GENERAL PRIVACY NOTICE

Your personal data – what is it?

“Personal data” is any information about a living individual which allows them to be identified from that data (for example a name, photographs, videos, email address, or address).  Identification can be directly using the data itself or by combining it with other information which helps to identify a living individual (e.g. a list of staff may contain personnel ID numbers rather than names but if you use a separate list of the ID numbers which give the corresponding names to identify the staff in the first list then the first list will also be treated as personal data).  The processing of personal data is governed by legislation relating to personal data which applies in the United Kingdom including the General Data Protection Regulation (the “GDPR) and other legislation relating to personal data and rights such as the Human Rights Act.

Who are we?

This Privacy Notice is provided to you by the Rowley Parish Council which is the data controller for your data.

Other data controllers the council works with:

We may need to share your personal data we hold with them so that they can carry out their responsibilities to the council.  If we and the other data controllers listed above are processing your data jointly for the same purposes, then the council and the other data controllers may be “joint data controllers” which mean we are all collectively responsible to you for your data. Where each of the parties listed above are processing your data for their own independent purposes then each of us will be independently responsible to you and if you have any questions, wish to exercise any of your rights (see below) or wish to raise a complaint, you should do so directly to the relevant data controller.

A description of what personal data the council processes and for what purposes is set out in this Privacy Notice.  

The council will process some or all of the following personal data where necessary to perform its tasks:

How we use sensitive personal data  

Do we need your consent to process your sensitive personal data?

The council will comply with data protection law. This says that the personal data we hold about you must be:

We use your personal data for some or all of the following purposes:

Children

There is special protection for the personal data of a child. The age when a child can give their own consent is 13. If the council requires consent from young people under 13, the council must obtain a parent or guardian’s consent in order to process the personal data lawfully. Consent forms for children age 13 plus, must be written in language that they will understand.

What is the legal basis for processing your personal data?

The council is a public authority and has certain powers and obligations.  Most of your personal data is processed for compliance with a legal obligation which includes the discharge of the council’s statutory functions and powers.  Sometimes when exercising these powers or duties it is necessary to process personal data of residents or people using the council’s services.   We will always take into account your interests and rights.  This Privacy Notice sets out your rights and the council’s obligations to you.

We may process personal data if it is necessary for the performance of a contract with you, or to take steps to enter into a contract.  An example of this would be processing your data in connection with the use of sports facilities, or the acceptance of an allotment garden tenancy

Sometimes the use of your personal data requires your consent. We will first obtain your consent to that use.

Sharing your personal data

This section provides information about the third parties with whom the council may share your personal data.  These third parties have an obligation to put in place appropriate security measures and will be responsible to you directly for the manner in which they process and protect your personal data. It is likely that we will need to share your data with some or all of the following (but only where necessary):

How long do we keep your personal data?

We will keep some records permanently if we are legally required to do so.  We may keep some other records for an extended period of time. For example, it is currently best practice to keep financial records for a minimum period of 8 years to support HMRC audits or provide tax information.  We may have legal obligations to retain some data in connection with our statutory obligations as a public authority.  The council is permitted to retain data in order to defend or pursue claims.  In some cases, the law imposes a time limit for such claims (for example 3 years for personal injury claims or 6 years for contract claims).  We will retain some personal data for this purpose as long as we believe it is necessary to be able to defend or pursue a claim.  In general, we will endeavour to keep data only for as long as we need it.  This means that we will delete it when it is no longer needed.

Your rights and your personal data 

You have the following rights with respect to your personal data:

When exercising any of the rights listed below, in order to process your request, we may need to verify your identity for your security.  In such cases we will need you to respond with proof of your identity before you can exercise these rights.

  1. The right to access personal data we hold on you

a) At any point you can contact us to request the personal data we hold on you as well as why we have that personal data, who has access to the personal data and where we obtained the personal data from.  Once we have received your request we will respond within one month.

b) There are no fees or charges for the first request but additional requests for the same personal data or requests which are manifestly unfounded or excessive may be subject to an administrative fee.

