West Lancs logo

Privacy and data protection (GDPR)

West Lancashire Borough Council has a robust approach to data protection and we're proud of our track record.

On Friday 25 May 2018, the GDPR will come into force. The following pages are designed to help you understand this change in law and how it affects you:

1. What is the GDPR?

From 25 May 2018, the GDPR and a new UK Data Protection Act will bring enhanced requirements to how the Council handles your personal data. The GDPR is a new European law which replaces the current Data Protection Act and gives you more control over your data.

The Information Commissioner has provided a helpful guide to the General Data Protection Regulation.

1.1    What is personal data?

The new law will apply only to ‘personal data’, which is anything that can identify a living person, either directly or indirectly.

Special categories of personal data reveal racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, or is about sex life or sexual orientation or health, including genetic and biometric data. We will need to comply with more safeguards when processing these kinds of data.

1.2    How does GDPR affect me?

The rights that you have about how your personal data is handled and stored by the Council are being changed and enhanced.

The GDPR ensures that any personal data we hold must be:

 

  • Processed fairly, lawfully and in a transparent manner.
  • Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
  • Adequate, relevant and limited to what is necessary.
  • Accurate and, where necessary, kept up to date.
  • Kept in a form which permits identification of data subjects for no longer than is necessary for the purpose for which it is being processed.
  • Kept secure.

The GDPR also places obligations on the Council to demonstrate how we are complying – see 3. What is the Council doing about the GDPR? for more information on this

We are committed to ensuring that we comply with the GDPR and have carried out the following to demonstrate this commitment:

2. Data Protection Officer

Under the new law, the Council must have a Data Protection Officer who is responsible for assisting on data protection matters and available to contact by members of the public.

Our Data Protection Officer can be contacted at dpo@westlancs.gov.uk or on 01695 58 5161.

3. What is the Council doing about the GDPR?

We are committed to ensuring that we comply with the GDPR and have carried out the following to demonstrate this commitment:

Training

Staff training has been rolled out across the Council.

Data audit

An audit of all of the data the Council collects and holds has been carried out to ensure all the action needed to ensure compliance is noted and carried out.

Privacy notices

Detailed privacy notices will be issued each time we gather your data to inform you of how we will handle your data and your rights. These will be provided by the Section which collected your data and will link to our Corporate Privacy Notice (pdf 15kb).

Contract clauses

We are amending our contract clauses to meet the GDPR standards and will require all contractors and third parties to demonstrate that they meet the requirements for data handling too.

Policy review

We have a large suite of Data Protection policies which have been reviewed and amended to reflect the changes under the GDPR.

4. What are my rights?

You have the following rights under the GDPR:

 

Right to be informed

Right of access

Right to rectification

Right to erasure

Right to restriction

Right to portability

Right to object

Right to object to automated decision making

Right to withdraw consent

Right of complaint

Right to judicial remedy

Right to compensation

We will respond to your request to exercise any of your rights without undue delay and within one month of your request. If this is not possible due to the complexity or number of the request(s), we will let you know and may extend the timescale up to a total of three months in certain circumstances.

Right to be informed

You have the right to be informed about the collection and use of your personal data. We will do this by way of privacy notices on forms, letters, contracts, on our website or over the telephone.

However, this right will not apply if you already have this information or if it would be impossible or involve disproportionate effort to let you know or if the data collection is set in law or there is an issue of secrecy and measures are in place to safeguard your privacy.

For example

We will not provide a privacy notice when you simply update your contact details on your Council Tax account as you already have this information.

Detailed privacy notices will be issued each time we gather your data to inform you of how we will handle your data and your rights. These will be provided by the Section which collected your data and will link to our Corporate Privacy Notice pdf (15kb).

Right of access

You have the right to request access to and details of the information we hold about you.

You will need to provide proof of your identify, including a utilities bill or bank statement with your current address and something confirming your identity such as a driving licence or birth certificate so that we can ensure that the correct data is provided to you and that your data and the data of others is adequately protected.

