Lancashire Child and Youth Justice Service
To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.
Contact details of this Lancashire County Council service:
Note that for queries intended for this specific service, do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to the following point of contact:
Lancashire Child and Youth Justice Service on 01772 532047
Reasons for processing your personal data
Lancashire County Council processes personal data through its Child and Youth Justice Service (CYJS) to deliver statutory youth justice functions. CYJS is a multi-agency partnership service working with children aged 8-18 who have committed offences or are at risk of offending. We also provide a consent led service to victims of crime. The service aims to:
Prevent offending and reoffending by children and young people through early intervention, diversion, and support.
Deliver statutory youth justice interventions, including out-of-court disposals and court-ordered supervision.
Support rehabilitation and reintegration of children into society using trauma-informed, restorative, and child-first approaches.
Safeguard children and reduce harm to victims and communities by addressing the underlying causes of offending.
Coordinate multi-agency support, including input from social care, education, police, probation, and health services.
Monitor and evaluate performance to improve service delivery and outcomes for children, families, and victims.
Engage volunteers and community partners to support children in making positive life choices and contributions to society.
Provide services to victims of crime who opt in to access support from the YJS.
Personal data is processed to assess needs, plan interventions, deliver services, and monitor outcomes in line with statutory duties under the Crime and Disorder Act 1998 and guidance from the Youth Justice Board.
Use of artificial intelligence (AI) technologies
We are increasingly utilising AI technologies to process your personal data. This is primarily utilised within Lancashire County Council using Microsoft Copilot Web and Microsoft Copilot 365. Please consult our Artificial Intelligence privacy notice for more details of how we use these specific platforms. We do not use AI to make automated decisions. There is always a human intervention to review and approve any outputs from the AI tools. Decisions are not made solely by automated means.
Any use of LCC approved AI in CYJS is for non-sensitive, administrative tasks and is not used in the context of Youth Justice assessments or planning for children, families and victims.
Legal basis for processing personal data
The Child and Youth Justice Service processes personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The lawful bases for processing are:
Article 6(1)(a) - Consent: Would be applicable in specific circumstances:
Sharing information with non-statutory third parties: If the service wishes to share personal data with organisations not covered by statutory duties (e.g. certain voluntary sector providers), and there is no other lawful basis, consent may be sought.
Use of personal stories or case studies for training or awareness: Where anonymised or identifiable data is used for service improvement, staff training, or public engagement, explicit consent would be required.
Communication preferences: For example, where individuals opt in to receive updates or information about services via email or text.
Article 6(1)(c) - Legal obligation: Processing is necessary for compliance with a legal obligation to which the Council is subject. This includes statutory duties under the Crime and Disorder Act 1998, the Children Act 1989 and 2004, and other legislation governing youth justice and safeguarding.
Article 6(1)(e) - Public task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Council. This relates to the Council’s role in preventing offending, protecting the public, and supporting children’s welfare.
Legal basis for processing special categories of personal data
In addition to standard personal data, the Child and Youth Justice Service may process special category data (such as health information, ethnicity, and data relating to criminal offences) where necessary to fulfil its statutory functions.
Under UK GDPR Article 9, the lawful bases for processing special category data include:
Article 9(2)(g) - Substantial public interest: Processing is necessary for reasons of substantial public interest, including safeguarding children and individuals at risk, preventing crime, and protecting the public. This is supported by provisions in Schedule 1, Part 2 of the Data Protection Act 2018, such as:
Safeguarding of children and individuals at risk
Statutory and government purposes
Preventing or detecting unlawful acts
Article 9(2)(h) - Health or social care: Processing is necessary for the provision of health or social care services, including assessments, support planning, and service delivery under the Children Act and other relevant legislation.
Article 9(2)(f) - Legal claims: Where necessary for the establishment, exercise, or defence of legal claims.
The Council ensures that appropriate safeguards are in place to protect this data, including strict access controls, secure systems, and adherence to data minimisation principles.
Legal basis for processing criminal offence data
The Child and Youth Justice Service may process personal data relating to criminal convictions and offences in accordance with UK GDPR Article 10 and the Data Protection Act 2018. This type of data is subject to additional safeguards due to its sensitivity.
Processing is carried out under the Council’s official authority and statutory responsibilities, and is supported by:
Schedule 1, Part 3 of the Data Protection Act 2018, which permits processing where it is:
Necessary for the exercise of a function conferred by an enactment or rule of law (e.g. youth justice duties under the Crime and Disorder Act 1998).