If the data we hold on you is out of date, incomplete or incorrect, you can inform us and your data will be updated.

a) If you feel that we should no longer be using your personal data or that we are unlawfully using your personal data, you can request that we erase the personal data we hold.

b) When we receive your request, we will confirm whether the personal data has been deleted or the reason why it cannot be deleted (for example because we need it for to comply with a legal obligation).

You have the right to request that we stop processing your personal data or ask us to restrict processing. Upon receiving the request, we will contact you and let you know if we are able to comply or if we have a legal obligation to continue to process your data.

You have the right to request that we transfer some of your data to another controller. We will comply with your request, where it is feasible to do so, within one month of receiving your request.

You can withdraw your consent easily by telephone, email, or by post (see Contact Details below).

You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/  or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Transfer of Data Abroad

Any personal data transferred to countries or territories outside the European Economic Area (“EEA”) will only be placed on systems complying with measures giving equivalent protection of personal rights either through international agreements or contracts approved by the European Union.  Our website is also accessible from overseas so on occasion some personal data may be accessed from overseas.

Further processing

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions.  Where and whenever necessary, we will seek your prior consent to the new processing.

Changes to this notice

We keep this Privacy Notice under regular review and we will place any updates on this web page http://www.rowleyparishcouncil.co.ukThis Notice was last updated in May 2018.

Contact Details

Please contact us if you have any questions about this Privacy Notice or the personal data we hold about you or to exercise all relevant rights, queries or complaints at:

The Data Controller: Rowley Parish Council, 9 Springdale Way, Newton Drive, Beverley HU17 8NU

Email: rowleyparish@littleweighton.karoo.co.uk

Adopted: May 2018 (RPC).

Rowley Parish Council

GDPR Privacy Policy

  1. Your personal data – what is it?

“Personal data” is any information about a living individual which allows them to be identified from that data (for example a name, photographs, videos, email address, or address).  Identification can be by the personal data alone or in conjunction with any other personal data.  The processing of personal data is governed by legislation relating to personal data which applies in the United Kingdom including the General Data Protection Regulation (the “GDPR) and other local legislation relating to personal data and rights such as the Human Rights Act.

This Privacy Policy is provided to you by Rowley Parish Council which is the data controller for your data.

Our processing may also include the use of CCTV systems for the prevention and prosecution of crime.

The council is a public authority and has certain powers and duties. Most of your personal data is processed for compliance with a legal obligation which includes the discharge of the council’s statutory functions and powers.  Sometime when exercising these powers or duties it is necessary to process personal data of residents or people using the council’s services.  We will always take into account your interests and rights.  This Privacy Policy sets out your rights and the council’s obligations to you in detail.

We may also process personal data if it is necessary for the performance of a contract with you, or to take steps to enter into a contract.  An example of this would be processing your data in connection with the use of sports facilities, or the acceptance of an allotment garden tenancy.

Sometimes the use of your personal data requires your consent. We will first obtain your consent to that use.

The council will implement appropriate security measures to protect your personal data.  This section of the Privacy Policy provides information about the third parties with whom the council will share your personal data.  These third parties also have an obligation to put in place appropriate security measures and will be responsible to you directly for the manner in which they process and protect your personal data. It is likely that we will need to share your data with some or all of the following (but only where necessary):

We will keep some records permanently if we are legally required to do so.  We may keep some other records for an extended period of time. For example, it is current best practice to keep financial records for a minimum period of 8 years to support HMRC audits or provide tax information.  We may have legal obligations to retain some data in connection with our statutory obligations as a public authority.  The council is permitted to retain data in order to defend or pursue claims.  In some cases the law imposes a time limit for such claims (for example 3 years for personal injury claims or 6 years for contract claims).  We will retain some personal data for this purpose as long as we believe it is necessary to be able to defend or pursue a claim.  In general, we will endeavour to keep data only for as long as we need it.  This means that we will delete it when it is no longer needed.

