This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
What personal information do we collect?
In order to deliver our service, we need to collect both personal and special category data depending on the specific service being delivered.
Personal data may include:
- names and contact details
- addresses
- date of birth
- case information and case details
- financial information
- photographs or video recordings
- education history for example, qualifications
- unique identifiers
Special category data may include:
- racial or ethnic origin
- religious or philosophical beliefs
- health Information
- sex life information
- sexual orientation information
Criminal conviction and offence history data may include:
- criminal offence data, including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks
- information relating to health and safety
Why do we collect your personal information and what is our lawful basis for processing?
We need to collect this information in order to fulfil our obligations in regard to the provision of the following services:
Service
Benefits assessment and charging
Purpose
The benefits assessments and charging (BAC) service is responsible for completing financial assessments, ensuring welfare benefits maximisation and facilitating charging for social care services. The team retains your information in order to ensure that social care clients are charged appropriately and also to facilitate payments to the providers of social care, according to the local authority guidelines encompassed in the Care Act 2014.
Lawful basis
UK GDPR Article 6 (1) (c) - processing is necessary for compliance with a legal obligation to which the controller is subject
UK GDPR Article 6 (1) (e) - processing is necessary for the performance of a task carried out in the public interest
UK GDPR Article 9 (2) - processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act (2018) as below:
- (6) Statutory and Government purposes
- (16) Support for individuals with a particular disability or medical condition
UK GDPR Article 9(2)(h) - processing is necessary for the purposes of the provision of health and social care
Service
Brokerage team
Purpose
The teams dealing with the sourcing of placements and packages of care for people with care and support needs on behalf of health collect and process data in order to facilitate this activity. They use this information to ensure that the care and support commissioned is appropriate and meets the needs of the person it is required for.
Lawful basis
UK GDPR Article 6(1)(c) - legal obligation: the processing is necessary to comply with the law
UK GDPR Article 9(2)(h) - provision of health and social care
Service
Court of protection and appointee team
Purpose
The court of protection and appointee team acts as a corporate deputy of the court of protection and / or an appointee of the department of work and pensions (DWP) to manage the property and financial affairs of individuals who do not have the mental capacity to do so themselves.
Lawful basis
UK GDPR Article 6(1)(c) - legal obligation: the processing is necessary to comply with the law
UK GDPR Article 9(2)(h) - processing is necessary for the purposes of the provision of health and social care
Service
Court of protection next of kin process
Purpose
We use heir hunters in order to establish whether a person in their care may have any family members so that they can be involved in the decisions related to that person.
Lawful basis
UK GDPR Article 6 (1) (e) – processing is necessary for the performance of a task carried out in the public interest
Service
Deprivation of liberties
Purpose
The deprivation of liberty safeguards (DoLS) / deprivation of liberty (in the community) (DoL) are a system of checks found in the Mental Capacity Act. They apply in registered care homes, hospitals, shared living and in a person’s own home. They are needed to make sure that someone aged 16 or over, who has a mental disorder and is not able to decide to stay in a care home or hospital, really needs to have their freedom taken away to keep them safe from harm.
Lawful basis
UK GDPR Article 6(1)(c) - legal obligation: the processing is necessary to comply with the law
UK GDPR Article 6 (1) (e) - processing is necessary for the performance of a task carried out in the public interest
UK GDPR Article 9(2)(h) - provision of health and social care
Service
Health and Adult Services care and support
Purpose
The Health and Adult Services care and support service provide high quality care and support services to adults and carers across the county, working closely with health and independent and voluntary sector partners to deliver our services.
Lawful basis
UK GDPR Article 6(1) (c) - processing is necessary for compliance with a legal obligation to which the controller is subject
UK GDPR Article 6(1) (e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
UK GDPR Article 9(2) (h) - processing is necessary for the provision of health or social care services, meeting Schedule 1, Part 1 of the Data Protection Act 2018 as below:
- (2) Health or social care purposes
UK GDPR Article 9 (2) - processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act (2018) as below:
- (6) Statutory and Government purposes
Service
Health and Adult Services provider services team
Purpose
We directly provide for adults living in North Yorkshire care and support through a number of different services. These services are offered in a number of different ways or settings but all with the aim of providing care and support where needed, promoting independence and ensuring adults have choice and control over their lives. The teams dealing with these services collect and process data in order to facilitate the care and support provision of adults receiving these services.
