Privacy notice

Overview

Being transparent and providing accessible information to individuals about how we use personal information is a key element of the UK General Data Protection Regulation (UK GDPR). The most common way to provide this information is in a privacy notice.

Alongside this privacy notice we also provide service and project specific privacy notices that give further details on how we process your personal data.

Data controller

A Data Controller is an individual or organisation that determines the purposes and means of processing personal data.

Lancashire County Council is registered as a data controller with the Information Commissioner's Office (registration number: Z542705X).

Contact details for the council's data controller are:
Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dataprotection@lancashire.gov.uk

Purpose of processing personal information

As a local authority, the council delivers services to you. In order to do this in an effective way we will need to collect and use personal information about you.

If you use a specific council service, we will usually let you know how that service will use your personal information via a separate privacy notice.

The UK General Data Protection Regulation ensures that we comply with a series of data protection principles. These principles are there to protect you and they make sure that we:

Process all personal information lawfully, fairly and in a transparent manner.
Collect personal information for a specified, explicit and legitimate purpose.
Ensure that the personal information processed is adequate, relevant and limited to the purposes for which it was collected.
Ensure the personal information is accurate and up to date.
Keep your personal information for no longer than is necessary for the purpose(s) for which it was collected.
Keep your personal information securely using appropriate technical or organisational measures.

Service or project specific privacy notices

Services using large amount of personal or special categories of information will have their own dedicated privacy notice to tell people what information is being shared. These notices will map out how personal information flows through the service or project and how it is processed.

As a local authority, the council delivers services to you. In order to do this in an effective way we will need to collect and use personal information about you.

If you use a specific council service, we will usually let you know how that service will use your personal information via a separate privacy notice.

The UK General Data Protection Regulation ensures that we comply with a series of data protection principles. These principles are there to protect you and they make sure that we:

Process all personal information lawfully, fairly and in a transparent manner
Collect personal information for a specified, explicit and legitimate purpose
Ensure that the personal information processed is adequate, relevant and limited to the purposes for which it was collected
Ensure the personal information is accurate and up to date
Keep your personal information for no longer than is necessary for the purpose(s) for which it was collected
Keep your personal information securely using appropriate technical or organisational measures

Service or project specific privacy notices

Consent and categories of personal data

Consent

We will usually seek your consent prior to processing or sharing your information, however, if there is a legal reason, as outlined under the UK GDPR, we may not require your consent, e.g. where the disclosure is necessary for the purposes of the prevention and/or detection of crime. Where we need to disclose special category or confidential information such as medical details to other partners, we will do so only with your prior explicit consent or where we are legally required to. We may disclose information when necessary to prevent risk of harm to an individual.

Categories of personal data

We process:

Personal information relating to identified natural persons used to deliver services such as:

Adult and children's social care, human resources, special educational needs, planning applications, access to information requests, legal claims, school appeals, library cards, blue badges, customer services, highways claims and complaints, pensions, children's services, parking services, care homes, early years, youth offending, trading standards and more.

Special categories of information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership and data concerning health or sex life.
Health and wellbeing information. All local authorities have a duty to improve the health of the population they serve. To help with this, we use information from a range of source data, including data collected at the registration of a birth or death to understand more about the health and care needs in the area.
Research and statistical data to provide intelligence about Lancashire including demographic data, population projections, the economic situation, health and wellbeing information. This personal information is often pseudonymised when an identifier such as name is replaced with a unique number.

Lawful basis for processing

The lawful basis for processing this personal data must be one of the following.

Consent: the individual has given clear consent for the council to process their personal data for a specific purpose.
Contract: the processing is necessary for a contract the council has with the individual.
Legal Obligation: the processing is necessary for the council to comply with the law.
Vital Interests: the processing is necessary to protect someone's life.
Public Task: the processing is necessary for the council to perform a task in the public interest and has a clear basis in law.
Legitimate Interests: Processing is necessary for the purposes of legitimate interests pursued by the local authority – (the local authority will not use this lawful basis for any tasks it performs as a public authority).

