Customer Access Service

To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Contact details of this Lancashire County Council service:

Note that for queries intended for this specific service, do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to this point of contact.

Reasons for processing your personal data

The Lancashire County Council Customer Access Service processes personal data to:

1. Provide Customer Support and Service Delivery

   • Respond to enquiries, requests for information, and service applications made through telephone, email, online forms, or in person.

   • Facilitate access to council services, including signposting to relevant departments and partner organisations.

2. Manage Customer Accounts and Interactions

   • Maintain accurate records of customer interactions to ensure continuity and quality of service.

   • Verify identity where necessary to prevent fraud and protect personal information.

3. Handle Complaints, Feedback, and Escalations

   • Investigate and resolve complaints or service issues raised by customers.

   • Record feedback to improve service standards and customer experience.

4. Support Statutory Duties and Legal Compliance

   • Fulfil obligations under UK GDPR, the Data Protection Act 2018, and other relevant legislation.

   • Respond to Subject Access Requests (SARs) and other rights exercised under data protection law.

5. Monitor and Improve Service Performance

   • Analyse service usage trends and customer interactions to enhance efficiency and accessibility.

   • Conduct audits and quality assurance checks to maintain compliance and service standards.

6. Safeguarding and Public Protection

   • Share information with internal teams or partner agencies where necessary to protect individuals from harm or to comply with safeguarding duties.

7. Communication and Notifications

   • Provide updates on service changes, closures, or emergencies affecting access to council services.

   • Contact customers regarding their enquiries or applications.

Use of artificial intelligence (AI) technologies

We are increasingly utilising AI technologies to process your personal data. This is primarily utilised within Lancashire County Council using Microsoft Copilot Web and Microsoft Copilot 365. Please consult our Artificial Intelligence privacy notice for more details of how we use these specific platforms.

Lancashire County Council’s Customer Access Service uses AI technologies to improve service delivery, efficiency, and accessibility. These include:

• AI-Powered Virtual Agents and Chatbots
  Virtual agents assist customers by answering common queries, guiding them to the correct services, and providing real-time support through natural language understanding. This helps reduce waiting times and improves the overall customer experience.

• Netcall Converse CX and Liberty Platform
  The Council has implemented Netcall’s AI-driven “digital front door” solution, which combines intelligent automation, workflow management, and conversational AI. This platform enables:

  • Automated triage and routing of enquiries.

  • Real-time responses to customer queries using AI autonomous agents.

  • Integration across voice, web, and social channels for a seamless experience.

  • Capture of both digital and non-digital interactions to ensure inclusivity.

• AI-Assisted Staff Support
  AI tools help staff by surfacing relevant information, streamlining workflows, and reducing administrative burdens, allowing employees to focus on complex cases.

The Council ensures that all AI systems are deployed responsibly, with human oversight and compliance with UK GDPR principles. AI outputs are reviewed by staff before being acted upon, and personal data processed by AI is handled securely and lawfully. Over time, AI-driven insights will support continuous improvement of services while maintaining fairness and transparency.

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR Article 6 is:

(a) Consent: you have given clear consent for us to process your personal data for a specific purpose.

In specific circumstances, we rely on your consent, for example:

• When you agree to receive newsletters or marketing communications.

• When optional services require your explicit agreement.
  You can withdraw consent at any time without affecting the lawfulness of prior processing.

(b) Contract: the processing is necessary for a contract we have with you, or because we have asked you to take specific steps before entering a contract.

Processing is necessary for:

• Performing a contract to which you are a party.

• Taking steps at your request before entering a contract (e.g., paid services or bookings).

(c) Legal Obligation: the processing is necessary for us to comply with the law. We will cite the applicable legislation if we need to rely on this basis for processing.

Processing is required to comply with legal obligations, such as:

• Duties under local government legislation.

• Safeguarding responsibilities.

• Compliance with data protection and other regulatory requirements.

(e) Public Task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. We will cite the applicable task/function and its' basis in law if we wish to rely on this basis for processing.

This includes:

• Delivering statutory services and fulfilling the Council’s legal functions.

• Responding to customer enquiries and managing service requests.

• Providing information and assistance to residents and businesses.

