Child Safeguarding Practice Reviews (CSPR) and Serious Adult Reviews (SAR)

In order to comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

Our Data Protection Officer is Paul Bond. You can contact him at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

The statutory safeguarding partners are required to undertake CSPR and SAR in certain circumstances that are set out in the Children Act 2004 and Care Act 2014. The purpose of these reviews is to identify anything that involved agencies could have done differently in order to safeguard the involved child or adult. In order to complete a review, agencies who worked with the child or adult and their families will share information about their involvement.

Category of personal data being processed

Personal data (information relating to a living, identifiable individual)
Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)
Criminal records

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

CSPRs and SARs are statutorily required to be completed by the following legislation:

For children:

Children Act (2004) s16D, s16F and S16H
Working Together to Safeguard Children (2018) Chapter 4

For adults:

Care Act (2014) s44 and s45

Legal basis for processing special categories of personal data

The legal basis for processing your special categories of personal data, in accordance with the UK GDPR is:

g) Processing is necessary for reasons of substantial public interest.

h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

UK GDPR Article 9 (2) (g) would be applicable if the processing is for 'statutory or government purposes by virtue of the Data Protection Act Schedule 1 Part 2 (6)

Legal basis for processing criminal record data

Article 10 is the lawful gateway: Article 10 is the lawful gateway: processing of personal data relating to criminal convictions and offences. Processing of personal data relating to criminal convictions and offences, or related security measures based on Article 6 (1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. (rather than using Article 9 conditions for processing)

The basis for processing criminal offence data relates to specific condition 18 in Schedule 1 of the DPA 2018.

Recipients of the data

Data will be shared with all agencies who are required to participate within the review process. This will be those agencies who are identified as having had contact with the involved child or adult and their family. More limited data (e.g. name, date of birth and address) will be shared with a wider group of agencies with the sole purpose of enabling them to identify if they have had any contact with the involved child or family.

Agencies with whom data may be shared include other local authorities, police forces, NHS providers and commissioners, housing providers, National Probation Service, schools and residential care providers (this list is not intended to be exhaustive).

Statutory partners include:

Lancashire County Council (LCC)
Blackburn with Darwen Council
Blackpool Council
Lancashire Constabulary
NHS Integrated Care Board
NHS Lancashire South Cumbria Care Foundation Trust
NHS Lancashire Teaching Hospital Trust
NHS East Lancashire Teaching Hospital Trust
NHS Southport and Ormskirk Hospital Trust
NHS University Morecambe Bay Hospital Trust
NHS Blackpool Teaching Hospital
HCRG Care Group

Information will also be shared, where relevant, directly to people subject to CSPRs/SARs and their families, including the final report produced as a result of a CSPR/SAR.

Information we share

In the course of completing a CSPR or SAR we will request and process data including:

Personal details such as name, gender, date of birth, address, contact details, NI and NHS number, and language spoken
Special category details such as race, ethnicity, religion and medical history
Other professional involvement with the child/ adult and their family preceding and immediately following the death, serious harm, abuse or neglect.
Criminal records

Any transfers to another country

Data retention schedule

Personal data will not be kept for longer than is necessary for the purpose for which it was provided: after which it will be destroyed by Lancashire County Council and Joint Partnership Business Unit (JBPU) in accordance with relevant organisational archive and retention policies:

File type (Statutory)	Security	Retention period
Child Safeguarding Practice Review (CSPR) – report and supporting documents created during the completion of the review, where the child was seriously harmed	Personal data is held on secure systems maintained by Lancashire County Council	Retained for 75 years from date of birth of the child, and kept with Local Authority child's file. Full Review report available on associated JBPU website(s) for 1 year from published date.
Child Safeguarding Practice Review (CSPR) – report and supporting documents created during the completion of the review, where the child has died	Personal data is held on secure systems maintained by Lancashire County Council	The records of a child who has died before reaching 18 years, will be retained for the period of 15 years from the date of death or when the age of 18 would have been achieved, whichever is the later. The same time periods would apply if the child was or was not in care. Full Review report available on associated JBPU website(s) for 1 year from published date.
Safeguarding Adult Review (SAR) – report and supporting documents created during the completion of the review where the adult was seriously harmed	Personal data is held on secure systems maintained by Lancashire County Council	Retained for 10 years from completion of the review. Full Review report available on associated JBPU website(s) for 1 year from published date.
Safeguarding Adult Review (SAR) – report and supporting documents created during the completion of the review where the adult has died	Personal data is held on secure systems maintained by Lancashire County Council	Retained for 10 years from date of death or date of closure, whichever is applicable. Full Review report available on associated JBPU website(s) for 1 year from published date.

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are the right:

to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights, then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific project then please contact case.reviews@lancashire.gov.uk

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).