APPROVED AT GOVERNANCE AND PROCEDURES COMMITTEE 15TH MAY 2018
1. Background
1.1 Part of moving towards compliance with General Protection Data Protection Regulations is that the Council should adopt a Privacy Policy and publish this on its website. The following policy is drawn from a draft prepared by the Herefordshire Association of Local Councils after legal advice from the National Association and their consultants. It is compliant with the requirements of the Data Protection Act 2018.
2. Data Controller
2.1 The data controller for your data is Hereford City Council. We do not have any joint data controller arrangements with any other parties.
3. Types of Personal Data
3.1 The Council will process some or all of the following personal data where necessary to perform its tasks: names, titles, aliases, photographs. Contact details such as addresses, email addresses, telephone numbers. Where there is a financial relationship with the Council such as receipt of a grant or payment for services we will keep and process financial identifiers such as bank account numbers, claim numbers, BACS details and payment transaction identifiers. Where you apply for employment with the Council we will process details of your employment history, qualifications and references.
4. To comply with data protection law the personal data we hold must be:
Used lawfully, fairly and in a transparent way.
Collected only for valid purposes that we have clearly explained to you and not used in any way not compatible with those purposes.
Relevant to the purposes we have told you about and limited only to those purposes.
Accurate and kept up to date.
Kept only for as long as necessary for the purposes we have told you about.
Kept and destroyed securely including ensuring that appropriate technical and securitymeasures are in place to protect your personal data from loss, misuse, unauthorised access and disclosure.
5. Personal Data Uses
5.1 We will use your personal data for some or all of the following purposes:
To deliver public services including to understand your needs to provide the services that you request and to understand what we can do for you and inform you of other relevant services.
To confirm your identity to provide some services.
To contact you by post, email or telephone.
To enable us to meet our legal and statutory obligations and powers including any
delegated functions.
To prevent and detect fraud and corruption in the use of public funds and where
necessary for law enforcement.
To promote the interests of the Council.
To maintain our own accounts and records.
To seek your views and comments.
To notify you of events and invite you to attend.
To notify you of changes to our facilities, services, events, staff, councillors and civic office holders.
To send you communications which you have requested and that may be of interest to you, including information about campaigns, appeals and new projects or initiatives.
To process relevant financial transactions including grants and payments for goods and services supplied to the Council.
To allow for the statistical analysis of data so we can plan the provision of services.
To ensure the Council meets its obligations in respect of safeguarding vulnerable adults or children.
6. Legal Basis for Processing Personal Data
6.1 The Council is a public authority and has certain powers and duties. Most of your personal data is processed for compliance with a legal obligation which includes the discharge of the Council’s statutory functions and powers. Sometimes when exercising these powers or duties it is necessary to process personal data of residents or people using the Council’s services. We will always take into account your interests and rights. This Privacy Policy sets out your rights and the Council’s obligations to you in detail.
6.2 We may also process personal data if it is necessary for the performance of a contract with you, or to take steps to enter into a contract.
6.3 Where the use of your personal data requires your consent, we will seek this before processing your data.
7. Sharing Personal Data
7.1 The Council will implement appropriate security measures to protect your personal data.
7.2 The Council will not share your data with third parties, except where required by law to do so, as it is retained and processed solely to enable the Council to perform its functions.
8. Personal Data Retention
8.1 We will keep some records permanently if we are legally required to do so. It is current best practice to keep financial records for eight years to support HMRC audits or provide tax information. We have some legal obligations to retain some data in connection without statutory functions. We also retain historical data relating to the civic history of the city.
8.2 The Council is permitted to retain data in order to defend or pursue claims. In general, we will endeavour to keep data only for as long as we need it. This means that we will delete it when it is no longer needed.
9. Your Rights and Your Personal Data
9.1 You have the following rights with respect to your personal data:
The right to access personal data we hold on you.
The right to correct and update the personal data we hold on you.
The right to have your personal data erased except where we have a legal obligation to retain it.
The right to object to processing of your personal data or to restrict it to certain purposes only.
The right to data portability.
The right to withdraw your consent to the processing at any time for any processing of data to which consent was obtained.
The right to lodge a complaint with the Information Commissioner’s Office.
10. Transfer of Data Abroad
10.1 The Council will not transfer your personal data abroad.
11. Further Processing
11.1 If we wish to use your personal data for a new purpose, not covered in this policy, then we will provide you with a privacy notice explaining the new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
12. Contact Details
12.1 Please contact us if you have any questions about this Privacy Policy or the personal data we hold about you or to exercise all relevant rights, queries or complaints: Steve Kerry, Town Clerk, 01432 260429, clerk@herefordcitycouncil.gov.uk, Hereford City Council, Town Hall, St
Owen Street, Hereford HR1 2PJ.
13. Review
13.1 Unless a change of legislation requires that this policy be reviewed or amended, it shall be reviewed during the first year of each new administration. The next regular review is therefore expected to be in the Autumn of 2023.
