Trading Standards

In order to comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

  • Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

  • Our Data Protection Officer is Paul Bond. You can contact him at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

Lancashire Trading Standards Service has a legal duty to enforce a range of public protection legislation, and in so doing will process personal data. The data is gathered following visits and inspections of trader premises, sampling and testing activity, consumer complaints (usually referred to us via the Citizen's Advice Consumer Service), requests for advice from businesses, consumers and partner agencies, investigations and prosecutions including witness statements and interview records and documents, provision of information on application forms e.g. for licensing of explosives and petroleum storage, and information provided in connection with membership of or use of our Safe Trader Scheme.

Category of personal data being processed

  1. Personal data (information relating to a living, identifiable individual)
  2. Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)
  3. Criminal convictions data

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

(c) Legal Obligation: the processing is necessary for you to comply with the law. You must reference the applicable legislation if you wish to rely on this basis for processing.

(e) Public Task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. You must reference the applicable task/function and its' basis in law if you wish to rely on this basis for processing.

Legal basis for processing special categories of personal data

The legal basis for processing your special categories of personal data, in accordance with the UK GDPR is:

(g) Processing is necessary for reasons of substantial public interest.

Data Protection Act 2018- Schedule 1 Part 2 statutory and government process states

(1)

This condition is met if the processing—

(a) is necessary for a purpose listed in sub-paragraph (2), and

(b) is necessary for reasons of substantial public interest.

(2)

Those purposes are—

(a) the exercise of a function conferred on a person by an enactment or rule of law;

All Lancashire County Council Trading Standards duly appointed Officers are (1) appointed authorised officers for the appropriate exercise of all the County Council’s powers and duties under the Schedule of Statutes reproduced below and any statutes amending or extending the same, and appropriate Statutory Instruments, Regulations, By-Laws or Orders made there under and (2) authorised under Sections 101, 222 and 223 of the Local Government Act 1972 to appear in, on behalf of the county council, any proceedings before any Magistrates Court under the appropriate acts set out in the Schedule of Statutes. See Table of Statutes on our website. 

For criminal record data, UK GDPR Article 10 is the lawful gateway - processing of personal data relating to criminal convictions and offences. Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6 (1) shall be carried out only under the control of official authority or when the processing is authorised by domestic law providing for appropriate safeguards for the rights and freedoms of data subjects. Conditions 10, 12 and 15 of Schedule 1 DPAI 2018 apply.

Recipients of the data

We will usually seek your consent before sharing information, however if there is a legal reason we may not require your consent e.g. in connection with the prevention or detection of crime. We may share information with:

  • Other Departments within the County Council where necessary for public tasks/safeguarding.
  • District Councils.
  • Law Enforcement agencies including HM Revenue and Customs, National Crime Agency, Department for Work and Pensions , Illegal Money Lending Team, Insolvency Service, Companies Investigations Branch, Environment Agency, Licensing Authorities, Action Fraud, Environmental Health, Council Tax, Legal Departments and Trade Associations, Health and Safety Executive.
  • Citizens Advice Consumer Service
  • National Trading Standards and Regional Investigations Teams
  • National Anti-Fraud Network and Sanctions Information Database
  • Local Authority Trading Standards Services
  • Central Government Departments including Office for Product Safety and Standards, DEFRA, Food Standards Agency
  • Police and Fire and Rescue Services
  • Community Safety Partners
  • Members of the public under certain Data Protection or Freedom of Information conditions

Information we share

  • Name
  • Date of birth/age
  • Gender
  • Marital status
  • Children
  • Place of birth
  • Contact details and preferred contact method
  • Health data including disabilities
  • Job/profession and other information about employment history and current employment
  • Professional qualifications
  • Photographs, audio and video records
  • Income and other financial information
  • Services or products provided to individuals and information about the services or products
  • Case details
  • Known associates
  • Enforcement and Investigation information
  • Patterns of offending
  • The devices and technology individuals use
  • Information from the Electoral Register
  • Social relationships and emergency contacts
  • National Insurance Number and other identifiers
  • Racial or ethnic origin
  • Criminal convictions and offences

Any transfers to another country

The service will occasionally share data with other law enforcement agencies within the European Economic Area (EEA) if necessary for a specific purpose.

The service will always ensure that any such processing complies with UK GDPR and Data Protection Act (2018) requirements.

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File Type Description Security Retention Period
Criminal Case Management System Prosecution files. Held on secure database, password protected The end of 6 years after proceedings concluded or longer if a specific need is identified.
APP Database Client Files. Held on secure database, password protected End of 6 years following closure of the record or completion of proceedings, whichever is later.
Website Safe Trader Information. Open information End of 6 years
Cases in which an order was made under the Proceeds of Crime Act 2002 (POCA) Note: The original case file should be retained for the same period as the POCA file. Prosecution files. Prescribed notices and court orders. Held on secure database, password protected Orders of any value: The end of 6 years following the date of the order or the length of the order if this is longer than 7 years Case files should be set for review on these dates to consider whether the retention periods need to be extended due to the recovery of assets.
Criminal Conviction Data. Electronic records confirming the outcome of proceedings and those required to be reported to the Sanctions Information Database. Held on secure database, password protected The end of 6 years after proceedings concluded or longer if a specific need is identified.

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are the right:

  • to be informed via Privacy Notices such as this.
  • to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
  • of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
  • of rectification, we must correct inaccurate or incomplete data within one month.
  • to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
  • to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
  • to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
  • to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
  • in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific service then please contact TSGeneralMail@lancashire.gov.uk or write to:

Lancashire County Council Trading Standards Service
County Hall
Pitt Street
Preston
PR1 0LD

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).