Individual service and project specific privacy notices will include further details of the lawful basis for processing specific categories of personal data.

Information sharing and retention periods

To ensure that the council provides you with an efficient and effective service we will sometimes need to share your information between teams within the council as well as with our partner organisations that support the delivery of the service you may receive, for example:

NHS
District Councils
Police
Fire Service
HMRC
DWP
Voluntary organisations
Government departments and agencies
Regulatory bodies

We will also need to supply your information to organisations we have contracted to provide a service to you.

We will only ever share your information if we are satisfied that our partners or suppliers have sufficient measures in place to protect your information in the same way that we do.

We will never share your information for marketing purposes.

Before sharing information the council will ensure that:

Privacy Notices are completed if appropriate.
Technical security such as encryption and access controls are in place to keep information secure.
Information Sharing Agreements are completed showing the rules to be adopted by the various organisations involved in the sharing exercise.
Data Protection Impact Assessments are completed to assess any risks or potential negative effects.
Common retention periods and deletion arrangements are set for the information.
Subject access rights are catered for.

Details of transfers to other countries and additional safeguards

We will always process as little personal data as is necessary to meet the purpose of the processing activity. We will inform you where your personal and sensitive data will be stored and of the additional safeguards that we have taken to ensure compliance with UK GDPR and data protection legislation which applies within the country where your personal and sensitive information is held, should this be outside of the UK.

Retention periods

We will only keep your information for as long as it is required to be retained. The retention period is either dictated by law or by our discretion. Once your information is no longer needed it will be securely and confidentially destroyed. Service and project specific retention periods can be found in our service and project specific privacy notices.

Your rights

You have certain rights under the UK General Data Protection Regulations (UK GDPR), these are the right:

to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you wish to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: DPO@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Data protection officer

As a public authority we are required to have a Data Protection Officer who is responsible for:

Monitoring the council's compliance with the UK GDPR and other data protection laws. Monitoring our data protection policies, awareness-raising, training, and audits.
Advising the council in respect to their data protection obligations.
Provide advice and monitor the Data Protection Impact Assessment process.
Acts as a point of contact for the Information Commissioner's Office (ICO) and members of public on any matter relating to Data Protection.

If you need to contact the Data Protection Officer their details are:

Paul Bond
Data Protection Officer
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

Incidents, complaints, comments and compliments

Information security incident

Should you wish to report an information security incident you can use our electronic reporting tool: Report an information security incident

Complaints, comments and compliments

If you wish to make a compliment, comment or complaint about how the council are processing your data, then please visit send a compliment or comment or make a complaint to the council.

Information Commissioner's Office

If you are still dissatisfied with how the council have handled your complaint, you may contact the Information Commissioner's Office.

The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Phone: 08456 30 60 60

Website: www.ico.org.uk

The authority also creates and holds information that does not contain personal information about a living individual to view of access this information you can access council official information.

Access to the council's official information

Under the Freedom of Information Act 2000 and the Environmental Information Regulations 2004 you have a right to request any recorded official information held by the council. The information you require may already be publicly available. The council has a duty to make official recorded information available The council has a duty to make information available via a publication scheme. Before you submit a request please check the publication scheme.

If you need to make a request, it must be done in writing. You can:

Submit a request online
Email freedomofinformation@lancashire.gov.uk
Write to:
Information Governance Team
Lancashire County Council
PO Box78
County Hall
Preston
PR1 8XJ

You do not need to say why you want the information. Your request must include your name, and an address for correspondence (if you apply by email, your email address is a suitable address for correspondence). Please ensure you identify the information you want as clearly as possible.

With certain limited exceptions, you are entitled to a response within 20 working days.

It costs nothing to make a freedom of information request. However, the county council can refuse to deal with your request if doing so would cost more than £450 (which equates to 18 hours' work). In extreme circumstances, the county council may also charge for the cost of photocopying and postage.

You may not get the information you asked for:

If the council does not hold the information you have requested
If the information is exempt from disclosure
if finding the information you have requested would take longer than 18 hours

If we are unable to supply any of the information you have requested, we will tell you the reasons why. More information available in the exemptions guide.

