This privacy notice is designed to help you understand how and why the resilience and emergencies team processes your personal data. This notice should be read in conjunction with our corporate privacy notice.
Who are we?
We are a ‘data controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR). The resilience and emergencies team consists of officers who deal with incident planning and response. Processing of data can be administered by any of the officers in the team.
We have appointed Veritau to be our data protection officer. Their contact details are:
Information Governance Office
Veritau
West Offices
Station Rise
York
North Yorkshire
YO1 6GA
Email: infogov@northyorks.gov.uk
Tel: 01904 552848
What personal information do we collect?
The resilience and emergencies team consists of twelve officers who deal with planning for, and our response to emergency incidents both in and out of normal office hours. To aid in providing this service, the following information is routinely processed:
- Health and Adult Services vulnerable people data - this personal data will contain information such as the individual’s name, address, age and what services they receive from the council which may include details about an individual’s mental or physical health
- emergency contact directory (ECD) - this is a database of individuals, from a range of organisations, who may need to be contacted in an emergency situation which includes their name, email address, work and personal telephone numbers
- North Yorkshire Council emergency or major incident WhatsApp group including personal and work phone numbers - this is to notify services of the current incident status only during response - the resilience and emergencies team post messages for this group
- ‘ready for anything’ volunteer database - this is a database of individuals, who have agreed to be contacted in an emergency situation and will include their name, address, email address and mobile phone number
- the major incident response team volunteer contact list - this is a database of individuals who have agreed to be contacted in an emergency situation - this will include their name, address, email address and mobile phone number
- community emergency plans - these are emergency plans written by communities and contain contact details for individuals within their community teams and include name, address and telephone number
- incident-specific information on behalf of the North Yorkshire Local Resilience Forum - this is unique information collected during an incident, for example, residents who have been flooded or major incident response team client information - this could include name, address and other pertinent data to assist with the emergency response and recovery
- North Yorkshire Local Resilience Forum survey forms - incident, e-learning and training and exercise surveys collect names and email addresses from officers across the North Yorkshire Local Resilience Forum
Why do we collect your personal information?
Vulnerable person data are collected for the specific purpose of assisting public safety by providing targeted support of known vulnerable people during an emergency incident.
The emergency contact directory is used for the specific purpose of providing an out of hours directory of emergency contact details for category one and two emergency responders - as defined by the Civil Contingencies Act 2004 - and partner agencies.
The North Yorkshire Council emergency or major incident WhatsApp group is used for the specific purpose of providing an out of hours text message alert for lead local authority officers as a category one emergency responder as defined by the Civil Contingencies Act 2004.
The ready for anything database is used for the specific purpose of maintaining a registered list of volunteers who are willing to be contacted to see if they are able to assist in an emergency situation.
The major incident response team database is used for the specific purpose of maintaining a registered list of volunteers who are willing to attend training, to be contacted to respond to dynamic incidents and are able to be called out to provide ongoing support in an emergency situation.
The community emergency plans are stored with the purpose of knowing a community's emergency response during an incident and for the resilience and emergencies team to be able to contact key individuals if needed.
Incident specific information is used to assist with the response and recovery stages of an emergency.
The North Yorkshire Local Resilience Forum surveys collect the data to assist in identifying lessons in good practice as part of the debrief and evaluation process.
Who do we obtain this information from?
Within the council, the resilience and emergencies team receive information from:
- Health and Adults Services (HAS)
We also receive information from the following external sources:
- partner agencies of the North Yorkshire Local Resilience Forum
- parish councils and other local community groups
- directly from members of the public affected by an incident
Who do we share this information with?
The data we use is stored on Resilience Direct - a secure online government site - and is shared under the Civil Contingencies Act 2004 with category one and two responders for the purposes of preparedness, response and recovery stages of an emergency.
In addition, we also share information with the following:
- vulnerable person data is also shared with the Health and Adult Services duty officer internally, or with the emergency services out of hours
- the emergency contact directory is shared solely for use within the resilience and emergencies team during emergency incidents
- the administration of the North Yorkshire Council emergency or major incident WhatsApp group is kept within the resilience and emergencies team
- the ready for anything data is shared by our administrators and with the emergency planning team in the City of York Council
- the major incident response team data is shared by the administrators within North Yorkshire Council, the resilience and emergencies team in North Yorkshire Council and with the volunteers themselves for the specific purpose of contacting each other at times of emergencies
- the community emergency plans are to be used for reference purposes within the resilience and emergencies team during emergency incidents - details may be shared with partner agencies within the local resilience forum during an incident response
- incident specific information is shared under the Civil Contingencies Act 2004 with category one and two responders for the purposes of response and recovery stages of an emergency
- The North Yorkshire Local Resilience Forum surveys are to be kept within the North Yorkshire Council resilience and emergencies team
How long do we keep your information for?
This table shows the retention periods for the data that we hold.
|
Data held |
Retention period |
|---|---|
|
Vulnerable person data |
This is refreshed each week with an updated file. Any information that is shared, for example, with the emergency services, must be deleted upon the closure of the incident, as directed by our established protocol. |
|
Emergency contact directory |
This is kept as a permanent resource, but is maintained by actively updating details on a quarterly basis. |
| North Yorkshire Council emergency or major incident WhatsApp group | This is kept as a permanent resource, but is maintained by actively updating details on a quarterly basis. |
|
Ready for anything volunteer data |
This is kept for as long as individuals wish to remain registered. |
| Major incident response team data | This is kept for as long as individuals wish to remain active in the team. |
|
Community emergency plans |
These are kept as a permanent resource, but are maintained by being updated with the latest version when received by a community. |
| Incident specific information |
This is retained until the incident is over and through the recovery period where residents need continued support. This may be days or weeks. Personally identifiable information will be removed once the response or recovery phase is over. Major incident response team client information is kept for as long as their support is required. Property information may be retained to assist with future flood response planning or similar. |
| North Yorkshire Local Resilience Forum survey data | This is routinely deleted quarterly. |
What is our lawful basis for processing your information?
North Yorkshire council relies on the following lawful basis to process your personal data:
UK GDPR Article 6 (1)(a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes i.e. being registered on the Ready for Anything database.
- UK GDPR Article 6 (1)(c) – processing is necessary in order to comply with a legal obligation to which the controller is subject
- UK GDPR Article 6 (1)(d) - processing is necessary in order to protect the vital interests of the data subject or of another natural person
- UK GDPR Article 6 (1)(e) - processing is necessary for the performance of a task carried out in the public interest
When processing special category data, we will rely on the following lawful basis:
- UK GDPR Article 9 (2)(c) - processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
UK GDPR Article 9 (2) (g) - processing is necessary for reasons of substantial public interest meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (16) Support for individuals with a particular disability or medical condition
- (18) Safeguarding of children and individuals at risk
The legislations, policies and guidance that relate to this service includes, but is not limited to:
- the Civil Contingencies Act 2004
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.