Integrated passenger transport, licensing, public rights of way and harbours privacy notice

This notice should be read in conjunction with our corporate privacy notice.

Who are we?

North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).

What personal information do we collect?

In order to deliver our service, we need to collect the following personal data:

names and contact details
addresses
date of birth
financial information
right to work information
audio and visual recordings

We may also collect certain categories of special category data:

racial and ethnic origin
religious or philosophical beliefs
health information
sex life information
sexual orientation information

Why do we collect your personal information and what is our lawful basis for processing?

We need to collect this information in order to fulfil our obligations in regard to the provision of the following services:

Service

Demand responsive

Purpose

The Integrated Passenger Transport team provides local bus services, including demand responsive bus services and the YorBus on-demand bus service and may do so using both internal and external transport providers, as part of its responsibilities under S63 of the Transport Act 1985.

Lawful basis

UK GDPR Article 6 (1) (e ) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

When processing personal data for marketing purposes, the council will rely on the following lawful basis:

UK GDPR Article 6 (1) (a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

When processing special category data, the council will rely on the following lawful basis:

UK GDPR Article 9 (2) (g) - processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:

(16) Support for individuals with a particular disability or medical condition

Service

Integrated passenger transport

Purpose

The integrated passenger transport (IPT) team facilitates the provision of home to school transport, health and adult transport, community transport and local bus services using both internal and external transport providers.

Lawful basis

The Education Act 1996 (as amended) sections 508B and 508C make provision for us to ensure that suitable travel arrangements are made, where necessary to facilitate a child attending school.

We process personal information as part of its public task and special category data is processed in line with substantial public interest. We use our legitimate interests to process data in relation to the maintenance of its fleet.

Service

Licensing

Purpose

North Yorkshire Council are responsible for administering and managing licenses and permits for establishments across the region. This includes the licensing of the following:

taxi and private hire vehicles, drivers and operators
licensed premises (alcohol) and individuals under the licensing act 2003
premises under the gambling act 2005
scrap metal providers
small lotteries
animal boarding
sex establishments
hypnotism
street trading
caravan parks
boatman licenses
tattoos, piercings and electrolysis
environmental permits
acupuncture
water sports

Environmental Health carry out inspections for some of the above licenses. For information pertaining to this, please also see their service specific privacy notice.

Lawful basis

UK GDPR Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject. When processing criminal conviction information (when undertaking DBS checks for Taxi/Private Hire drivers), processing meets Schedule 1 of the Data Protection Act 2018 as below:

(6) Statutory and Government purposes

UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest. When processing criminal conviction information (when undertaking DBS checks for licenses under the Licensing Act 2003, street traders and those holding licenses in relation to animals), processing meets Schedule 1 of the Data Protection Act 2018 as below:

(6) Statutory and Government purposes

When processing special category data, the council will rely on the following lawful basis:

UK GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest (with a basis in law), meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:

(6) Statutory and Government Purposes

Service

Harbours

Lawful basis

UK GDPR Article 6(1)(a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes

UK GDPR Article 6(1)(b) - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract

UK GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject

UK GDPR Article 6 (1)(f) - processing is necessary for the purposes of the legitimate interests pursued by the controller

When processing special category data, the council will rely on the following lawful basis:

UK GDPR Article 9 (2)(f) - processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity

UK GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest

Who do we obtain your information from?

In addition to information collected directly from you, we may receive information from the following external agencies:

Disclosure and Barring Service (DBS)
Driver and Vehicle Licensing Agency (DVLA)
The NHS (such as GPs)
National Anti-Fraud Network
The Police
Highways England
RSPCA
The Environment Agency

Who do we share this information with?

Information you provide may be shared with the following:

other local authorities
training providers
transport providers
schools
government departments and agencies, such as the Home Office, DBS, HMRC, DEFRA, the DVLA and the DWP
Crime prevention agencies, such as the Police or trading standards
the NHS or other healthcare providers
Highways England
RSPCA
National Anti-Fraud Network
MOGO
Marine Management Organisation
North Eastern Inshore Fisheries and Conservation Authority
Maritime and Coastguard Agency
Border Force

How long do we keep your information for?

Demand responsive

Data held	Retention period
Basic identifiers, contact details and personal details, including supporting documentation sent with your application	Data is retained for as long as the customer remains a user or prospective user of the service. Once this no longer applies, the data will be deleted within 1 year
Journey details	1 year
For customers booking via the customer service centre, we hold basic identifiers, contact details and personal details, including supporting documentation sent with your application and journey details	In line with existing customer service centre retention periods