Necessary for the administration of justice or for the prevention or detection of unlawful acts.
Necessary for safeguarding children and individuals at risk.
The Council ensures that appropriate policies and procedures are in place to meet the requirements of Section 35 of the Data Protection Act 2018, including a policy document outlining how criminal offence data is handled and protected.
Information we process about you
The Child and Youth Justice Service collects and processes a range of personal and special category data to deliver its statutory functions. This includes:
Personal Data
Full name, date of birth, gender, and contact details
Address and family composition
Education history and school attendance
Social care involvement and case history
Details of offending behaviour and legal outcomes
Information about parents/carers and other family members
Referral and assessment information
Case notes and service interactions
Special Category Data
Racial or ethnic origin
Physical or mental health information
Religious or philosophical beliefs (where relevant)
Sexual orientation (where relevant to safeguarding or support)
Data concerning criminal convictions and offences (processed under Article 10 UK GDPR and Schedule 1 of the Data Protection Act 2018)
Other Data
Risk assessments and safeguarding concerns
Information shared by partner agencies (e.g. police, probation, health, education)
Outcomes of interventions and progress reports
Volunteer involvement and DBS status (for those participating in Referral Order Panels)
All data is stored securely on an electronic case management system and accessed only by authorised personnel.
Recipients of the personal data that we process about you
To deliver its statutory functions and provide effective support to children, young people, families, and victims, the Child and Youth Justice Service shares personal data with authorised partner organisations. These may include:
Local authority departments, including children’s social care, education, and safeguarding teams
Police and other law enforcement agencies, for crime prevention, investigation, and public protection
National Probation Service, for supervision and rehabilitation of young people involved in offending
Health services, including NHS mental health and substance misuse teams, for care and treatment planning
Schools and education providers, to support educational engagement and address barriers to learning
Youth Justice Board, for oversight, performance monitoring, and statutory reporting
Courts and legal representatives, where required for legal proceedings and compliance with court orders
Community volunteers, specifically those involved in Referral Order Panels, who receive limited personal data under strict confidentiality agreements and DBS clearance
Other commissioned services and voluntary sector organisations, where involved in delivering support or interventions
All data sharing is carried out in accordance with UK GDPR, the Data Protection Act 2018, and relevant safeguarding legislation. Information is only shared where necessary, proportionate, and lawful, with appropriate safeguards in place to protect privacy.
Any transfers to another country
No
Retention periods
Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.
File type | Description | Security | Retention period |
|---|---|---|---|
Child and Youth Justice Service case file (excluding Looked After Children and those convicted of MAPPA eligible offences) including details of parents/carers/siblings and anonymised victim data (crime ref no, contact with victim, what service offer, if accepted) | Destroy or extend if further offence | Stored on Core + | 25 years Retention trigger - Date of Birth |
Records relating to children convicted of Multi-Agency Public Protection Arrangements (MAPPA) eligible offences (under Schedule 18 or 17a of the Sentencing Act 2020)1. Case files include details of parents/carers/siblings | Destroy or extend if further offence | Stored on Core + | 100 years from action date. Summary case details will be passed to Lancashire Archives for permanent preservation at the end of retention |
Looked After Service User Case File (also remanded children to Local Authority Accommodation and the Secure Estate) including details of parents/carers/siblings. | Destroy | Stored on Core + | 75 years Retention trigger Date of Birth |
Child's Health Information Files | Destroy | Stored on Core + | 25 years (unless they have been convicted of a MAPPA eligible offence under Schedule 18 or 17a of the Sentencing Act 2020 and/or are a CLA, in which case the above retention schedules apply). Retention tigger DOB |
Victim records (victim information including protected characteristics, crime ref number, contacts with the victim, details of the service offer/intervention undertaken, if accepted)
| Destroy | Core Plus
| Expunge at 2 years Full deletion at 4 years Retention Trigger From the date of conclusion of intervention. |
Spreadsheets tracking individuals through court system/live cases within the Child and Youth Justice Service | Destroy | Stored on the R: Drive | Details input into Core + or cases no longer live. |
Your rights
You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:
to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.
If you want to exercise any of these rights, then you can do so by contacting:
Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ
Email: dpo@lancashire.gov.uk
To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.
Identity and contact details of the data controller
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Contact details of the data protection officer
Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Further information
For more information about how we use personal information see Lancashire County Council's full privacy notice.
If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law, you can complain to the Information Commissioner’s Office (ICO).