Lawful basis
UK GDPR Article 6(1)(c) - legal obligation: the processing is necessary to comply with the law
UK GDPR Article 6 (1) (e) - processing is necessary for the performance of a task carried out in the public interest
UK GDPR Article 9(2)(h) - provision of health and social care
Service
Mental health service
Purpose
The mental health team collects and processes data in order to facilitate the care and support of adults receiving these services.
Lawful basis
UK GDPR Article 6(1)(c) – legal obligation: the processing is necessary to comply with the law
UK GDPR Article 6 (1) (e) – processing is necessary for the performance of a task carried out in the public interest
UK GDPR Article 9(2)(h) – provision of health and social care
Service
North Yorkshire Safeguarding Adults Board
Purpose
The Care Act 2014 requires each local authority to establish a safeguarding adults board (SAB) for their area and specifies the organisations and individuals that should be represented on the safeguarding adults board. North Yorkshire safeguarding adults board is a partnership of local agencies which consists of senior representatives of all the key organisations that work together to safeguard and promote the welfare of adults at risk in North Yorkshire.
Lawful basis
UK GDPR Article 6(1)(c) - legal obligation: the processing is necessary to comply with the law
UK GDPR Article 6 (1) (e) - processing is necessary for the performance of a task carried out in the public interest
UK GDPR Article 9(2)(h) - provision of health and social care
UK GDPR Article 9(2)(c) - vital interests
Who do we share this information with?
In the course of delivering care and support, we may need share your information with a number of external agencies who are key to delivering our services. These include:
- other local authorities and central government agencies
- housing providers
- the Police
- the NHS or other healthcare providers
How long do we keep your information for?
Benefits assessment and charging
| Data held | Retention period |
|---|---|
| Data in relation to your overall financial position | Retain from year records created plus 6 years |
| Client records in relation to the care of adults | Retain from year records created plus 6 years |
Brokerage team
| Data held | Retention period |
|---|---|
| Records relating to the commissioning of health and social care services | Retain from year records created for 6 years |
Court of protection and appointee team
| Data held | Retention period |
|---|---|
| Data in relation to your property and financial affairs | 6 years from date recorded |
| Personal details | Up to 6 years after date of death |
Court of protection next of kin process
| Data held | Retention period |
|---|---|
| Next of kin information where a relationship is confirmed | 6 years from the date of death of the client |
| If a relationship is not confirmed | The personal information would be stored until the court order is obtained |
Deprivation of liberties
| Data held | Retention period |
|---|---|
| All records relating to the management of Mental health support | Retain from last contact with client for 20 years |
Health and Adult Services care and support
| Data held | Retention period |
|---|---|
| Records relating to the creation and management of the care needs assessment process | Retain from year records created plus 8 years |
| Client records relating to the provision of respite care for adults | Retain from year records created plus 8 years |
Health and Adult Services provider services team
| Data held | Retention period |
|---|---|
| Records relating to the creation and management of the care needs assessment process | Retain from year records created plus 6 years |
| Client records relating to the provision of respite care for adults | Retain from year records created plus 6 years |
Mental health service
| Data held | Retention period |
|---|---|
| All records relating to the management of Mental health support | Retain from last contact with client for 20 years |
North Yorkshire Safeguarding Adults Board
| Data held | Retention period |
|---|---|
| Safeguarding adults reviews | 15 years from the date of publication |
| Records relating to the constitution and management of the NYSAB | 4 years from creation |
Other relevant transparency information
The legislation, policies and guidance that relates to these services include, but is not limited to:
- Care Act 2014
- Mental Capacity Act 2005
- The Health and Social Care Act 2014
- Care Quality Registration Regulations 2009
- The Mental Health Act 1983
Other data that we may hold about you is only kept for as long as is necessary and all data is retained in line with our record retention and disposal schedule (RRDS).
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.