Privacy

Being transparent and providing accessible information to individuals about how we use personal information is a key element of the General Data Protection Regulation (GDPR). The most common way to provide this information is in a privacy notice.

Alongside this privacy notice we also provide service specific privacy notices that give further details on how we process your personal data (Electoral Registration and Customer Accounts).

Allerdale Borough Council uses your personal data you provide to deliver the services you require. It will all be processed in accordance with the General Data Protection Regulations (GDPR) and other privacy laws.

The Data Controller is Allerdale Borough Council, though there may be instances where the data is shared with another party as joint Data Controllers, or where the Council is operating as a data processor for another party.

Allerdale Borough Council is registered with the Information Commissioner’s Office as a Data Controller (registration number: Z5680850

As a public authority we are required to have a Data Protection Officer who is responsible for:

• Monitoring the council's compliance with the GDPR and other data protection laws.
• Monitoring our data protection policies, awareness-raising, training, and audits.
• Advising the council in respect to their data protection obligations.
• Providing advice and monitoring the Data Protection Impact Assessment process.
• Acting as a point of contact for the Information Commissioner's Office (ICO) and members of public on any matter relating to Data Protection.

The contact details for the Data Protection Officer at Allerdale Borough Council is the:

Information Governance and Data Protection Officer,

Allerdale House,

Workington,

CA14 3YJ

(tel: 0303 123 1702 ); email: foi@allerdale.gov.uk

To provide you with the services we provide, we will sometimes need to collect and use your personal information.

All data will be processed lawfully, fairly and in a transparent manner, in accordance with the GDPR and prevailing UK data protection legislation.

The General Data Protection Regulation ensures that we comply with a series of data protection principles. These principles are there to protect you and they make sure that we:

• Process all personal information lawfully, fairly and in a transparent manner.
• Collect personal information for a specified, explicit and legitimate purpose.
• Ensure that the personal information processed is adequate, relevant and limited to the purposes for which it was collected.
• Ensure the personal information is accurate and up to date.
• Keep your personal information for no longer than is necessary for the purpose(s) for which it was collected.
• Keep your personal information securely using appropriate technical or organisational measures.

Where there is large amounts of data being processed we shall use dedicated privacy notices which will clearly outline how your data will be used and what information is being shared.

The reasons for processing data include:

• maintaining our own accounts and records
• supporting and managing our employees
• promoting the services we provide
• marketing our local tourism
• carrying out health and public awareness campaigns
• managing our property
• providing leisure and cultural services
• carrying out surveys
• administering the assessment and collection of taxes and other revenue including benefits and grants
• licensing and regulatory activities
• local fraud initiatives
• crime prevention and prosecution offenders including the use of CCTV
• corporate administration and all activities we are required to carry out as a data controller and public authority
• undertaking research
• the provision of all commercial services including the administration and enforcement of parking regulations and restrictions
• the provision of all non-commercial activities including refuse collections from residential properties,
• internal financial support and corporate functions
• managing archived records for historical and research reasons
• data matching under local and national fraud initiatives
• administration of "nuisance vehicles" system

The basis for the processing will be either of one, or more, of the following:

1. Consent from you
2. Contractural requirements
3. Legal obligation
4. To protect your vital interests
5. Provision of statutory functions or public task
6. Where it is necessary for our legitimate interests

As we are a local authority, the lawful basis for processing the majority of personal data is in the provision of statutory functions or public task. However, sometimes we require your consent. Where this is the case you have the right to withdraw your consent at any time. Please contact the Information Governance and Data Protection Officer for further details.

We shall use your data for the specific purpose for which it is provided, unless to use it for another purpose is in your interests and does not infringe with your privacy rights. We shall not use your data for marketing purposes unless you have consented for us to do so.

Categories of personal data

We shall only process data which is required to carry out the required task. This includes name, date of birth, address, and similar. We shall not ask for information which is not required.

The types of services which require the processing of personal data include:

Customer services; elections and boundary reviews; democratic services including the Mayor's and Leader's office; benefits and council tax; building control; town centre management; estates; tourism and destination management; planning and planning policy; homelesseness; emergency planning; environmental health; food and health and safety; environmental protection; housing and housing grants; legal; senior management office; human resources; policy; communications and marketing; parking; community services; waste management; street scene; licensing; land charges; parks management; property services; finance; business support grants; test and trace support payments; procurement and contracts; information technology.

The categories of data we shall be processing include:

• personal details
• family details
• lifestyle and social circumstances
• goods and services
• financial details
• employment and education details
• housing needs
• visual images, personal appearance and behaviour
• licenses or permits held
• student and pupil records
• business activities
• case file information

We also process sensitive classes of information that may include:

• race
• ethnic origin
• politics
• religion
• trade union membership
• biometrics
• health
• sex life
• sexual orientation

In most cases the information we receive will be held by us only. To ensure that we provide you with an efficient service we will sometime need to share your information between teams within the council.