Legal basis for processing special categories of personal data

In certain circumstances, the Customer Access Service may need to process special category personal data (such as health information, ethnicity, or other sensitive details) to deliver services or meet statutory obligations. Under UK GDPR Article 9, this requires an additional lawful basis beyond Article 6. The Council relies on the following conditions:

• Explicit Consent – Article 9(2)(a)
  Where you have given clear and explicit consent for the processing of your special category data for one or more specified purposes. You can withdraw consent at any time.

• Employment, Social Security, and Social Protection Law – Article 9(2)(b)
  Processing is necessary for carrying out obligations and exercising specific rights in the field of employment and social protection law, as authorised by UK legislation.

• Legal Claims – Article 9(2)(f)
  Processing is necessary for the establishment, exercise, or defence of legal claims or whenever courts are acting in their judicial capacity.

• Substantial Public Interest – Article 9(2)(g)
  Processing is necessary for reasons of substantial public interest, based on UK law, and subject to appropriate safeguards. This includes safeguarding duties and statutory functions.

• Health or Social Care – Article 9(2)(h)
  Processing is necessary for the provision of health or social care services, treatment, or the management of health or social care systems, under UK law or a contract with a health professional.

Where our Customer Access Service ever asks you to provide any form of special category personal data, it will only ever be required to assist in resolving your query.

The underlying lawful basis will typically be informed by the broader service area that your query relates to. Please refer to our wider privacy notices for specific details of the lawful basis that governs our wider areas of activity.

Legal basis for processing criminal offence data

The Customer Access Service may occasionally process personal data relating to criminal convictions and offences when required to deliver services or comply with statutory duties. Under UK GDPR Article 10, this type of data can only be processed when:

• Authorised by UK Law
  Processing is carried out under official authority or where it is necessary for the Council to fulfil its legal obligations and statutory functions, as permitted by legislation such as the Data Protection Act 2018.

• Substantial Public Interest
  Processing is necessary for reasons of substantial public interest, including safeguarding individuals, preventing fraud, and protecting public funds, subject to appropriate safeguards.

• Legal Claims or Judicial Capacity
  Processing is necessary for the establishment, exercise, or defence of legal claims or when courts are acting in their judicial capacity.

The Council ensures that any processing of criminal offence data is strictly controlled, proportionate, and subject to appropriate technical and organisational measures to protect individuals’ rights and freedoms. This includes limiting access to authorised personnel and applying enhanced security measures.

Information we process about you

The Customer Access Service may collect and process the following categories of personal data:

1. Basic Identification Details

   • Name, address, date of birth, and contact information (telephone number, email address).

2. Service Interaction Details

   • Records of enquiries, requests, complaints, and feedback provided through phone, email, online forms, or in person.

3. Account and Authentication Information

   • Customer reference numbers, login credentials, and identity verification details.

4. Communication Preferences

   • Choices regarding how you wish to be contacted (e.g., email, SMS, phone).

5. Special Category Data (where necessary)

   • Health information, ethnicity, or other sensitive data required for statutory services or safeguarding purposes.

6. Technical and Usage Data

   • IP address, device information, and interaction logs when using online services.

7. Criminal Convictions and Offences Data (where applicable)

   • Only processed when required for safeguarding or legal compliance under Article 10 UK GDPR.

Recipients of the personal data that we process about you

We may share your personal data with:

1. Internal Council Departments

   • To ensure your enquiry or request is directed to the appropriate service area for resolution.

2. Partner Organisations and Service Providers

   • Organisations delivering services on behalf of the Council, such as contracted suppliers and technology providers (e.g., Netcall for contact centre solutions).

3. Other Public Authorities

   • Where necessary for statutory functions, safeguarding, or legal compliance (e.g., NHS, police, or other local authorities).

4. Regulatory and Government Bodies

   • For audit, compliance, and reporting purposes as required by law.

5. Technology and Communication Platforms

   • Secure platforms used to manage customer interactions, including AI-assisted tools and virtual agents, under strict contractual and data protection controls.

We ensure that all recipients process your data securely, lawfully, and only for the purposes specified.

Any transfers to another country

• All data submitted to an online form or within a virtual agent is stored externally to the County Council within the Netcall platform and data is held within the UK.

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:

• to be informed via Privacy Notices such as this.

• to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.

• of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.

• of rectification, we must correct inaccurate or incomplete data within one month.

• to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.

• to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.

• to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.

• to object. You can object to your personal data being used for profiling, direct marketing or research purposes.

• in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights, then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Identity and contact details of the data controller

• Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

• Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Further information

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).