Information Governance

To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

The Information Governance Team is responsible for managing all Subject Access Requests (SARs), Freedom of Information (FOI) requests and Environmental Information Regulations (EIR) requests that Lancashire County Council receives.
The Information Governance Team process personal information to provide access to public information and/or a copy of your personal information and records that the council holds either directly or jointly with partners and commissioned private and third sector providers.
The team also handles any information security incidents or data breaches that are reported to Lancashire County Council and manages these in accordance with statutory frameworks and internal policies.
We facilitate access to personal data relating to Lancashire County Council's own employees where there is a legitimate requirement for internal teams or services to do so.

Category of personal data being processed

Personal data (information relating to a living, identifiable individual)
Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)
Criminal offence or criminal record data

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

Legal Obligation: the processing is necessary for us to comply with the law. We will cite the applicable legislation if we need to rely on this basis for processing.

This lawful basis is relied on by virtue of the following legislation:

Legal basis for processing special categories of personal data

The legal basis for processing special categories of personal data relating to you, in accordance with the UK GDPR is:

(g) Processing is necessary for reasons of substantial public interest.

This lawful basis is relied on by virtue of the following legislation:

Recipients of the data

We may share your personal data with internal Lancashire County Council teams and services to effectively respond to a request we receive and handle.
We may share your personal data with external organisations that are involved in handling a request for information, or who we must liaise with as part of a request, data breach, information security incident or investigation.

This includes the following organisations:

- The Information Commissioners Office
- Other councils
- NHS organisations such as NHS trusts, Integrated Commissioning Boards, GPs surgeries or others
- Lancashire Police
- Our providers commissioned to provide certain services on behalf of Lancashire County Council
- Providers of the digital systems/platforms that we use to process personal data

Your personal data will only ever be shared with such organisations where a clear lawful basis or exemption under UK GDPR exists for Lancashire County Council to do so.

Information we share

We will process a wide range of personal data about you, to respond to requests for information that you submit, or for other legitimate purposes for which we have a clear lawful basis.

This includes the following broad categories of data:

Contact details of yourself and others associated with you
Proof of identity
Address details
Details of any social care involvement you might have had with Lancashire County Council
Medical data that forms part of social care involvement and support that we might have provided to you.
Criminal record/criminal offence data that may have been captured and recorded by Lancashire County Council as part of its broader service provision.

Any transfers to another country

We do not transfer personal data outside of the United Kingdom.

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File type	Description	Security	Retention period
Email	Emails held in Outlook that haven't been exported or moved elsewhere.	Encrypted used when emailing personal data to partners.	Retained in accordance with appropriate internal retention guidelines
SAR/FOI/EIR cases	All correspondence and response associated with any given SAR/FOI/EIR	Held in a secure dedicated case management platform we utilise	Retained for 6 years from case closure

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:

to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights, then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific service, then please contact DPO@lancashire.gov.uk.

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law, you can complain to the Information Commissioner’s Office (ICO).