Facilities Management

To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Contact details of this Lancashire County Council service

Note that for queries intended for this specific service, do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to the following point of contact:

askfm@lancashire.gov.uk

Reasons for processing your personal data

We process personal data to enable Lancashire County Council Facilities Management services to safely, effectively and efficiently manage council buildings, facilities and related services. This includes:

• Managing access to and use of council buildings and facilities.

• Maintaining the safety, security and wellbeing of employees, service users, visitors, contractors and members of the public.

• Delivering facilities management services, including building maintenance, repairs, cleaning, catering, waste management and workplace support services.

• Managing contractors, suppliers and service providers working on council premises.

• Responding to incidents, emergencies, health and safety matters, and business continuity requirements.

• Planning, monitoring and improving the operation, utilisation and performance of council buildings and assets.

• Complying with legal, regulatory and statutory obligations, including health and safety, safeguarding, security and audit requirements.

• Preventing and detecting crime, fraud, misuse of council assets and unauthorised access to council premises.

Use of artificial intelligence (AI) technologies

We are increasingly utilising AI technologies to process your personal data. This is primarily utilised within Lancashire County Council using Microsoft Copilot Web and Microsoft Copilot 365. Please consult our Artificial Intelligence privacy notice for more details of how we use these specific platforms.

We do not use AI to make automated decisions. There is always a human intervention to review and approve any outputs from the AI tools. Decisions are not made solely by automated means.

Facilities Management may use approved artificial intelligence (AI) tools, including Microsoft Copilot Web and Microsoft Copilot 365, to support administrative and operational activities. These tools may be used to assist with drafting and summarising documents, analysing information, preparing reports, improving communications, managing service requests, and supporting the planning and delivery of facilities management services.

Where personal data is processed using AI tools, this is done in accordance with Lancashire County Council policies, security requirements and data protection legislation. AI tools are used to support staff in carrying out their duties and are not used to make decisions about individuals. Any outputs generated by AI are reviewed and validated by appropriately authorised council officers before being used or acted upon.

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR Article 6 is:

(b) Contract
In some circumstances, processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract. This may apply where Facilities Management engages with contractors, suppliers, tenants, service providers or other organisations involved in the provision of facilities-related services.

(c) Legal Obligation
Processing is necessary for Lancashire County Council to comply with its legal obligations relating to the management, maintenance, health and safety, security and operation of its buildings, facilities and workplaces. This includes obligations under legislation such as the Health and Safety at Work etc. Act 1974, which places duties on those responsible for premises to protect employees, visitors and others who may be affected by their activities.

(e) Public Task
Processing is necessary for the performance of tasks carried out in the public interest and in the exercise of the Council's official authority as a local authority. This includes managing, maintaining, securing and operating council buildings and assets to support the delivery of public services. The Council's functions are derived from and supported by legislation including the Local Government Act 1972 and other legislation that confers powers and duties relating to the management of council property, facilities and services. Public authorities may rely on this lawful basis where the processing is necessary for functions laid down in law.

Legal basis for processing special categories of personal data

The legal basis for processing special categories of personal data relating to you, in accordance with the UK GDPR Article 9 is:

(b) Employment, social security and social protection
Processing is necessary for the purposes of carrying out obligations and exercising specific rights in the field of employment, social security and social protection law. This may include managing health and safety incidents, workplace adjustments, accident reporting, occupational health matters and supporting the wellbeing and safety of employees, contractors and visitors.

This processing is carried out in accordance with obligations under legislation including the Health and Safety at Work etc. Act 1974 associated health and safety regulations, and Schedule 1, Part 1 of the Data Protection Act 2018.

(c) Vital Interests
Processing is necessary to protect your vital interests or those of another individual where a person is physically or legally incapable of giving consent. This may arise in emergency situations involving council premises, facilities or activities.

(f) Legal Claims
Processing is necessary for the establishment, exercise or defence of legal claims. This may include investigating incidents, accidents, insurance matters, complaints or legal proceedings involving council buildings, facilities, employees, contractors or visitors.

