This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
What personal information do we collect?
In order to deliver the children and families service to our residents, we need to collect both personal and special category data depending on the specific service being delivered.
Personal data may include:
- names and contact details
- addresses
- date of birth
- service history
- financial information
- family and relationship details
- educational history (for example, qualifications)
- case history
- photographs or video recordings
Special category data may include:
- racial or ethnic origin
- religious or philosophical beliefs
- health information
- sex life information
- sexual orientation information
Criminal conviction and offence history data may include:
- criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)
- information relating to health and safety
Why do we collect your personal information and what is our lawful basis for processing?
Service
Fostering service
Purpose
The fostering service is responsible for processing data relating to foster carers and the children and young people they look after.
Lawful basis
UK GDPR Article 6 (1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 9(2)(h) – processing is necessary for the purposes of the provision of health and social care.
Service
Inspiration for change
Purpose
The aim of inspiration for change is to work intensely with parents who have had a child or children permanently removed from their care to reduce the chances of further pregnancies leading to future care proceedings.
Lawful basis
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
UK GDPR Article 9(2)(h) – processing is necessary for the purposes of the provision of health and social care.
Service
Leaving care services
Purpose
The leaving care service collect and process data in order to provide services and support to children and young people leaving care. We usually provide support up until the age of 21, or 25 if the young person is in education or training or if they request support.
Lawful basis
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
UK GDPR Article 9(2)(h) – processing is necessary for the purposes of the provision of health and social care.
Service
Looked after children and children in need
Purpose
The teams dealing with looked after children and children in need collect and process data in order to facilitate the direct care of children receiving these services.
Lawful basis
UK GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
Service
No Wrong Door
Purpose
Young people (as defined in the No Wrong Door (NWD) project submission to the Department of Education) in the care of North Yorkshire Council are at risk of being drawn into crime or criminal gangs, falling victim to sexual abuse or exploitation, or engaging in anti-social behaviour with, or encouraged by, other people. No wrong door aims to identify those people associating with young persons in the care of North Yorkshire Council who may pose or increase the likelihood one or more of the above risks (either directly or indirectly through other contacts) and to disrupt that association and provide alternative, lower-risk paths for the young person concerned.
Lawful basis
UK GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
UK GDPR Article 9(2)(h) – processing is necessary for the purposes of the provision of health and social care.
UK GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act (2018) as below:
- (6) Statutory and Government purposes
- (10) Preventing or detecting unlawful acts
- (18) Safeguarding of children and individuals at risk
Service
North Yorkshire Safeguarding Children’s Board
Purpose
The Children Act 2004 requires each local authority to establish a Local Safeguarding Children Board (LSCB) for their area and specifies the organisations and individuals that should be represented on the Local Safeguarding Children Board. North Yorkshire Safeguarding Children Board (NYSCB) is a partnership of local agencies which consists of senior representatives of all the key organisations that work together to safeguard and promote the welfare of children and young people in North Yorkshire.
Lawful basis
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest
UK GDPR Article 9(2)(c) – processing is necessary to protect the vital interests of the data subject
UK GDPR Article 9(2)(h) – processing is necessary for the purposes of the provision of health and social care.
Service
Short breaks (early help)
Purpose
The early help service working with children, young people and families need to collect and process data in order to facilitate the short breaks offer.
Short breaks are available to families to provide a break from caring for a disabled child and for the child to have a break from their carers.
To access these breaks families must:
- be open to North Yorkshire Early Help
- not already receiving a statutory short breaks service
- not accessed a Principle Trust holiday within the last three years
- have circumstances that mean a break could significantly benefit family wellbeing
Lawful basis
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
UK GDPR Article 9(2)(h) – processing is necessary for the purposes of the provision of health and social care.
Article 9(2)(g) - Substantial public interest
- (16) Support for individuals with a particular disability or medical condition
- (18) Safeguarding of children and individuals at risk
Service
Supporting Families programme
Purpose
The national Supporting Families programme is a government initiative which aims to ‘turn around’ the lives of an additional 400,000 vulnerable families across England. The programme supports families who have problems around crime, anti-social behaviour, school attendance and unemployment. The programme does this by working with families at an early stage through targeted intervention and prevention. We are committed to delivering the national Supporting Families programme in our area. In order to achieve this, we need to collect and process your personal data.
