This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
What personal information do we collect?
In order to deliver our service to our residents, we need to collect both personal and special category data depending on the specific service being delivered. The resilience and emergencies team consists of 12 officers who deal with planning for and our response to emergency incidents both in and out of normal office hours. To aid in providing this service, the following information is routinely processed:
- names and contact details
- case information or case history
- health information
- sex life or sexual orientation
- date of birth
- identification documents
- education and professional qualifications
- family and relationship information
Why do we collect your personal information and what is our lawful basis for processing?
We need to collect this information in order to fulfil our obligations in regard to the provision of the following services:
Service
Resilience and emergencies
Purpose
The resilience and emergencies team consists of officers who deal with incident planning and response. Processing of data can be administered by any of the officers in the team.
Lawful basis
UK GDPR Article 6 (1)(a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes for instance, being registered on the Ready for Anything database.
UK GDPR Article 6 (1)(c) – processing is necessary in order to comply with a legal obligation to which the controller is subject
UK GDPR Article 6 (1)(d) - processing is necessary in order to protect the vital interests of the data subject or of another natural person
UK GDPR Article 6 (1)(e) - processing is necessary for the performance of a task carried out in the public interest
When processing special category data, we will rely on the following lawful basis:
UK GDPR Article 9 (2)(c) - processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
UK GDPR Article 9 (2) (g) - processing is necessary for reasons of substantial public interest meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (16) Support for individuals with a particular disability or medical condition
- (18) Safeguarding of children and individuals at risk
Who do we obtain your information from?
Within the council, the resilience and emergencies team receive information from:
- Health and Adults Services (HAS)
- emergency contact directory
- North Yorkshire Council emergency or major incident WhatsApp group
- ‘Ready for anything’ volunteer database
- the major incident response team volunteer contact list
- community emergency plans
- North Yorkshire Local Resilience Forum survey forms
We also receive information from the following external sources:
- partner agencies of the North Yorkshire Local Resilience Forum
- parish councils and other local community groups
- directly from members of the public affected by an incident
Who do we share this information with?
The data we use is stored on resilience direct, a secure online government site and is shared under the Civil Contingencies Act 2004 with category one and two responders for the purposes of preparedness, response and recovery stages of an emergency.
In addition, we also share information with the following:
- other local authorities
- Police
- NHS or other Healthcare Providers
- North Yorkshire Emergency WhatsApp group
How long do we keep your information for?
Resilience and emergencies
| Data held | Retention period |
|---|---|
| Vulnerable person data | Updated weekly with a new file. Any shared information (for example, with emergency services) must be deleted after incident closure, per protocol. |
| Emergency contact directory | Kept as a permanent resource and updated quarterly. |
| North Yorkshire Council emergency or major incident WhatsApp group | Kept as a permanent resource and updated quarterly. |
| Ready for anything volunteer data | Retained while individuals remain registered. |
| Major incident response team data | Retained while individuals stay active in the team. |
| Community emergency plans | Kept as a permanent resource and updated with the latest version when received by a community. |
| Incident specific information | Retained during the incident and recovery period (days or weeks). Personally identifiable information is removed once response / recovery ends. |
| North Yorkshire Local Resilience Forum survey data | Major incident response client information is kept while support is required. Property information may be retained for future flood response planning or similar purposes. Routinely deleted every quarter. |
Other relevant transparency information
The legislations, policies and guidance that relate to this service includes, but is not limited to:
- The Civil Contingencies Act 2004
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.