This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
What personal information do we collect?
In order to deliver these services to our residents, we need to collect both personal and special category data depending on the specific service being delivered.
Personal data may include:
- name and contact details
- addresses
- date of birth
- case details and case history
- financial information
- video and CCTV recordings of public areas
- family relationships
- call recordings
Special category data may include:
- racial or ethnic origin
- religious or philosophical beliefs
- health information (including dietary requirements, allergies and health conditions)
- sex life information
- sexual orientation information
Criminal conviction and offence history data may include:
- criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)
Why do we collect your personal information and what is our lawful basis for processing?
We need to collect this information in order to fulfil our obligations in regard to the provision of the following services:
Self-isolation payments
Purpose
When you applied for the self-isolation support payment, we were required to process your personal data to assess whether you were eligible to receive financial support and if so, to provide a payment to you.
We continue to process relevant information held in relation to the payment outlined above in accordance with legislative or regulatory obligations.
Lawful basis
UK GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
UK GDPR Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health meeting Schedule 1, Part 1 of the Data Protection Act 2018 as below:
- (2) health or social care purposes
Blue badges
Purpose
We collect your information for an application for a blue badge and for us to check your eligibility for the service using the guidelines provided by the department for transport. Once eligibility for the service is confirmed or denied any documents relating to a medical condition will be destroyed and not retained by us.
Lawful basis
UK GDPR Article 6 (1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
Customer portal – My Account
Purpose
We collect this information to create “my account”, validate “my account” and enable you to apply for services within “my account’’. This information will also be used to keep “my account” information current. From time to time, we will contact you to ensure that the information it holds in “my account” is accurate and up to date.
Lawful basis
UK GDPR Article 6 (1)(a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Customer services
Purpose
Customer services deal with the enquiries and complaints submitted to the council to enable the provision of services to residents. We ensure that residents receive council services to which they are entitled. We offer support via telephone, webchat, email (for now), Webforms, Voicebot, Chatbot, Social Media and face to face.
Calls may be recorded for the following purposes:
- monitoring and improving customer service quality
- staff training and development
- verifying information provided during calls
- investigating complaints or disputes
- providing evidence in the event of legal action
- callers will be informed at the beginning of each call that the conversation may be recorded
Lawful basis
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
UK GDPR Article 9(2)(g) – The processing of your special category data is necessary for reasons of substantial public interest (with a basis in law), meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (16) support for individuals with a particular disability or medical condition
Household support fund
Purpose
North Yorkshire Council has been allocated funding from the Department of Work and Pensions (DWP) to provide crisis support to vulnerable households in most need of support and to help with significantly rising living costs over the next six months.
We collect your data for the following purposes:
- to inform eligible households of the available funding
- to validate claims for the funding
- to allocate and distribute the funding
- to provide management information to DWP on how the funding was allocated and spent
Lawful basis
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest
The legislations and guidance that relate to this service includes, but is not limited to:
- DWP Household Support Fund (Phase 7) – Grant Determination and Scheme Guidance.
North Yorkshire Local Assistance Fund
Purpose
The North Yorkshire Local Assistance Fund (‘the fund’) supports vulnerable adults to move into or remain in the community and to help families under pressure to stay together.
Lawful basis
UK GDPR Article 6(1)(b) - processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
UK GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act (2018) as below:
- (6) Statutory and Government purposes
Benefits
Purpose
We will process the personal data outlined above, for the administration of the following statutory and discretionary benefits:
- housing benefit
- council tax reduction
- discretionary housing payments
- discretionary council tax support
- local welfare provision
- North Yorkshire Local Assistance Fund
- housing benefit overpayments
- to check your eligibility
- to assess the quality of our service via call recording and monitoring
- prevention and detection of fraud
- to facilitate the calculation and payment of benefit entitlements
Lawful basis
UK GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
UK GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act (2018) as below:
- (6) Statutory and Government purposes
- (16) Support for individuals with a particular disability or medical condition
Revenues
Purpose
North Yorkshire Council processes your personal information for the administration and enforcement of the collection of:
- Council Tax
- Business Rates (Non-Domestic Rates)
- Business Improvement District (BID)
- sundry debts
- administer government grants/schemes
- to assess the quality of our service via call recording and monitoring
- prevention and detection of fraud
Lawful basis
UK GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
UK GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act (2018) as below:
- (6) Statutory and Government purposes
- (16) Support for individuals with a particular disability or medical condition
Who do we share this information with?
