Privacy Notice November 2018

As an elected Councillor within the borough of Oldham, I am the controller accountable for the processing of personal information in connection with the processing of requests received from ward constituents.

In accordance with the Data Protection Act 2018, this Privacy Notice provides information about how I process personal information for the purpose of responding to requests from constituents and provides information about the privacy rights of individuals.

What is the role of an elected representative?

As an elected Councillor, I regularly hold advice surgeries and respond to casework and policy queries raised with me by residents in my ward. In order to provide assistance and respond to these enquires, it is necessary to process personal data relating to the constituent making the request and other individuals who may be involved or identified during the course of my enquiries.

How is personal data processed when responding to requests from constituents?

When you ask for my help and assistance I will need to collect some information from you.

This will generally include personal information such as your name, address and contact information together with details of your problem or concern.

The law treats some types of personal information as ‘special’ because the information requires more protection due to its sensitivity. This information consists of:

• racial or ethnic origin
• sexuality and sexual life
• religious or philosophical beliefs
• trade union membership
• political opinions
• genetic and bio-metric data
• physical or mental health
• criminal convictions and offences

It will only be necessary to collect this type of information where it is of relevance to the request you are making.

Personal information about you will only be disclosed on a ‘need to know’ basis with a relevant organisation and/or individual who is able to provide information to help address or resolve your concern.

A relevant third party organisation and/or individual will be determined by the nature of the concern you have raised and therefore will vary from case to case.

However, by way of example these third parties include:

• local and/or central government
• elected representatives and other holders of public office
• landlords
• statutory law enforcement agencies and investigating bodies
• the media
• healthcare, social and welfare advisers or practitioners

Any third parties with whom I may share your data are obliged to keep your details securely, and to use your data for purposes already communicated to you.

The personal information you provide and I may receive from organisations or individuals in the course of my enquiries, will only be used to progress the problem or concern you have raised. Your personal data will not be used in a way that goes beyond your reasonable expectations.

If you specifically ask me not to disclose information identifying you to other third parties it is necessary for me to contact, I will try to respect that. However, please be aware that it may not be possible to progress a matter for you on an anonymous basis.

Unless I receive an objection, any unresolved requests from you at the point my elected period of office ends, will be transferred to another appropriate Councillor and/or council officer

How is personal data about other individuals processed in connection with requests from constituents?

In representing constituents, I will from time to time also process personal information relating to:

• employees working in the Council and/or other public sector, third sector or private sector organisations
• elected representatives and others in public office
• complainants and enquirers
• relatives, guardians and associates of the constituent I represent
• business or other contacts
• the subject of complaints

What is the legal basis for processing my personal data?

The legal bases relied on for processing personal information in relation to responding to requests from constituents is:

• consent or explicit consent of the constituent making the request (or any other relevant persons where this is appropriate)
• necessary in pursuit of my legitimate interests as an elected representative and those of my constituent and it is assessed these interests override any privacy intrusion involved in processing personal data about other individuals
• discharging functions as an elected representative for the purpose of responding to requests from constituents where this is permissible, without explicit consent, under one of the conditions specified in Schedule 1, Part 2, paragraph 23 of the Data Protection Act 2018

Is my personal data shared with anyone else?

Unless the law requires or permits the sharing of information e.g. crime prevention or detection or the safeguarding of vulnerable children or adults, no personal information obtained by me will be further disclosed other than for the purpose of progressing and responding to requests from constituents as outlined above.

Personal information may be stored on my behalf by the Council within their secure network or by myself directly using appropriate technological and physical controls to prevent unauthorised access and use. Other than technical and monitoring operations, access and processing is undertaken only in accordance with my instructions.

Is my personal data transferred beyond the EEA?

It may sometimes be necessary to transfer personal information overseas. Where this is needed and the information is only shared within the European Economic Area (EEA). Any transfers made will be in full compliance with all aspects of data protection legislation.

We will only send your data outside the European Economic Area (‘EEA’):

• with your consent, or
• to comply with a lawful and legitimate request, or
• if we use service providers or contractors in non EEA countries. If we do transfer your information beyond the EEA, we will make sure that it is protected in the same way as if it was being used in the EEA.

Does your processing involve automated decision making about me?

None of the personal information controlled by me involves automated decision making.

For how long will my personal data be kept?

Unless specifically requested by you, personal data held for the purposes of responding to requests received from constituents and obtained in the course of my enquiries, will only be kept for as long as the law specifies or where the law does not specify this, for a suitable length of time after the case/enquiry is closed.

Closed casework files will be for a minimum of 4 years, and if my period of elected office ends before resolving a constituent’s request, where the constituent has not expressed any objection, the case file will be transferred to another appropriate Councillor and/or council officer.

How is my personal data safeguarded?

Reasonable security measures are taken to ensure that personal information within my control is protected from accidental loss or alteration, inappropriate access, misuse or theft.

These measures may include, (not exhaustive), physical and technological controls, secure storage of information, records retention, restrictions of unauthorised access to information

What rights do I have?

The new data protection legislation strengthens the rights of individuals.

In general you have the following rights:

• Right of access – you have the right to request a copy of the information that I hold about you.

• Right of rectification – you have a right to correct data that I hold about you if it is inaccurate or incomplete.

• Right to be forgotten – in certain circumstances you can ask for the data I hold about you to be erased from my records.

• Right to restriction of processing – where certain conditions apply you have the right to ask me to restrict [quarantine] my processing of your data.

• Right of portability – in certain circumstances you have the right to have the data I hold about you transferred to another organisation.

• Right to object – you have the right to object to certain types of processing, such as direct marketing.

• Right to object to automated processing, including profiling – you have the right to ask for a decision made on wholly automated basis which legally affects you to be reviewed by a human being.

The Information Commissioner’s Office (ICO) is responsible for upholding these rights in the UK. For a detailed explanation of all these rights and, the circumstances in which they apply, please visit the ICO website below:

• Information Commissioners Office - website

If you wish to exercise any of your rights including where you are seeking a copy of your personal information,

please write or email me at the address given on the Council’s web page at:

• Committees - web page

Do I have the right to complain?

You have the right to complain to the information Commissioner if after contacting me about a data protection concern, you are not satisfied with my response.

If you wish to complain to the Information Commissioner the contact details are:

Information Commissioner's Office

Wycliffe House, Water Lane

Wilmslow

Cheshire

SK9 5AF

• Make a complaint - web page