Resilience and emergencies privacy notice

This privacy notice is designed to help you understand how and why the resilience and emergencies team processes your personal data. This notice should be read in conjunction with our corporate privacy notice.

Who are we?

We are a ‘data controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR). The resilience and emergencies team consists of officers who deal with incident planning and response. Processing of data can be administered by any of the officers in the team.

We have appointed Veritau to be our data protection officer. Their contact details are:

Information Governance Office
Veritau
West Offices
Station Rise
York
North Yorkshire
YO1 6GA

Email: infogov@northyorks.gov.uk

Tel: 01904 552848

What personal information do we collect?

The resilience and emergencies team consists of nine officers who deal with planning for, and our response to emergency incidents both in and out of normal office hours. To aid in providing this service the following personal information, including special category information, is routinely processed:

• health and adult services vulnerable people data - this personal data will contain information such as the individual’s name, address, age and what services they receive from the council which may include details about an individual’s mental or physical health
• emergency contact directory (ECD) - this is a database of individuals, from a range of organisations, who may need to be contacted in an emergency situation which includes their name, email address, work and personal telephone numbers
• ‘ready for anything’ volunteer database - this is a database of individuals, who have agreed to be contacted in an emergency situation and will include their name, address, email address and mobile phone number.
• community emergency plans - these are emergency plans written by communities and contain contact details for individuals within their community teams and include name, address and telephone number

Why do we collect your personal information?

We collect the personal information detailed above to allow us to plan and respond to emergency incidents.

• vulnerable person data is collected for the specific purpose of assisting public safety by targeted support of known vulnerable people during an emergency incident
• the ECD is used for the specific purpose of providing an out of hours directory of emergency contact details for category 1 and 2 emergency responders (as defined by the civil contingencies act 2004) and partner agencies
• the ready for anything database is used for the specific purpose of maintaining a registered list of volunteers who are willing to be contacted to see if they are able to assist in an emergency situation
• the community emergency plans are stored with the purpose of knowing a community’s emergency response during an incident and for the resilience and emergencies team to be able to contact key individuals if needed

Who do we obtain your information from?

Within the council, the resilience and emergencies team receive information from:

• health and adults services (HAS)

We also receive information from the following external sources:

• partner agencies of the North Yorkshire local resilience forum
• parish councils and other local community groups

Who do we share this information with?

The data we use is stored on Resilience Direct (this is a secure online government site) and is shared under the civil contingencies act 2004 with category 1 and two responders for the purposes of preparedness, response and recovery stages of an emergency.

In addition, we also share information with the following:

• vulnerable person data is also shared with the health and adult services duty officer internally, or with the emergency services out of hours
• the ECD shared solely for use within the resilience and emergencies team during emergency incidents
• the ready for anything data is shared by our administrators and with the emergency planning teams in the City of York Council
• the community emergency plans are to be used for reference purposes within the resilience and emergencies team during emergency incidents - details may be shared with partner agencies within the local resilience forum during an incident response

How long do we keep your information for?

What is our lawful basis for processing your information?

North Yorkshire council relies on the following lawful basis to process your personal data:

UK GDPR Article 6 (1)(a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes i.e. being registered on the Ready for Anything database.

• UK GDPR Article 6 (1)(c) – processing is necessary in order to comply with a legal obligation to which the controller is subject
• UK GDPR Article 6 (1)(d) - processing is necessary in order to protect the vital interests of the data subject or of another natural person
• UK GDPR Article 6 (1)(e) - processing is necessary for the performance of a task carried out in the public interest

When processing special category data, we will rely on the following lawful basis:

• UK GDPR Article 9 (2)(c) - processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent

UK GDPR Article 9 (2) (g) - processing is necessary for reasons of substantial public interest meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:

• (16) Support for individuals with a particular disability or medical condition
• (18) Safeguarding of children and individuals at risk

The legislations, policies and guidance that relate to this service includes, but is not limited to:

• the civil contingencies act 2004