  1. Children

There is special protection for the personal data of a child. The age when a child can give their own consent is 13. If the council requires consent from young people under 13, the council must obtain a parent or guardian’s consent in order to process the personal data lawfully. Consent forms for children age 13 plus, must be written in language that they will understand.

  1. Your rights and your personal data 

You have the following rights with respect to your personal data:

When exercising any of the rights listed below, in order to process your request, we may need to verify your identity for your security.  In such cases we will need you to respond with proof of your identity before you can exercise these rights.


You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/  or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

  1. Transfer of Data Abroad

Any personal data transferred to countries or territories outside the European Economic Area (“EEA”) will only be placed on systems complying with measures giving equivalent protection of personal rights either through international agreements or contracts approved by the European Union.  Our website is also accessible from overseas so on occasion some personal data may be accessed from overseas.

  1. Further processing

If we wish to use your personal data for a new purpose, not covered by this Privacy Policy, then we will provide you with a Privacy Notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions.  Where and whenever necessary, we will seek your prior consent to the new processing.

  1. Changes to this policy

We keep this Privacy Policy under regular review and we will place any updates on this web page  https://rowleyparishcouncil.co.uk  This Policy was last updated in May 2018.

  1. Contact Details

Please contact us if you have any questions about this Privacy Policy or the personal data we hold about you or to exercise all relevant rights, queries or complaints at:

The Data Controller: Rowley Parish Council, 9 Springdale Way, Newton Drive, Beverley.

Email:  rowleyparish@littleweighton.karoo.co.uk

Adopted May 2018

Rowley Parish Council – Data Protection Policy

  1. Introduction

ROWLEY Parish Council has a responsibility under the Data Protection Act 2018 to hold, obtain, record, use and store all personal data relating to an identifiable individual in a secure and confidential manner.  This Policy is a statement of what the Parish Council does to ensure its compliance with the Act.

The Data Protection Policy applies to all Parish Council employees, councillors, volunteers, and contractors.  The Policy provides a framework within which the Parish Council will ensure compliance with the requirements of the Act and will underpin any operational procedures and activities connected with the implementation of the Act.

  1. Background

The Data Protection Act 2018 governs the handling of personal information that identifies living individuals directly or indirectly and covers both manual and computerised information. It provides a mechanism by which individuals about whom data is held (the “data subjects”) can have a certain amount of control over the way in which it is handled.

Some of the main features of the Act are:

  1. Policy Statement

The Parish Council is committed to ensuring that personal information is handled in a secure and confidential manner in accordance with its obligations under the Data Protection Act 2018 and professional guidelines.  The Parish Council will use all appropriate and necessary means at its disposal to comply with the Data Protection Act and associated guidance.

  1. Roles and Responsibilities

 4.1. Data Protection Officer  

The Data Protection Officer is (TO BE APPOINTED IF REQUIRED), and they are responsible for the following tasks:

(a) assigning responsibilities under those policies,

(b) raising awareness of those policies,

(c) training staff involved in processing operations, and

(d) conducting audits required under those policies.

The parish council must provide the Data Protection Officer with the necessary resources and access to personal data and processing operations to enable them to perform the tasks outlined above and to maintain their expert knowledge of data protection law and practice.

4.2. Parish Council 

The Parish Council will be responsible for ensuring that the organisation complies with its responsibilities under the Data Protection Act through monitoring of activities and incidents via reporting by the Data Protection Officer. The Parish Council will also ensure that there are adequate resources to support the work outlined in this policy to ensure compliance with the Data Protection Act.

4.3. All Staff and Councillors

All staff and councillors will ensure that:

It is the responsibility of all staff and councillors to ensure that they comply with the requirements of this policy and any associated policies or procedures.