In the course of delivering the above stated services, we may need share your information with a number of external agencies who are key to delivering our services. These include:
- central government departments, such as the Department of Health, the Department of Transport, the Home Office, the Department of Work and Pensions, environmental health department and His Majesty's Revenue and Customs (HMRC)
- other local authorities
- Cabinet Office national fraud initiative and the audit commission
- HM Courts and Tribunal Service
- Local Government and Social Care Ombudsman
- family fund business services and credit reference agencies
- electoral services and external auditors
- housing providers
- debt recovery team and your employer, if necessary for the recovery of benefit overpayments
- external litigation solicitors
How long do we keep your information for?
The following table details the retention periods for records relating to the specific services stated above:
Self-isolation payment
| Data held | Retention period |
|---|---|
| We will keep your personal data only for Covid‑19 response, audit and payment purposes. | Due to the UK Covid‑19 Public Inquiry, the council must retain this information until the inquiry concludes, after which it will be disposed of in line with retention requirements |
Blue badges
| Data held | Retention period |
|---|---|
| Documents to evidence any medical condition or temporary or permanent disability. | Duration of the application and eligibility check period (6-10 weeks) |
| Customer details | Data is kept while a Blue Badge is active and deleted 1 year after cancellation or expiry |
Customer portal – My Account
| Data held | Retention period |
|---|---|
| Current customer information | Data is kept while a customer account is active. If there are no active services and no activity for 1 year, you will be contacted to confirm whether the account and data should be deleted |
Customer services
| Data held | Retention period |
|---|---|
| Customer enquiries | 6 years |
| Call recordings – general enquiries | 3 months from date of call |
| Revenues and benefits calls | 12 months from date of call |
| Building visitor records | 6 months |
Household support fund
| Data held | Retention period |
|---|---|
| Customer details – eligibility assessment and payment of funds | For as long as is necessary to assess eligibility and distribute the funding (no later than 31 March 2027) |
North Yorkshire Local Assistance Fund
| Data held | Retention period |
|---|---|
| Customer details - eligibility assessment and payment of funds | Year record created plus 6 years |
Benefits
| Data held | Retention period |
|---|---|
| Housing benefit data | 6 years |
| Council tax support data | 6 years |
| Scanned ID documents | 6 years |
Revenues
| Data held | Retention period |
|---|---|
| Council tax support data | The council keeps information dating back to April 1993 so that when a property is re-banded, we can refund all entitled persons |
| Non-domestic rates data | Year record created plus 10 years |
| Business improvement districts (BIDs) | 7 years (unless bid is renewed) |
| Sundry debts | Year record created plus 6 year |
Other relevant transparency information
The legislation, policies and guidance that relates to these services include, but is not limited to:
- Universal Credit Regulations 2013
- The Welfare Reform Act 2012
- Local Government Finance Act 2012
- Localism Act 2011
- Business Rate Supplements Act 2009
- National Health Service Act 2006
- Housing Benefit Regulations 2006
- Theft Act 2006
- Local Government Act 2003
- Associated Health Service Regulations 2002
- Housing Benefit and Council Tax Benefit Regulations 2001
- Discretionary Financial Assistance Regulations 2001
- Disabled Persons (badges for motor vehicles) Regulations 2000
- Social Security Contributions and Benefit Act 1992
- Social Security Administration Act 1992
- The Council Tax Regulations 1992
- Department of Work and Pensions Household Support Fund – Grant Determination and Scheme Guidance
In cases of legal action or formal complaints, call recordings may be retained beyond the standard retention periods and used as evidence. Access to such recordings will be restricted and managed according to legal requirements and internal procedures. Other data that we may hold about you is only kept for as long as is necessary and all data is retained in line with our record retention and disposal schedule (RRDS).
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.