This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
What personal information do we collect?
In order to deliver the prevention service to our residents, we need to collect both personal and special category data depending on the specific service being delivered.
Personal data may include:
- names and contact details
- addresses
- date of birth
- case information and case details
- financial Information
- photographs or video recordings
- education history for example, qualifications
- unique identifiers
Special category data may include:
- racial or ethnic origin
- religious or philosophical beliefs
- health information
- sex life information
- sexual orientation information
Criminal conviction and offence history data may include:
- criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks)
- information relating to health and safety
Why do we collect your personal information and what is our lawful basis for processing?
We need to collect this information in order to fulfil our obligations in regard to the provision of the following services:
Service
Research team
Purpose
The council’s HAS research team works with external research partners, such as Universities, to approve and facilitate social care research.
The external research partners conduct research that has been identified as having a clear public interest, such as by identifying how council services could most effectively meet people’s needs.
Lawful basis
UK GDPR Article 6(1)(e) – Processing is necessary for the performance of a task carried out in the public interest.
UK GDPR Article 9(2)(j) – Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes.
Service
Participation and engagement team
Purpose
Processes personal data in order to support the directorate and council and at times other statutory partners, to carry out engagement and consultation activity. The team also directly supports a number of community engagement forums and regularly liaises with a wide range of community groups.
Lawful basis
UK GDPR Article 6(1)(c) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 9(2)(h) – Processing is necessary for the purposes of the provision of health and social care.
Service
Quality and monitoring team
Purpose
The teams dealing with brokerage, contracting, quality assurance, contract compliance and quality improvement collect and process data in order to facilitate this activity.
Lawful basis
UK GDPR Article 6(1)(c) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
UK GDPR Article 9(2)(h) – Processing is necessary for the purposes of the provision of health and social care.
Who do we share this information with?
In the course of delivering the prevention service, we may need share your information with a number of external agencies who are key to delivering our services. These include:
- other local authorities and central government agencies
- housing providers
- Police
- NHS or other healthcare providers
- research institutes and education providers
How long do we keep your information for?
The following tables details the retention periods for records relating to the prevention and service development services stated above:
Research team
| Data held | Retention period |
|---|---|
| Research outputs (such as articles, reports or presentations) will use anonymised data and will not include any personal information | Data use and storage details may vary by study and institution and will be explained in the participant information sheet, which should be read before taking part |
Participation and engagement team
| Data held | Retention period |
|---|---|
| Name and contact details | Year record created plus 6 years |
| Banking information | Year record created plus 6 years |
| Notes and information from engagement and consultation activities | Year record created plus 6 years |
| Meeting minutes | Year record created plus 6 years |
| Reports on engagement and consultation activities | Year record created plus 6 years |
| Information collected for risk assessments and safeguarding | Year record created plus 6 years |
Other relevant transparency information
The legislation, policies and guidance that relates to these services include, but is not limited to:
- The Care Act 2014
- The Health and Social Care Act 2014
- Equality Act 2010
Other data that we may hold about you is only kept for as long as is necessary and all data is retained in line with our record retention and disposal schedule (RRDS).
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.