4.4. Contractors and Employment Agencies

Where contractors are used, the contracts between the Parish Council and these third parties should contain mandatory information assurance clauses to ensure that the contract staff are bound by the same code of behaviour as parish council members of staff and councillors in relation to the Data Protection Act.

4.5. Volunteers 

All volunteers are bound by the same code of behaviour as parish council members of staff and councillors in relation to the Data Protection Act.

  1. Records Management

Good records management practice plays a pivotal role in ensuring that the parish council is able to meet its obligations to provide information, and to retain it, in a timely and effective manner in order to meet the requirements of the Act. All records should be retained and disposed of in accordance with the Parish Council retention schedule.

  1. Consent

The parish council will take all reasonable steps to ensure that service users, members of staff, volunteers, and contractors are informed of the reasons the parish council requires information from them, how that information will be used and who it will be shared with. This will enable the data subject to give explicit informed consent to the parish council handling their data where the legal basis for processing is consent.

Should the parish council wish to use personal data for any purpose other than that specified when it was originally obtained, the data subject’s explicit consent should be obtained prior to using the data in the new way unless exceptionally such use is in accordance with other provisions of the Act.

Should the parish council wish to share personal data with anyone other than those recipients specified at the time the data was originally obtained, the data subject’s explicit consent should be obtained prior to sharing that data, failure to do so could result in a breach of confidentiality.

  1. Children

There is special protection for the personal data of a child. The age when a child can give their own consent is 13. If the council requires consent from young people under 13, the council must obtain a parent or guardian’s consent in order to process the personal data lawfully. Consent forms for children age 13 plus, must be written in language that they will understand.

  1. Accuracy and Data Quality

The parish council will ensure that all reasonable steps are taken to confirm the validity of personal information directly with the data subject.

All members of staff and councillors must ensure that service user personal information is checked and kept accurate and up to date on a regular basis, for example, by checking it with the service user when they attend meetings or organised events that the information held can be validated.

Where a member of the public exercises their right for their data to be erased, rectified, or restricted, the parish council must ensure that records are updated accordingly.  Or where a member of the public objects to the processing of their data, the Data Protection Officer must be notified and the appropriate procedures followed.

  1. Data Protection Impact Assessments

A data protection impact assessment is a process which helps to assess privacy risks to individuals in the collection, use and disclosure of information. They must be carried out at the early stages of projects and are embedded in to the parish council’s decision-making process.

  1. Providers

The parish council must have written contracts in place with all suppliers who process personal data on behalf of the parish council as “data processors”. The parish council will ensure that processors are only appointed if they can provide ‘sufficient guarantees’ through the procurement process that the requirements of the Act will be met and the rights of data subjects protected.

  1. Security and Confidentiality

All staff and councillors must ensure that information relating to identifiable individuals is kept secure and confidential at all times.  The parish council will ensure that its holdings of personal data are properly secured from loss or corruption and that no unauthorised disclosures of personal data are made.

Any personal data transferred to countries or territories outside the European Economic Area (“EEA”) will only be placed on systems complying with measures giving equivalent protection of personal rights either through international agreements or contracts approved by the European Union. Our website is also accessible from overseas so on occasion some personal data may be accessed from overseas.

  1. Rights of Data Subjects

Individuals wishing to request their information as a subject access request should contact the parish council in writing, who will arrange for the information to be processed in accordance with the Data Protection Act.

Data Controller: ROWLEY Parish Council, 9 Springdale Way, Newton Drive, Beverley, HU17 8NU

Website: www.rowleyparishcouncil.co.uk

Email: clerk@rowleyparishcouncil.co.uk

APPENDIX 1

DATA PROTECTION PRINCIPLES

First Principle:

Processed lawfully, fairly and in a transparent manner in relation to individuals;

Second Principle:

Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;

Third Principle:

Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

Fourth Principle:

Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

Fifth Principle:

Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals;

 Sixth Principle:

Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.