For more details please refer to the Information Commissioner's Office website.

Access to the council's decision making process

Information on the decision making process of the council can be found in the constitution.

National data opt-out

The National data opt-out is a system covering health and social care that allows members of the public the opportunity to make an informed choice about whether they wish their confidential information to be used just for their individual care and treatment or also used for research and planning purposes.

For further details, please visit the website: www.nhs.uk/my-data-choice

How the NHS and care services use your information

Lancashire County Council is one of many organisations working in the health and care system to improve care for patients and the public.

Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

improving the quality and standards of care provided
research into the development of new treatments
preventing illness and diseases
monitoring safety
planning services

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters. On this webpage you will:

See what is meant by confidential patient information
Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
Find out more about the benefits of sharing data
Understand more about who uses the data
Find out how your data is protected
Be able to access the system to view, set or change your opt-out setting
Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
See the situations where the opt-out will not apply

You can also find out more about how patient information is used at:

https://www.hra.nhs.uk/information-about-patients/ (which covers health and care research); and

https://understandingpatientdata.org.uk/what-you-need-know (which covers how and why patient information is used, the safeguards and how decisions are made)

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

Health and care organisations have until 2020 to put systems and processes in place so they can be compliant with the national data opt-out and apply your choice to any confidential patient information they use or share for purposes beyond your individual care. Our organisation is currently compliant with the national data opt-out policy.

Patient control of information

You may want to prevent confidential information about you from being shared or used for any purpose other than providing your care. You have a right to opt-out of Lancashire County Council or other organisations using your information for these further purposes. If you wish to do this please contact Lancashire County Council via the contact details highlighted below:

Paul Bond
Data Protection Officer
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

Councillors as data controllers

Lancashire County Councillors can also be data controllers but this depends in what capacity they are working in:

As a member of the council, for example, as a cabinet member or a member of a committee. In this circumstance the council is the registered data controller. Personal information held by the council will not be used for political purposes unless both the council and the individuals concerned agree.
As a representative of residents of their ward, for example, in dealing with complaints. In this circumstance, the councillor is the data controller. Whilst Councillors are considered to be 'data controllers' for constituency casework purposes, they are exempt from payment of the Information Commissioner's Office registration fee, with a few exceptions such as if councillors are personally responsible for of any kind of CCTV, either recording or live feed cameras. All Councillors take into account the context in which personal information is collected to decide whether their use of the information will be fair and lawful, as required by the first data protection principle. Where a councillor is representing an individual resident who has made a complaint, the councillor will usually have the implied consent of the resident to retain relevant personal data provided and to disclose it as appropriate. The resident will also expect that the organisation who is the subject of the complaint will disclose personal data to the councillor. If there is any uncertainty regarding the resident’s wishes, it will be appropriate to make direct contact with the resident to confirm the position. Special Category information, such as health data, racial origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation is treated differently, and to process this data the councillor will always obtain your explicit consent.
They may represent a political party, particularly at election time. In this circumstance, the political party will be the data controller. When campaigning for election as the representative of a political party, candidates can use personal information, such as mailing lists, legitimately held by their parties. However, personal information they hold in their role as representative of local residents, such as complaints casework, will not be used without the consent of the individual. When campaigning for election to an office in a political party, councillors will only use personal information controlled by the party if its rules allow this. Candidates for election are also aware that political campaigning falls within the definition of direct marketing. Consequently, they have regard to the requirements of data protection legislation and the Privacy and Electronic Communication (EC Directive) Regulations 2003 which set out specific rules that must be complied with for each type of marketing communication.

All councillors will comply with the council's information governance policies and data protection legislation including the UK general data protection regulation (UK GDPR). Personal information will be processed in line with data protection legislation and will be kept for as long as it is required to be retained. The retention period is either dictated by law or by the councillors' discretion. Once your information is no longer needed it will be securely and confidentially destroyed.

