Lancashire Music Service

To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Contact details of this Lancashire County Council service:

Note that for queries intended for this specific service, do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to the following point of contact:

https://www.lancashiremusichub.co.uk/site/contact/

Reasons for processing your personal data

We process personal data to enable Lancashire Music Service to deliver, manage and improve music education services across Lancashire. This includes:

Registering learners for music lessons, ensembles, workshops, performances and other music education activities.
Managing applications, enrolments, attendance, timetables and participation in Lancashire Music Service programmes.
Communicating with pupils, parents, carers, schools, tutors and other relevant stakeholders about services and activities.
Providing instrumental and vocal tuition, progression opportunities, performances and enrichment activities.
Managing payments, invoicing, instrument hire arrangements, bursaries and other financial support services.
Identifying and providing appropriate support, adjustments and accessibility arrangements to meet individual needs.
Safeguarding the welfare, health and safety of children, young people and others who engage with the service.
Monitoring participation, attendance, service performance and outcomes to help improve the quality and effectiveness of music education provision.
Planning and managing resources, staffing, venues and service delivery across Lancashire.
Producing reports, statistics and management information to support service improvement, accountability and decision making.
Meeting legal, regulatory, audit, funding and accountability requirements.
Promoting equality of opportunity, accessibility and inclusion within music education services.
Responding to enquiries, complaints, requests and feedback relating to Lancashire Music Service.

The information we process helps us provide a safe, effective and inclusive music education service while ensuring resources are targeted appropriately and opportunities are available to children and young people across Lancashire.

Use of artificial intelligence (AI) technologies

We are increasingly utilising AI technologies to process your personal data. This is primarily utilised within Lancashire County Council using Microsoft Copilot Web and Microsoft Copilot 365. Please consult our Artificial Intelligence privacy notice for more details of how we use these specific platforms.

We do not use AI to make automated decisions. There is always a human intervention to review and approve any outputs from the AI tools. Decisions are not made solely by automated means.

Examples of how AI technologies may be used include:

Assisting staff to draft emails, letters, reports, meeting notes and other routine communications.
Summarising information and documents to help staff work more efficiently.
Analysing service, participation and performance data to identify trends, patterns and areas for service improvement.
Supporting reporting, business intelligence, planning and resource allocation activities.
Assisting with the creation of management information, dashboards and statistical reports.
Helping staff locate, organise and interpret information held within approved Council systems.
Supporting the creation of accessible content, guidance and communications for service users and stakeholders.

When using AI technologies:

Only Lancashire County Council approved AI tools are used.
We seek to minimise the amount of personal data used and will use anonymised or aggregated information wherever possible.
AI-generated content and insights are reviewed by appropriately authorised staff before being relied upon or acted upon.
Human oversight is always maintained, and AI is used to support decision making rather than make decisions independently.
Appropriate security, confidentiality and data protection controls are applied to information processed using AI technologies.

Legal basis for processing personal data

The legal basis for processing your personal data under UK GDPR Article 6 is:

(a) Consent – in limited circumstances, we may ask for your consent to process personal data for a specific purpose. For example, this may include the use of photographs, videos or recordings for promotional purposes, or other optional activities. Where we rely on consent, you may withdraw your consent at any time.

(b) Contract – processing is necessary to provide services that you or your parent/carer have requested, such as music lessons, ensemble membership, instrument hire, event participation, invoicing, payment administration and related customer support activities.

(e) Public Task – processing is necessary for Lancashire County Council to carry out its official functions and responsibilities relating to the provision, management, monitoring and development of music education services for children and young people across Lancashire. This includes the administration of music tuition, participation monitoring, safeguarding, service planning, performance monitoring and equality of access activities.

The Council's reliance on the Public Task lawful basis is supported by legislation including:

Education Act 1996 – relating to local authority responsibilities for education provision and the promotion of educational opportunities.
Education Act 2002 – providing powers and responsibilities connected with the delivery and administration of education services.
Education and Inspections Act 2006 – supporting educational improvement and wider educational activities.
Local Government Act 1972 – providing local authorities with powers to deliver services for the benefit of their communities.
Article 6(1)(e) UK GDPR, together with Article 6(3) UK GDPR and section 8 of the Data Protection Act 2018, which permit public authorities to process personal data where necessary to exercise official functions or perform tasks in the public interest.

We will only process your personal data where there is a valid legal basis to do so and where the processing is necessary and proportionate for the purposes of delivering and managing Lancashire Music Service.

Legal basis for processing special categories of personal data

Where it is necessary for Lancashire Music Service to process special category personal data, such as information relating to health conditions, disabilities, accessibility requirements, special educational needs, ethnicity or other equality monitoring information, the legal basis under UK GDPR Article 9 is:

(g) Substantial Public Interest – processing is necessary to ensure that music education services are delivered safely, inclusively and equitably, to support safeguarding responsibilities, make reasonable adjustments, promote equality of opportunity, monitor accessibility, and ensure that children and young people can participate effectively in activities and programmes.