Lawful basis
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
Service
Trusted relationships
Purpose
The North Yorkshire and York ‘Trusted Relationships’ project is one of 11 initiatives to have been funded by the Home Office to improve support to young people at risk of exploitation and abuse. The North Yorkshire and York project centres on the implementation of a multi-agency collaborative approach to identification and support for children and young people who are primarily at risk of or subject to child criminal exploitation (including county lines, child sexual exploitation and modern slavery).
Lawful basis
UK GDPR Article 6 (1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
UK GDPR Article 9(2)(c) – processing is necessary to protect the vital interests of the data subject.
UK GDPR Article 9(2)(g) – The processing of your special category data is necessary for reasons of substantial public interest.
UK GDPR Article 9(2)(h) – processing is necessary for the purposes of the provision of health and social care.
The legislation, policies and guidance that relates to these services include, but is not limited to:
- Keeping Children Safe in Education Act 2018
- Children and Social Work Act 2017
- The Digital Economy Act 2017
- The Children’s Homes (England) Regulations 2015
- Children and Families Act 2014
- Care Act 2014
- The Education (information about individual pupils) (England) Regulations 2013
- Welfare Reform Act 2012
- Localism Act 2011
- Fostering Services Regulations 2011
- Care Planning, Placement and Case Review Regulations 2010
- Children and Young Persons Act 2008
- Children and Adoption Act 2006
- Children's Act 2004
- Education Act 2002
- Children’s Home Regulations 2001
- Crime and Disorder Act 1998
- Sufficiency – statutory guidance on securing sufficient accommodation for looked after children
Who do we share this information with?
In the course of delivering the Children and Families service, we may need share your information with a number of external agencies who are key to delivering our services. These include:
- healthcare providers including the NHS, NHS trusts, clinical commissioning groups (CCGs) and care providers – including family members
- housing authorities and providers including Foundation UK, Safe and Sound Homes, Barnados, Ryedale YMCA, Ripon YMCA, Richmond YMCA, Leeds Federation Housing and Broadacres
- local and central government agencies, such as the department for education, the department of work and pensions, Home Office, Office of National Statistics and the Ministry of Justice
- relevant regulatory authorities, such as Ofsted, Army Welfare and the Probation Service.
- support services including the fostering network, children and family court advisory and support service, employment agencies, independent domestic abuse services, care placement providers and the national society for the prevention of cruelty to children
- organisations we need to share information for safeguarding reasons, including North Yorkshire Police and the National Probation Service.
We will also share data appropriately with other agencies in the following circumstances:
- where there is a serious risk of harm to you or others
- where there are concerns for the welfare of an adult at risk
- where a court requires us to share information about you
How long do we keep your information for?
The information details the retention periods for records relating to the Children and Families services stated above:
Fostering service
| Data held | Retention period |
|---|---|
| Client records relating to the provision of foster care | 75 years from date of birth of the child |
| Records relating to the creation and management of providing foster care places | 6 years from when the process changes |
Inspiration for change
| Data held | Retention period |
|---|---|
| EHM file of involvement | 6 years after closure of episode |
Leaving care services
| Data held | Retention period |
|---|---|
| Records relating to a child leaving care | 75 years from date of birth of the child |
Looked after children and children in need
| Data held | Retention period |
|---|---|
| Records relating to a child in care | 75 years from date of birth of the child |
No Wrong Door
| Data held | Retention period |
|---|---|
| No Wrong Door case files | 40 years from date of birth |
| Child protection orders | 75 years from date of birth of the child |
North Yorkshire Safeguarding Children Board
| Data held | Retention period |
|---|---|
| Serious case reviews | 15 years from the date of publication of the serious case review |
| Child death reviews | 15 years from the date of publication of the child death review |
| Records relating to the constitution and management of the LSCB | 4 years from creation |
Short breaks (early help)
| Data held | Retention period |
|---|---|
| Records relating to short breaks applications | Current year plus 6 years |
Supporting Families programme
| Data held | Retention period |
|---|---|
| Research information | Data is retained in line with our record retention and destruction schedule (RRDS). Where information is shared with ministry of justice, department of work and pensions and department for education, these organisations will keep the information for no longer than 90 days |
Trusted Relationships
| Data held | Retention period |
|---|---|
| Project information will be included in your case file and retained in line with the file’s applicable retention period | We keep personal data only as long as necessary to deliver services and in accordance with our record retention and disposal schedule |
Other data that we may hold about you is only kept for as long as is necessary and all data is retained in line with our record retention and disposal schedule.
Other relevant transparency information
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.