Contact the Information Governance Team

To access your personal information or make a request in relation to other rights, contact the Information Governance Team:

Information Governance Team,
Lancashire County Council,
PO Box78,
County Hall,
Preston,
PR1 8XJ

Email: dataprotection@lancashire.gov.uk.

This is called a subject access request and must be made in writing.

You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you.

To ensure that we can deal with your request as efficiently as possible you will need to include as much detail as possible regarding your request.

This should include your current name and address and proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address).

It may also help to include your previous name and address, date of birth and what council service you were involved with.

This is so that we can identify any information we may hold about you.

Child friendly privacy notice

This page is our Privacy Notice. A Privacy Notice tells you how we use your personal data, so you know what happens with it when people give it to us.

Sometimes there are links to other pages. You might want to ask an adult to help with these because it can be confusing.

Child Friendly Privacy Notice - print version PDF 212 KB

Who are we?

We are Lancashire County Council and we offer lots of services to people who live in Lancashire.

We provide care for people who need it, we help your local school to function, and we make sure you have a local library service.

Personal data? What’s that?

Anything that can identify you is your personal data. You might know this could be things like your name or a photo of you, but it is also things like your email address or your online gamertag.

There are some types of data we have to be extra careful with. These are known as special category data. This could be something like an illness you have, or what religion you are.Sometimes we have to use data about crimes and breaking the law.

The Council uses a lot of personal data. If you want to read a long list, it’s on our main Privacy Notice.

Why do you need my personal data?

The main reason we need to use your personal data is to know who you are.

If you have been in care, or if you are at school, it makes sure that we give you the help you need from us.

We could also use it because of an event you have taken part in, or competition that we organised, to make sure if you win you get your prize.

If we don’t have your personal data it could mean you miss out on the things we can do for you.

Sometimes we need to tell you more about what we’re doing with your personal data. You can see some of these on this page.

So, can you use my personal data for anything?

Just because we have your personal data, it doesn’t mean we can do what we want with it, we have to follow some rules.

Sometimes we have to ask you if we can use it, and if you say no then we can’t.

The Council does a lot of work, so there are times that there are more rules that say we have to use your personal data to do our work, and we can do this without asking you first.

There are different rules for personal data and special category data. If we are using any of your data, we make sure we are following all the rules, which are on our main Privacy Notice.

Can anyone else see my personal data?

Sometimes in order to do our work we have to share your personal data, or other people might share it with us. We’re very careful about how we do this, meaning there are even more rules.

We might need to share your data with your school, doctor or family if they are helping you, or with the police or fire service.

We keep a lot of data on secure systems. There are times we let other people, like care providers or the NHS, access our systems to make sharing easier, but we always make sure that they know all our rules first, so only people who are helping you will look at your data.

There are too many people to list here, but there is a longer list of who we could share with on our main Privacy Notice.

There are times we might need to ask for help doing our work, and someone else will use your data for us. This could mean your personal data might go around the world, but don’t worry – we’ll make sure it’s safe.

Do you keep my personal data forever?

We only keep your personal data for as long as we need it and sometimes this might be for years.

There are times we have to follow rules about how long we can keep your personal data, and we have a special page that tells you how long we keep it. It’s really long, because we do a lot of work.

Do I have a say in what happens to my personal data?

Yes you do. You have what we call 'rights' when we use your data. One of these is the right to know what we do with it. That’s what this page is for.

You can ask us to tell you what personal data we have about you, or if we will stop using it or delete it. If your personal data is wrong, you can tell us and we will fix it.

The rights you have depend on what we use your data for, and there is more information on our main Privacy Notice.

Who makes sure you follow all the rules?

We have someone in the Council called our Data Protection Officer, and their job is to protect your data. This means they make sure we are following all the rules, and your data is safe. If they see something wrong, they tell us how we can fix it.

Because of how important it is to keep your data safe, and to follow all the rules, you can email or write a letter to our Data Protection Officer if you are worried about what we do:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

There is a business whose job it is to make sure we follow the rules, and can tell us off if we do things wrong.

You can also email or write to them:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF or look online at www.ico.org.uk