This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
What personal information do we collect?
Information on panel members will include:
- name and contact details
- addresses
- date of birth
Special category data may include:
- racial or ethnic origin
- health information
- identification documents
- biometric information (where used to identify someone)
- copies of passport or other photo identification
- account information
Why do we collect your personal information and what is our lawful basis for processing?
Engagement community panel
Purpose
North Yorkshire Views is North Yorkshire council’s engagement community, an online panel where members are invited to take part in surveys and occasionally other engagement activities such as polls, focus groups and user testing to give their feedback and opinions on a range of topics such as the council plan, satisfaction with services, volunteering and contacting the council.
Lawful basis
North Yorkshire Views is North Yorkshire council’s engagement community, an online panel where members are invited to take part in surveys and occasionally other engagement activities such as polls, focus groups and user testing to give their feedback and opinions on a range of topics such as the council plan, satisfaction with services, volunteering and contacting the council.
UK GDPR Article 6(1)(e) – We process personal information as part of our public task.
UK GDPR Article 9(2)(g) – the processing of your special category data is necessary for reasons of substantial public interest (with a basis in law), meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (6) Statutory and government purposes
The legislations, policies and guidance that relate to this service includes, but is not limited to:
Our best value duty within Section 3 of the local government act 1999 (as amended by s137 of the local government and public involvement in health act 2007).
Compliments and complaints service
Purpose
The Strategy and Performance service deal with any complaints and compliments submitted to the council.
Lawful basis
UK GDPR Article 6 (1) (c) - processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
No Recourse to Public Funds (NRPF) review.
The NRPF review is a case management and immigration status checking service.
UK GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest.
Processing is necessary for the exercise of specified powers and duties under UK law, substantial public interest condition under paragraph 6 of Schedule 1 of the DPA 2018 is also satisfied; data processing is necessary for statutory and government purposes.
Community awards
Purpose
The data is collected for the purpose of conferring an award. The information is necessary to assess nominations and to communicate directly with nominees and nominators.
Lawful basis
UK GDPR Article 6 (1)(a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
UK GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest.
UK GDPR Article 6(1) (f) Legitimate Interests - processing is necessary for the purposes of the legitimate interests pursued by the controller.
The legislation, policies and guidance that relates to these services include, but is not limited to:
- the council has statutory obligations in relation to the investigation of Children’s Social Care complaints under the Children Act 1989 Representations Procedure (England) Regulations 2006
- the council has statutory obligations in relation to the Local Authority Social Services and National Health Service Complaints (England) Regulations 2009
- the council has statutory obligations in relation to the NHS Bodies and Local Authorities (Partnership Arrangements, Care Trusts, Public Health and Local Healthwatch) Regulations 2012
- the Local Authority Social Services and National Health Service Complaints (England) Regulations 2009
- Immigration and Asylum Act (IAA) 1999
- Nationality, Immigration and Asylum Act (NIAA) 2002
- Children’s Act 1989
- Care Act 2014
- Allocation of Housing and Homelessness (Eligibility) (England) Regulations 2006
- Localism Act 2011
- Local Government Act 1972
- National Health Service Act 2002
Who do we share this information with?
Individual's information will not be shared with anyone other than those administrating the activities of the panel. We may share anonymised information with partner organisations such as police, fire and health authority.
Much of the information we process will be obtained directly from your complaint or from a complaint made by another individual. However, we may need to collect data about you from, but not necessarily limited to, the following organisations:
- our appointed data protection officer
- the Police and/or other law enforcement bodies
- local health and/or social care providers
- Local Government and Social Care Ombudsman
- Housing Ombudsman
- Parliamentary and Health Services Ombudsman
- Care Quality Commission
- Information Commissioner’s Office
- Home Office
- any other organisation and/or regulator when the council is legally required to disclose your information
How long do we keep your information for?
Engagement community panel
| Data held | Retention period |
|---|---|
| Survey information | No longer than 5 years |
| Membership information | As long as the individual remains a member |
Complaints and compliments
| Data held | Retention period |
|---|---|
| Standard complaint and compliments | 6 years upon closure |
| Non-standard complaint | Some complaint records must be kept for longer than six years under legislation, for example complaints about Looked After Children are retained for 70 years after file closure. |
No Recourse to Public Funds (NRPF) review
| Data held | Retention period |
|---|---|
| When a case is created on NRPF, individual data sets: | No longer than 10 years after a case is closed by the local authority |
Community awards
| Data held | Retention period |
|---|---|
| Nominees - name, address, phone number, email, full nomination forms, video and photographs | Three months after nomination closing date |
| Shortlisted nominees - name, address, phone number, email, full nomination forms, video and photographs and a short description of the reason for nomination | 6 months after nomination closing date |
| Finalists - personal details including contact information | 1 year after nomination closing date |
| Finalists - videos, photographs and reason for nomination | 2 years to promote the awards |
| Video footage, photographs and reason for nomination, contact details to inform about use of video or photograph for promotional purposes | 2 years for purposes of promoting the awards |
| Finalists - name of winner | 3 years to enable administrators to check future eligibility for awards |
| Bank account details are held for groups only, in line with the council’s financial policies and procedures. No details are held for individuals |
Other relevant transparency information
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.