This processing is supported by the following legislation:

Article 9(2)(g) UK GDPR and Schedule 1, Part 2 of the Data Protection Act 2018, which permit the processing of special category personal data where this is necessary for reasons of substantial public interest and appropriate safeguards are in place.
Equality Act 2010, which requires public authorities to eliminate discrimination, advance equality of opportunity and make reasonable adjustments where required.
Children Act 1989 and Children Act 2004, which place duties on local authorities to safeguard and promote the welfare of children and young people.
Education Act 1996 and Education Act 2002, which support the provision of education services and the inclusion of children and young people with additional needs.

In limited circumstances, we may also rely on:

(a) Explicit Consent – where we ask for your explicit consent to process categories of sensitive personal data for a specific purpose and no other appropriate condition applies. Where we rely on consent, you may withdraw your consent at any time.

We only process special category personal data where it is necessary, proportionate and subject to appropriate technical and organisational safeguards to protect your privacy and confidentiality.

Information we process about you

Depending on the services you receive or your involvement with Lancashire Music Service, we may process:

Name, date of birth and unique identification numbers.
Home address, email address, telephone number and other contact details.
Parent, guardian and carer information, including emergency contact details.
School, educational setting and year group information.
Details of music lessons, ensembles, performances, workshops and other activities you participate in.
Attendance, participation, engagement and progression records.
Instrument hire, booking and registration information.
Payment, invoicing, bursary and financial support information where applicable.
Correspondence, enquiries, requests, feedback and communication records.
Information about disabilities, health conditions, medical needs, accessibility requirements or special educational needs where necessary to support safe and inclusive participation.
Equality, diversity and inclusion information where collected to support accessibility monitoring and service improvement.
Safeguarding information where required to protect children and young people and to fulfil our safeguarding responsibilities.
User account, system access and technical information relating to the use of our online services and systems.

Recipients of the personal data that we process about you

We may share your personal data, where necessary and appropriate, with:

Lancashire County Council employees involved in the administration, management and delivery of Lancashire Music Service.
Schools, academies, colleges and other educational settings participating in or supporting music education activities.
Music tutors, instructors, ensemble leaders, contractors and volunteers involved in delivering services on our behalf.
Parents, guardians and carers, where information sharing is necessary to support participation and service delivery.
Approved system and technology providers that support our services, including providers of music service management systems, Microsoft 365 services and reporting platforms.
Payment processing providers and financial service partners involved in managing payments, invoicing and instrument hire arrangements.
Funding, regulatory and government organisations where information is required for funding, monitoring, audit or statutory reporting purposes, including the Department for Education and Arts Council England.
Other local authorities, auditors, inspectors, regulators or public sector organisations where there is a lawful basis for sharing information.
Safeguarding, law enforcement or emergency services where information sharing is necessary to protect children, young people or other individuals, or where required by law.

We will only share personal data where there is a legitimate business need, a legal obligation, or another lawful basis under data protection legislation, and appropriate safeguards will be applied to protect your information.

Any transfers to another country

We do not routinely or intentionally transfer your personal data outside of the United Kingdom.

However, some of the technology platforms and cloud-based services used to deliver and support Lancashire Music Service, such as approved Microsoft 365 services and other contracted service providers, may process or store personal data in countries outside the UK.

Where international transfers occur, we will ensure that appropriate safeguards are in place to protect your personal data and that any transfers comply with UK data protection legislation. These safeguards may include the use of adequacy regulations, approved contractual arrangements or other legally recognised transfer mechanisms.

We regularly review our suppliers and technology providers to ensure that any international processing of personal data remains lawful, secure and appropriately protected.

Retention periods

Lancashire County Council will only keep your personal data for as long as necessary to fulfil the purposes for which it was collected, to meet legal, financial, safeguarding and operational requirements, and in accordance with the Council's Records Retention and Disposal Schedule.

File type	Description	Security	Retention period
Learner records	Personal, contact and participation records relating to pupils receiving music services	Stored within approved secure systems with role-based access controls	Duration of participation plus 6 years
Attendance and lesson records	Registers, timetables and lesson participation information	Securely stored within approved service systems	Current academic year plus 6 years
Financial records	Invoices, payments, instrument hire charges and related financial information	Restricted access and secure financial systems	6 years from the end of the relevant financial year
Bursary and financial support records	Applications and supporting information used to assess eligibility for financial assistance	Restricted access due to the sensitivity of the information	Decision date plus 6 years
Health, accessibility and support records	Information relating to medical needs, disabilities, accessibility requirements and support arrangements	Enhanced access controls and confidentiality measures	Duration of participation plus 6 years
Communications records	Emails, messages, enquiries and routine correspondence	Stored within approved Council systems	6 years from date of communication
Reporting and management information	Service reports, dashboards, statistics and performance information	Stored within approved corporate systems with restricted access	Retained only for as long as required for business and reporting purposes and reviewed regularly
Website, portal and system logs	User account activity, audit trails and technical records	Securely maintained for monitoring and security purposes	12 months unless required for an ongoing investigation or legal purpose

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:

to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights, then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Identity and contact details of the data controller

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Further information

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).