Privacy statement and notice

Introduction

This notice provides advice for customers about how the Council will use the personal information provided by them and their rights. The full policy can be found on the Council’s website.

The information is provided to comply with the General Data Protection Regulation 2016 (GDPR). This is a Europe-wide law that replaces the Data Protection Act 1998 in the UK.

This information leaflet gives general information about your rights and our obligations. It refers particularly to how we will process the information you have provided for the specific purpose of managing your tenancy.

Data Protection Rights

North Warwickshire Borough Council is fully committed to compliance with the requirements of the Data Protection Act 1998 (“the Act”) and the changes arising from the General Data Protection Regulation (GDPR) and in the Data Protection Act 2018.

With regard to the information you provide the Council is the data controller.

All of our employees, Councillors and others working on our behalf, who have access to or process any personal information held by us, or on our behalf, are made aware of their duties and responsibilities under the Act and the new requirements specified in the GDPR and the Data Protection Act 2018.

The GDPR applies to personal data, which means any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.

It is the Council’s stated intention to ensure that information provided by its customers is:

1. Processed fairly, lawfully and in a transparent manner in relation to the data subject.
2. Collected for specified, explicit and legitimate purposes and not further processed for other purposes incompatible with those purposes.
3. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
4. Accurate and, where necessary kept up to date.
5. Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
6. Processed in a way that ensures appropriate security of the personal data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Our employees are aware that all personal information must be handled and dealt with properly no matter how it is collected, recorded and used and whether it is held on paper, in computer records or recorded by any other means.  There are safeguards in the Act which ensure this.

We will, therefore, make certain that we treat all personal information that we hold in a lawful and correct manner and in accordance with the Act.  We will also comply with the Data Protection Principles set out in the Act.

The information that we hold and use is provided with consent. In some circumstances we will not be able to provide the service or support you are requesting unless we have certain information however we understand that the consent you give will not be valid unless:

• there is a genuine choice;
• it has been explicitly and freely given and is an informed choice
• the consent was given through a statement made by you or by a clear affirmative action undertaken by you
• the Council can demonstrate that you have been fully informed about the data processing to which they have consented and is able to prove that it has obtained valid consent lawfully;
• a mechanism is provided for you to withdraw your consent and you are able to do this easily

How we obtain your personal data

Personal data will only be collected, created or otherwise obtained for specific, explicit and legitimate purposes.

We ask you to provide personal data to allow us to manage your tenancy and offer support services if appropriate.

The information we obtain is subject to it being for legitimate purposes and, in some circumstances, to your consent. It includes your name, address, date of birth, photographic I.D. and national insurance number. We will have your contact details. We will record the names and dates of birth of your family if they living in your tenancy. We will ask for information about your current personal circumstances as they relate to your tenancy and support that you may require. It can include information about your medical and/ or your financial situation. We may have information about your circumstances which we receive in correspondence or by e-mail. We will document our meetings with you and information from home visits. We do not record telephone conversations. We will hold information on other households who live in your tenancy.

We may obtain information from third parties in order to support you in your tenancy. We will ask for your consent to obtain this information.

How we use your personal data

We use your personal data to manage your tenancy and to keep it under review to ensure we are able to support you to meet your housing needs.

Sometimes we might share the information you have provided with another public body, such as the County Council, because we have concerns about your safety or well being. We will advise you if we intend to do this.

With your consent, if you require support services to assist you, we will share specific personal information with the relevant agency as part of an agreed referral.

To allow us to repair and maintain your home we will need to share your contact details with contractors who work for us to deliver our maintenance service. Usually this will be your name, address and contact telephone number. If we need to share other personal data we will request your permission. Our contractors will only use the data we provide for the specific purpose of providing the maintenance work we have ordered.

The Council will ensure that it does not retain personal data for any longer than is necessary for the purposes for which they were collected and will apply appropriate measures at the end of data’s useful life such as erasure or anonymising.

We will retain the information that you have provided whilst you have a tenancy with the Council. We will keep records for 2 years after your tenancy ends. This is to fulfil regulatory requirements such as the Right to Buy scheme and succession.

Sharing Information

We will keep the information you have provided confidential.

We will only share the information you have provided with your consent and to enable us to manage your tenancy.

There may be times when we need to share personal information with third parties for the purposes set out in this notice or where we are legally required to do so. Examples are when we have to comply with a court order, to assist with fraud protection or to protect the vital interests of an individual.

Information rights

The Council recognises the legal rights of those whose data it is processing or intends to process and will ensure that appropriate information is provided to them advising them of their rights, and that policies and procedures are maintained to ensure that the organisation is able to recognise information rights requests and handle them appropriately when they are exercised. These rights include:

• Right to information about data processing operations
• Right of access to personal data
• Right to portability of personal data (which is the right to have personal data transmitted to another data controller)
• Right of rectification of personal data (if it is inaccurate)
• Right of erasure of personal data
• Right to restriction of processing
• Right to object to direct marketing
• Right to object to data processing operations under some circumstances
• Right not to be subject to decisions made by automated processing under some circumstances
• Right of complaint about the organisation’s processing of personal data and the right to a judicial remedy and compensation

Protection of Data

The Council will maintain a Data Breach Reporting Procedure and will ensure that all employees and those with access to personal data are aware of it.

All employees and individuals with access to personal data for which the organisation is either data controller or processor are expected to report all personal data breaches to an appropriate individual as set out in the Data Breach Reporting Procedure as soon as they become aware of the breach.

The Council will log all personal data breaches and will investigate each incident without delay. Appropriate remedial action will be taken as soon as possible to isolate and contain the breach, evaluate and minimise its impact, and to recover from the effects of the breach. Data protection near misses will also be recorded and investigated in the same manner as data protection breaches. The breach reporting procedure will set out responsibilities, decision-making criteria and timescales for notifying data subjects, the Information Commissioner and the media about a personal data breach.