This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
What personal information do we collect?
In order to deliver the children and families service to our residents, we need to collect both personal and special category data depending on the specific service being delivered.
Personal data may include:
- names and contact details
- addresses
- date of birth
- case history
- financial information
- family and relationship details
- educational history (for example, qualifications)
- photographs or video recordings
Special category data may include:
- racial or ethnic origin
- religious or philosophical beliefs
- health information
- sex life information
- sexual orientation information
- health and safety information
Criminal conviction and offence history data may include:
- criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)
Why do we collect your personal information and what is our lawful basis for processing?
We need to collect this information in order to fulfil our obligations in regard to the provision of the following services:
Inclusion service
Purpose
The inclusion service is responsible for carrying out duties under the Children and Families Act 2014 in relation to statutory assessment processes and the ongoing monitoring of children and young people who have an Education, Health and Care Plan.
Lawful basis
UK GDPR Article 6 (1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject;
UK GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act (2018) as below:
- (8) Equality of opportunity or treatment
SENDIASS
Purpose
The Special Educational Needs Disability Advice Support Service, offers free, confidential and impartial information, advice and support to parents and carers of children and young people aged 0 to 25 with special educational needs and/or disabilities (SEND) and to young people aged 16 to 25.
Lawful basis
UK GDPR Article 6 (1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject
UK GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest
UK GDPR Article 9(2)(c) - processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
UK GDPR Article 9(2)(h) - processing is necessary for the purposes of the provision of health and social care
The legislation, policies and guidance that relates to this service include, but is not limited to:
- Working Together to Safeguard Children 2015
- Children and Families Act 2014
- Special Educational Needs and Disability (SEND) code of practice: 0 to 25 years (2014)
- Children’s Act 2004
- Early Education and Childcare Statutory Guidance for Local Authorities
Who do we share this information with?
In the course of delivering the Inclusion service, we may need share your information with a number of external agencies who are key to delivering our services. These include:
- educational providers and professionals including educational establishments attended by your child or children
- healthcare providers including the NHS, NHS trusts and clinical commissioning groups (CCGs)
- local and central government agencies, such as the department for education
- support services including social care services, early years providers, Special educational needs and/or disabilities tribunal and mediation services, Information, advice and support services network and the council for disabled children services
- any other persons or organisations that parents, carers, or young person’s requests as part of the statutory process. Examples are sports coaches, physiotherapists, speech therapists, depending on the needs of the child
We will also share data appropriately with other agencies in the following circumstances:
- where there is a serious risk of harm to you or others
- where there are concerns for the welfare of an adult at risk
- where a court requires us to share information about you
How long do we keep your information for?
The following table details the retention periods for records relating to the Inclusion services stated above:
Inclusion service
| Data held | Retention period |
|---|---|
| Data relating to children with special needs (EHCP plans and/or other related information) | 25 years from the child’s date of birth |
SENDIASS
| Data held | Retention period |
|---|---|
| Personal data and special category data relating to the child or young person places. | 25 years from the child’s date of birth |
Other data that we may hold about you is only kept for as long as is necessary and all data is retained in line with our record retention and disposal schedule (RRDS).
Other relevant transparency information
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.