We may also share the information with partner organisations where necessary so that you receive the service you request.

This could include, but is not limited to, our waste company Allerdale Waste Services, our landscaping contractor, ISS, and our sports and leisure contractor, GLL.

In addition, we may share your information with partner authorities or government departments, including:

• NHS
• District councils
• Police
• Fire Service
• HMRC
• DWP
• Voluntary organisations

A full list of the types of organisations we may share your information with is below.

We will only ever share your information if we are satisfied that our partners or suppliers have sufficient measures in place to protect your information in the same way that we do.

We will never share your information for marketing purposes.

Before sharing information we will ensure that:

• Privacy Notices are completed if appropriate.
• Technical security such as encryption and access controls are in place to keep information secure.
• Information Sharing Agreements are completed showing the rules to be adopted by the various organisations involved in the sharing exercise.
• Data Protection Impact Assessments are completed to assess any risks or potential negative effects.
• Common retention periods and deletion arrangements are set for the information.
• Subject access rights are catered for.

Full list of the types of organisations we may be obliged to share information with:

• customers
• family, associates or representatives of the person whose personal data we are processing
• current past and prospective employers
• healthcare, social and welfare organisations
• educators and examining bodies
• providers of goods and services
• financial organisations
• debt collection and tracing agencies
• private investigators
• service providers
• local and central government
• ombudsman and regulatory authorities
• press and the media
• professional advisers and consultants
• courts and tribunals
• trade unions
• political organisations
• professional advisers
• credit reference agencies
• professional bodies
• survey and research organisations
• police forces
• housing associations and landlords
• voluntary and charitable organisations
• religious organisations
• students and pupils including their relatives, guardians, carers or representatives
• data processors
• other police forces, non-home office police forces
• regulatory bodies
• courts, prisons
• customs and excise
• local and central government
• international law enforcement agencies and bodies
• security companies
• partner agencies, approved organisations and individuals working with the police,
• licensing authorities
• service providers
• press and the media
• healthcare professionals
• current past and prospective employers and examining bodies
• law enforcement and prosecuting authorities
• legal representatives, defence solicitors
• police complaints authority
• the disclosure and barring service
• healthcare professionals

Transfers to third countries

Your personal and sensitive personal data will normally be stored and processed on servers within the European Economic Area (EEA).

It may sometimes be necessary to transfer personal information overseas. When this is needed information may be transferred to countries or territories around the world. Any transfers made will be in full compliance with all aspects of the prevailing data protection legislation.

Your personal data is retained for as long it is required and in accordance with our retention policy.

When your data is no longer required it will be destroyed securely and confidentially.

There may be times when decisions are automated by computer to speed up the service you require. This may be the case for benefits and council tax enquiries, however, the final decision is always made by a member of staff. You do have a right to request that your data is always considered by a member of our staff instead (see below).

Our website collects information automatically via cookies to improve your use of the site and to provide advertising. More information on cookies is available on our website

You have a number of rights in relation to your data. These are:

• The right to be informed when data is collected
• The right of access to your data
• The right to rectification of your data - to correct inaccurate or incomplete data
• The right to erasure of your data (except in certain circumstances) - we will delete your data if requested unless there is a legal obligation to process your data
• The right to restrict processing - we can retain as much data is necessary to ensure the restriction is respected in the future
• The right to data portability - where we can, where possible, provide your information in a structured, commonly used, machine readable form when asked
• The right to object to the processing of data - where you can object to the processing of data for direct marketing or research purposes
• Rights in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

You also have a right to withdraw any consent you may have given us to processing your data and a right to lodge a complaint with the Information Commissioners Office (ICO). More details on these rights can be found on the ICO's website .

For more information and advice on how to exercise any of the above rights, please see the Individuals’ Rights page on our website.

Failure to provide the necessary information may mean we are unable to provide you with the service you require.

We aim to meet high standards and so our policies and procedures are constantly under review. From time to time we may therefore update this Privacy Notice.

To report a possible information security incident contact the Information Governance and Data Protection on: Allerdale House, Workington, CA14 3YJ, tel: 0303 123 1702 , email: foi@allerdale.gov.uk .

If you wish to compliment, comment or complain about how we are processing your data, then please visit our comments, compliments and complaints page.

If you remain dissatisfied with our service and how we have handled your complaint or request to exercise your privacy rights, then you can go to the Information Commissioner's Office at:

The Information Commissioner

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Phone: 08456 30 60 60 or their website .

We make as much information as possible on our website: www.allerdale.gov.uk . You can access Council information under the Freedom of Information (FOI) and Environmental Information Regulations (EIR ).

If you wish to make a request it must be in writing to the Information Governance and Data Protection on: Allerdale House, Workington, CA14 3YJ, email: foi@allerdale.gov.uk .

Please ensure you identify the information you require as clearly as possible.

You do not need to say why you want the information and we shall provide you with a response within 20 working days (unless a legitimate extension applies).