We will usually have to provide a copy of this to you free of charge. However, we may be able to charge a reasonable fee if a request is manifestly unfounded or excessive and we can charge a fee if you request further copies of information we have already provided to you

We will also be able to refuse to act on your request where it is manifestly unfounded or excessive and may not be able to provide your data where it adversely affects the rights and freedoms of others.

For example

If other family members’ details are in your housing file, we would need to either obtain their permission to share this part of the file or redact that data

Other exemptions are yet to be defined under the GDPR and this page will be updated once the new Data Protection Act is passed

You can exercise your right of access by completing our Data Protection Request Form and sending it to us: Senior Admin and Elections Officer, West Lancashire Borough Council, 52 Derby Street, Ormskirk, Lancashire L39 2DF or emailing it to us: freedomofinformation@westlancs.gov.uk.

Right to rectification

If you feel that any data that we hold about you is inaccurate, you have the right to ask us to correct or complete it without undue delay

Rectification can be achieved by adding to the record or creating a supplementary record. Even if we decide that the information is correct, we will place a statement from you on the record with the data you believe to be correct or stating your dispute

However, if we need to make further checks or dispute that the data we hold is incorrect, we may restrict access to the data pending a decision.

You can exercise your right to rectification by completing our Rectification Request Form and sending it to us: Senior Admin and Elections Officer, West Lancashire Borough Council, 52 Derby Street, Ormskirk, Lancashire L39 2DF or emailing it to us: freedomofinformation@westlancs.gov.uk.

 

Right to erasure

You have a right to ask us to erase information we hold about you without undue delay.

 

However, this right will only apply where:

 

  • The processing of the personal data is no longer necessary for the purpose which we originally collected it for.
  • We are relying on your consent to process the data and you withdraw that consent.
  • If you successfully object to the data processing under the Right to Object.
  • If the data is being unlawfully processed, e.g. we have processed data for a purpose we were not entitled to.
  • If we are obliged to erase the data to comply with a legal obligation.
  • If the data was provided on line when you were a child and you or your parent(s) gave consent at the time. However we do not think that the council holds any data that falls in this category.

For example

Where we have a lawful reason to process your data and it is kept in accordance with our retention schedule then we will not be obliged to erase it.

Where you agreed to take part in a consultation or you signed up for a newsletter and withdraw your consent then we will be obliged to erase it.

Where we have disclosed your personal information to others, we will take all reasonable steps to inform them about your request for erasure.

The right to erasure will not apply where:

 

  • The data is required for information purposes.
  • We need the information to provide a service which we are obliged to provide by law, or we believe processing the data is necessary for a task in the public interest or in exercise of our official authority.
  • If records are required for archiving in the public interest or for scientific or historical interest.
  • If we require the data to establish, exercise or defend a legal claim.

For example

A task carried out in the public interest or in exercise of our official authority will include a wide range of the Council’s functions, including:

 

  • Assessing and collecting Council Tax and Business Rates
  • Processing anti-social behaviour complaints
  • Refuse collection
  • FOI requests

You can exercise your right to erasure by completing our Erasure Request Form and sending it to us: Senior Admin and Elections Officer, West Lancashire Borough Council, 52 Derby Street, Ormskirk, Lancashire L39 2DF or emailing it to us: freedomofinformation@westlancs.gov.uk.

Right to restriction

You can ask that the processing of your data is restricted where: 

  • You are contesting the accuracy of the data and we are seeking to verify it. The processing of your data is unlawful, but you want the record preserved.
  • You need the data to establish, exercise and/or defend a legal claim.
  • You have exercised your Right to Object and a decision is pending.

In these circumstances the Council may only process the data with your consent or to establish, exercise and/or defend a legal claim or to protect the rights of another person or important public interest

For example

You object to the Council processing leisure club attendance data for your children as you believe the records are inaccurate.

We may restrict access to the data while your objection is being considered and the data verified. However, an exception to this may be if the matter is being contested in court.

Where there is a request for restriction of processing in place, we must inform you before lifting that restriction.

