section 11 may be sent to the Information Governance Officer (see section 11 below).

8.4 Rights in relation to automated decision-taking

Although Council is unlikely to carry out any automated decision-taking that does not involve some human element, under Section 12 of the Act and subject to certain exemptions, an individual has the right to require that Council ensures that no decision that would significantly affect them is taken by Council or on its behalf purely using automated decision-making software. The right has to be exercised in writing. If there is a human element involved in the decision-making the right does not apply. Requests under Section 11 may be sent to the Information Governance Officer (see section 11 below).

8.5 Right to take action for compensation if the individual suffers damage by any contravention of the Act by data controllers

Under Section 13 of the Act any individual who believes they have suffered damage and / or distress as a result of any contravention of the requirements of the Act may be entitled to compensation from Council where the Council is unable to prove that it had taken such care as was reasonable in all the circumstances to comply with the relevant requirement. Any claim for compensation arising from this provision may be sent to the Legal Services, Causeway Coast and Glens Borough Council, Civic Headquarters, Cloonavin, 66 Portstewart Road, Coleraine, BT52 1EY

8.6 Right to take action to rectify, block, erase or destroy inaccurate data

Under Section 14 of the Act an individual has the right to seek a court order for the rectification, blocking, erasure or destruction of their inaccurate personal data handled by Council. The right cannot be exercised directly to Council.

8.7 Right to request the Information Commissioner to assess a data controller’s Processing

Under Section 42 of the Act any person can request the Information Commissioner to make an assessment if they believe that they are / have been adversely affected by the handling of personal data by Council. Such requests should be made direct to the Information Commissioner whose contact details can be found below.

Generally if individuals have any concerns regarding the way their personal data is handled by Council or the quality (accuracy, relevance, non-excessiveness etc.) of their personal data they are encouraged to raise them with the Council Information Governance Officer (see section 11 below).

The Information Commissioner is the independent regulator responsible for enforcing the Act and can provide useful information about the Act’s requirements. The Information Commissioner’s Office may be contacted using the following:

The Information Commissioner’s Office
Wycliffe House
Wilmslow
Cheshire. SK9 5AF
t: 0303 123 1113
w: www.ico.gov.uk

9. How long does Council retain personal data?

Causeway Coast and Glens Borough Council keeps personal data as long as is necessary for the particular purpose or purposes for which it is held and will be disposed of in a secure manner when no longer needed. The periods for retention of information are specified in the council’s Retention Schedule which was laid before the Northern Ireland Assembly in 2016.

10. Monitoring

Causeway Coast and Glens Borough Council may monitor or record and retain telephone calls, text, emails and other electronic communications to and from the Council in order to deter, prevent and detect inappropriate or criminal activity, to ensure security and to assist the purpose described under section 1 above.

11. Contact Us

Any individual with concerns over the way Causeway Coast and Glens Borough Council handles their personal data may contact the Information Governance Officer as below:

Information Governance Officer
Civic Headquarters, Cloonavin,
66 Portstewart Road,
Coleraine, BT52 1EY
t: +44 (0) 28 7034 7034
e: info@causewaycoastandglens.gov.uk
w: www.causewaycoastandglens.gov.uk

[1] ‘Personal data’ is defined under Section 1 of the Data Protection Act 1998. In practical terms it means information handled by Council that relates to identifiable living individuals. It can include intentions and expressions of opinion about the individual. The information can be held electronically or as part of paper records, and can include CCTV footage and photographs. For ease of readers this document refers to the handling, use, holding etc of personal data – Section 1 of the Act uses the term ‘processes’ to effectively cover any usage of personal data.

[2] 2 This document is designed to help satisfy the ‘Fair Processing Requirements’ as required by Schedule 1 Part 2 Paragraphs 1 to 4 of the Data Protection Act 1998 and may be regarded as a generic over-arching ‘Fair Processing Notice’ for Council. . Additional more specific Fair Processing Notices may appear in other circumstances such as on forms, policies, correspondence, or CCTV signage.

[3] Council is required to conduct Customer Satisfaction Surveys to evaluate our performance and effectiveness. We may contact individuals, such as services users, or those reporting complaints, and ask them to give us their opinion of the service we are providing to the public. We use the information given to improve our services wherever we can. Council like many local authorities, use a private company to undertake such surveys on our behalf with strict controls to protect the personal data of those involved.