This privacy notice is designed to help you understand how and why trading standards, processes your personal data. This notice should be read in conjunction with our corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘data controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR) for general processing and Section 32 of the Data Protection Act 2018 for law enforcement processing.
North Yorkshire council trading standards service (the service) is responsible for enforcing a wide range of trading standards, consumer protection and safety legislation across North Yorkshire. Our aims are to safeguard consumers, so that every adult has a longer, healthier and independent life and every child has the best possible start in life; and to support legitimate traders to ensure that North Yorkshire is a place with a strong economy and a commitment to sustainable growth.
The council has appointed Veritau to be its data protection officer. Their contact details are:
Information Governance Office
Veritau
West Offices
Station Rise
York
North Yorkshire
YO1 6GA
Email: infogov@northyorks.gov.uk
Tel: 01904 552848
What personal information do we collect?
Trading Standards may collect the following categories of personal information:
- name
- address
- phone number
- other contact details
- health and medical data, including disabilities
- information relating to employment history
- financial information , bank and building society accounts
- electronically held information such as held on devices such as computers, laptops, mobile phones and remote and off-site storage
- business names (trading names, company name), date of incorporation
- details of complainants, consumers, businesses, victims and witnesses
- criminal offences data (including alleged) and convictions
Depending on the service/action being undertaken, further information may be required.
We will only gather the minimum amount of data necessary for a legitimate purpose ensuring collection is proportionate to the circumstances.
Why do we collect your personal information?
NYC collects your personal data for the following purposes:
- to monitor and promote compliance with Trading Standards legislation in line with our Enforcement policy.
- for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties - provided we have a statutory function to enforce the legislation in question, this is a “law enforcement” purpose
- to fulfil the council’s reporting and safeguarding obligations under legislation such as the care act 2014 and the modern slavery act 2015.
- to register and licence activities where required by law, for example, explosives, petroleum, safety at sports grounds, animal feed hygiene.
- to provide services to the trade and public
- to check the effectiveness of our own activities and consult on priorities we should apply to achieving our public duties.
- for health and safety purposes.
- for staff administration and welfare.
Who do we obtain your information from?
In addition to information you provide North Yorkshire Council may also receive information from:
- consumers
- individuals
- witnesses and victims
- businesses
- internal and external partners and agencies
- enforcement agencies
Who do we share this information with?
NYC may be required to share information with organisations such as:
- internal NYC services
- external enforcement agencies such as HMRC, national crime agency, DWP, illegal money lending team, insolvency service, environment agency, licensing, action fraud, environmental health, legal department
- central government
- health authorities
- police services
- the criminal justice system and agencies involved in it, for example, probation services, HM courts service, witness liaison and victim support services
- with other partner agencies to reduce crime and disorder, anti-social behaviour and safeguarding of children and adults
- other local authorities
- other relevant partners such as regulatory bodies or public services
Sharing will only take place where legal gateways allow it and the sharing is necessary and proportionate. We will assess the impact of any disclosure and make decisions on a case by case basis unless formal information sharing protocols which permit otherwise are in place.
How long do we keep your information for?
|
Data held |
Retention period |
|---|---|
|
Consumer advice - all records relating to providing consumers with information and advice on minimum standards of buying and selling of goods and services |
3 years since from when record was created |
|
Fair trading - all records relating to the administration of fair trading schemes |
3 years since from when record was created |
|
Product safety - all records relating to advice and support given to businesses about product safety |
6 years from the date that the advice was given |
|
Retail trading standards - all records relating to the development and implementation of retail trading standards |
6 years from the date that the standard expires |
|
Trading standards advice to businesses - all records relating to trading standards advice given to businesses |
6 years from the date that the advice was given |
|
Under age sales - all records relating to the monitoring and enforcement of under age sales |
6 years from the date of enforcement action |
|
Weights and measurements - all records relating to the monitoring and enforcement of weights and measures |
6 years since from when record was created |
|
Child performance licences - all records relating to the allocation of child performance licences |
25 years from the date of birth of the child |
|
Illegal street trading - all records relating to the licensing and monitoring of street traders and street trading |
6 years from when the date that the licence expires or the date of the resolution of enforcement action |
What is our lawful basis for processing your information?
North Yorkshire council relies on the following lawful basis to process your personal data under the UK GDPR:
- UK GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject
- UK GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest
With regard to special category data, the council will rely on the following lawful basis
UK GDPR Article 9(2)(g) – The processing of your special category data is necessary for reasons of substantial public interest (with a basis in law), meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (6) Statutory and government purposes
- (10) Preventing or detecting unlawful acts
- (11) Protecting the public against dishonesty
- (12) Regulatory requirements relating to unlawful acts and dishonesty etc
- (18) Safeguarding of children and individuals at risk
Where information is for law enforcement purposes the council processes under the data protection act. The processing is specified, explicit and legitimate; meets section 35 of the data protection act and where information is sensitive it is processed under schedule 8:
- (1) Statutory etc purposes
- (4) Safeguarding of children and of individuals at risk.
Please see the trading standards enforcement policy for more information.
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.