(g) Substantial Public Interest
Processing is necessary for reasons of substantial public interest, including health and safety, safeguarding, preventing unlawful acts, protecting the public, and ensuring the safe and effective operation of council facilities. This processing is undertaken in accordance with Schedule 1 of the Data Protection Act 2018.

(h) Occupational Health
Processing is necessary for the purposes of occupational medicine, assessing the working capacity of employees, managing workplace health and safety requirements, and making reasonable adjustments for staff, contractors or visitors where required by law. This processing is carried out in accordance with UK GDPR Article 9(2)(h), the Health and Safety at Work etc. Act 1974, the Equality Act 2010, and Schedule 1 of the Data Protection Act 2018.

Legal basis for processing criminal offence data

Facilities Management may process information relating to criminal offences, allegations, incidents, investigations or related security measures where this is necessary to maintain the safety and security of council premises, protect staff, service users and visitors, investigate incidents, prevent and detect crime, fraud or antisocial behaviour, and support legal proceedings.

Where criminal offence data is processed, it will only be used where necessary, proportionate and in accordance with applicable data protection, human rights and local government legislation.

Information we process about you

Depending on the service being provided, Facilities Management may process the following categories of personal data:

• Name, title and contact details (including address, telephone number and email address).

• Employee, contractor, supplier, tenant or visitor identification details.

• Organisation and job role information.

• Building access and security information, including visitor records, access card details and CCTV images where applicable.

• Vehicle details, including registration numbers and parking permit information.

• Health and safety information, including accident, incident and near-miss reports.

• Information relating to accessibility requirements, disabilities, health conditions or reasonable adjustments where necessary to support your health, safety or access to council facilities.

• Emergency contact details.

• Correspondence, enquiries, complaints and service requests.

• Records relating to facilities management services, maintenance activities, room bookings, asset management and site operations.

• Training, competency, accreditation and contractor compliance records where required.

• Investigation, security or safeguarding records where necessary.

• Information relating to criminal offences, allegations or incidents where required for security, crime prevention, safeguarding, legal or regulatory purposes.

We will only collect and process personal data that is necessary, relevant and proportionate for the purposes described in this privacy notice.

Recipients of the personal data that we process about you

We may share your personal data, where necessary and lawful to do so, with:

• Lancashire County Council departments and services.

• Contractors, suppliers and service providers engaged to deliver facilities management, maintenance, cleaning, catering, security, waste management, property, and workplace services on behalf of the Council.

• Building occupiers, tenants and partner organisations operating from Council premises where necessary for operational, health and safety, or security purposes.

• Emergency services, including the Police, Fire and Rescue Service, and Ambulance Service.

• Health and safety, regulatory and enforcement bodies, including the Health and Safety Executive (HSE).

• Local authorities, government departments and public sector organisations where information sharing is required by law or is necessary to support the delivery of Council functions.

• Insurers, legal representatives, auditors and investigative bodies in connection with claims, complaints, incidents, inspections, audits or legal proceedings.

• Security providers and operators of access control, visitor management or CCTV systems acting on behalf of the Council.

• Courts, tribunals, law enforcement agencies and safeguarding partners where disclosure is required or permitted by law.

We will only share personal data where there is a lawful basis to do so and appropriate safeguards are in place to protect your information.

Any transfers to another country

Where Council-approved systems or service providers process personal data outside the UK, or permit access from outside the UK, we will ensure that appropriate safeguards are in place in accordance with UK data protection legislation. This may include the use of adequacy regulations, International Data Transfer Agreements (IDTAs), or other approved transfer mechanisms.

Retention periods

Lancashire County Council will only retain your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory requirements, to support operational needs, and to establish, exercise or defend legal claims.

Records created and maintained by Facilities Management will be retained in accordance with Lancashire County Council's Records Retention and Disposal Schedule and information governance policies.

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:

• to be informed via Privacy Notices such as this.

• to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.

• of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.

• of rectification, we must correct inaccurate or incomplete data within one month.

• to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.

• to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.

• to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.

• to object. You can object to your personal data being used for profiling, direct marketing or research purposes.

• in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights, then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ 

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Identity and contact details of the data controller

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Further information

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).