You can exercise your right to restriction by completing our Restriction Request Form and sending it to us: Senior Admin and Elections Officer, West Lancashire Borough Council, 52 Derby Street, Ormskirk, Lancashire L39 2DF or emailing it to us: freedomofinformation@westlancs.gov.uk.

 

Right to portability

You have a right to be provided with a copy of your data in an accessible electronic format. This right applies if you gave us the data with your consent or if the data was provided as required for a contract between you and the Council and the processing is electronic.

At your request we can pass this data to another data controller. 

However, this right does not apply to data collected in any other circumstances.

For example

If you have used the rent balance on demand service you may ask to have a copy of your historical rent records transferred to a new landlord.

You can exercise your right to portability by completing our Portability Request Form and sending it to us: Senior Admin and Elections Officer, West Lancashire Borough Council, 52 Derby Street, Ormskirk, Lancashire L39 2DF or emailing it to us: freedomofinformation@westlancs.gov.uk.

Right to object

You have a right to object to us processing your personal data where the basis of the processing is based on the performance of a task in the public interest or in exercise of our official authority.

However, this right will not apply where the Council has demonstrated overriding grounds to continue processing or for the establishment, exercise and/or defence of a legal claim.

For example

You might seek to exercise your right to object to the Council processing data regarding your housing application but there may be a potential legal claim which the Council is seeking to establish.

You might seek to exercise your right to object to the Council processing data regarding your waste collection but the issue of public health might be demonstrated to be an overriding ground.

The right to object also applies to us processing your data for direct marketing and there are no exceptions to this right. You can exercise this right by clicking on the 'unsubscribe' or 'opt-out' link in the marketing emails we send you. To opt out of other forms of marketing (such as postal marketing), then please contact us using the contact details provided in the privacy notice you received when we first collected your data.

Finally, you can also object to your data being processed for research purposes unless the Council can establish that such research is in the public interest.

You can exercise your right to object by completing our Objection Form and sending it to us: Senior Admin and Elections Officer, West Lancashire Borough Council, 52 Derby Street, Ormskirk, Lancashire L39 2DF or emailing it to us: freedomofinformation@westlancs.gov.uk.

Right to object to automated decision making

Some decisions are made by machine calculation of data held and this right allows you to object to having decisions made by an automated process. The machine calculation of the data is known as profiling and could mean analysing and predicting your economic situation, your health, your location or movements, and your preferences or behaviour.

 

However, this right does not apply where the processing is necessary for a contract between you and the Council, the processing is authorised by law with necessary safeguards to your rights and freedoms or you have given your explicit consent to the profiling.

 

The Council does not currently undertake profiling that has a significant and/or legal impact on you but may at times use data held to identify populations impacted by policy and legislative changes.

 

You can exercise your right to object by completing our ADM Objection Form and sending it to us: Senior Admin and Elections Officer, West Lancashire Borough Council, 52 Derby Street, Ormskirk, Lancashire L39 2DF or emailing it to us: freedomofinformation@westlancs.gov.uk.

Right to withdraw consent

Where our processing is based purely on your consent, you have a right to withdraw your consent at any time.

You should contact the named Officer on the privacy notice you received when we initially collected your data in the first instance.

Right of complaint

You have the right to lodge a complaint about any aspect of how we are handling your data with the UK Information Commissioner’s Office, which can be contacted at www.ico.org.uk (external link)

However, we would strongly urge you to pursue your complaint through our internal complaints process in the first instance to allow us the chance to rectify and learn from any unlikely mistakes.

Right to judicial remedy

 

You have the right to seek a judicial remedy against the Information Commissioner if the Commissioner does not handle a complaint within three months.

You also have the right to seek a judicial remedy against the Council where you believe the data processing did not comply with the GDPR.

However, we would strongly urge you to pursue your complaint through our internal complaints process in the first instance to allow us the chance to rectify and learn from any unlikely mistakes.

In all cases, you should seek independent legal advice.

Right to compensation

You have a right to receive compensation from the Council if you have suffered material or non-material damage as a result of an infringement of the GDPR.

We recommend that you seek independent legal advice on any proposed claim.