Legal privacy notice

This privacy notice is designed to help you understand how and why North Yorkshire Council processes your personal data. This notice should be read in conjunction with our corporate privacy notice.

Who are we?

North Yorkshire Council is a ‘data controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR). We have a duty to provide legal advice to internal clients (and external clients where this is permitted, specifically wholly owned companies and the electoral registration officer and returning officer).  

The council has appointed Veritau to be its data protection officer. Their contact details are:

Information Governance Office


West Offices

Station Rise


North Yorkshire



Tel: 01904 552848

What personal information do we collect?

Legal services does not routinely collect data, due to the nature of the services we provide, it is most probable that your data will have been acquired by one of our other service departments, for example, if we are advising on a planning matter then your data may be passed over from our planning department if we are advising on a highway matter then your data may be passed over from our highways department.

We will routinely receive personal information from our service departments, that legal services support and advise, which may include but not be limited to the following personal data:

  • name and contact details
  • family details
  • lifestyle and social circumstances
  • goods and services
  • financial details
  • employment and education details
  • visual images, personal appearance and behaviour
  • business activities
  • case file information

We also collect the following special category data:

  • physical or mental health details
  • racial or ethnic origin
  • offences (including alleged offences)
  • criminal proceedings, outcomes and sentences
  • religious or other beliefs of a similar nature

On occasion, we may be the first point of contact that you have, in these circumstances we may collect some or all of the information listed below. We will ensure that we only collect the information required for us to deal with the matter.

  • current and former name, telephone number, e-mail address, address
  • medical information, banking details, criminal record
  • copies of identity documents, national insurance number
  • account information, transaction history, complaints

There are limited circumstances where you must provide us with information; where there is a legal obligation to provide this information, we will advise you of this along with the consequences of failing to provide this.

In all other circumstances the information we obtain is necessary for the matter that we are dealing with, if you fail to provide the information that is required then we may not be able to provide a service/complete legal transactions with you, or it may take longer to perform that service or may lead to you failing to receive important legal documents and relevant correspondence.

Why do we collect your personal information?

We are collecting your personal data for the purposes of dealing with legal proceedings and transactions in accordance with our statutory duties and/or the establishment, exercise or defence of legal claims. This includes but is not limited to:

  • monitor regulation of investigatory powers (RIPA) authorisations
  • manage legal cases
  • provide legal advice to council services
  • prepare any materials for litigation
  • run the council’s petitions scheme, process community governance review
  • process complaints received
  • ensure the council complies with its statutory duties
  • to respond to requests for advice or prepare legal documentation

Who do we obtain your information from?

We may also obtain personal information from other sources as follows:

  • personal information from public sources such as the electoral roll, social media, public directories etc
  • other government agencies or departments relevant to the matter that we are advising on
  • your personal information will be treated as confidential but it may be shared with our other services in order to ensure our records are accurate and up-to-date, and to improve the standard of the services we deliver
  • we will only use your information in ways that are permitted by the UK General Data Protection Regulation (UK GDPR) and the data protection act 2018 (DPA)

Who do we share this information with?

In order to deliver services, it may be necessary for us to share your personal data with, but necessarily limited to, the following organisations/partners:

  • the courts and those involved in legal proceedings and non-contentious matters including external solicitors and barristers, expert witnesses, the office of the official solicitor and public guardian, the police and other crime enforcement agencies, CAFCASS
  • other local authorities, parish councils and commons associations
  • highways England
  • tribunals
  • coroner’s inquests
  • inquiries
  • government agencies and departments e.g. HMRC, DWP, Immigration where necessary
  • the land registry
  • the national health service and clinical commissioning groups
  • members of the public by way of statutory notice or property related order (e.g. compulsory purchase order)
  • trade unions
  • solicitors, barristers and other professionals who may be acting on our behalf
  • third party organisations such as care agencies, care home providers and other professional carers
  • deputies appointed by the court of protection and attorneys appointed under lasting powers of attorney
  • debt collectors
  • elected members and MPs (as your representative)
  • contractors providing IT or advice services
  • national regulators e.g. information commissioner’s office, investigatory powers commissioner
  • schools
  • consultees – statutory or others

We will not disclose your personal information to third parties for marketing purposes.

How long do we keep your information for?

We will retain your personal data for as long as is necessary it is required by us or other regulatory bodies in order to comply with legal and regulatory requirements or for other operational reasons and in line with our organisation’s document retention policy.

What is our lawful basis for processing your information?

North Yorkshire Council relies on the following lawful basis to process your personal data:

UK GDPR Article 6 (1)(c) processing is necessary for compliance with a legal obligation to which the controller is subject. For the processing of personal data relating to criminal convictions and offences, processing meets Schedule 1, Part 2 of the Data Protection Act 2018 as below:

  • (6) Statutory and government purposes

When processing special category data, the Council will rely on the following lawful basis:

  • UK GDPR Article 9 (2)(f) - processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity

The legislations, policies and guidance that relate to this service includes, but is not limited to:

  • the regulation of investigatory powers act 2000,
  • the equality act 2010; and
  • the following areas of law / common law:
  • adult social care
  • childcare
  • employment
  • education
  • litigation
  • commercial
  • property
  • planning
  • highways
  • environmental
  • local government
  • coronial
  • judicial review
  • information law

For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.