General information
As an elected County Councillor, I sometimes need to collect and use personal information so that I can respond to your enquiries and provide assistance.
In most cases, I act as an independent data controller when handling your personal data. This means I am responsible for how your information is used in connection with your enquiry.
Where I act on behalf of Suffolk County Council, the council may also be a data controller.
The processing of personal data is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), as amended by the Data (Use and Access) Act 2025 (DUAA), collectively referred to as data protection law.
This privacy notice explains how I use information about you when you contact me, and how I protect your privacy.
What is personal data?
Personal data includes information about you, which can be used to identify you as an individual. Examples include:
- your name
- your date of birth
- your contact details
- your image
Special category data is the most sensitive type of personal data and is protected by stronger safeguards. It includes:
- information about your health or any social care services that you may use
- information that could identify your racial or ethnic origins
- information that could identify your political beliefs
- information that could identify your religious or philosophical beliefs
- information that could identify your trade union membership
- genetic data
- biometric data (where used to identify you, e.g. use of fingerprints to access online services)
- information about your sex life, or sexual orientation
The types of personal data that I collect and where it comes from
When you contact me, either in person at surgeries or in the community, or by telephone, email, or letter, I will usually collect the following personal data from you:
- Name
- Contact details, including email address and telephone number
- Your date of birth
- Any other personal and special category information that you provide that is relevant to your query.
I may also receive personal data about you from other organisations including complainants, family members, or public bodies if it is necessary for me to resolve your enquiry.
I will only collect personal data that is necessary to provide you with relevant information, services, or support.
Why do I process your personal data?
My reasons for collecting personal data from you include:
- processing requests for assistance or responding to your enquiries
- investigating complaints
- complying with laws that require us to provide personal information to other organisations, such as health organisations and courts
Our legal basis for processing your information
Under data protection law, I can only process your personal data if it is lawful to do so. Please see details below of the lawful bases that I rely on for processing different types of personal data.
Personal data
For processing personal data, I rely on the following lawful basis(es):
- UK GDPR Article 6(1)(a) – where you have provided consent for me to process your information for a specific purpose – this is used exceptionally
- UK GDPR Article 6(1)(e) – where processing is necessary for me to perform a task which is in the public interest, or for my official functions as an elected representative, where that task has a clear basis in law (public task)
- UK GDPR Article 6(1)(ea) - where processing is necessary to meet a recognised legitimate interest
- UK GDPR Article 6(1)(f) – where processing is necessary to meet my legitimate interests which are not part of my public function
Special category data
When I process special category data, I rely on the following additional lawful bases:
- UK GDPR Article 9(2)(a) – where you have provided me with explicit consent to process your information for a specific purpose
- UK GDPR Article 9(2)(g) – where processing is necessary for reasons of substantial public interest, specifically:
- for statutory and government purposes (Schedule 1, Part 2, section 6, DPA 2018)
- for the safeguarding of children and of individuals at risk (Schedule 1, Part 2, section 18, DPA 2018)
- where processing is necessary for purposes relating to political activities, including casework (Schedule 1, Part 2, section 22, DPA 2018)
- where processing is necessary for an elected representative to respond to a request (Schedule 1, Part 2, section 23, DPA 2018)
Criminal offence data - general processing
I may also process criminal offence data if it is necessary for you to provide it so that I can assist you with your query. This may include:
- Information about any criminal record or criminal history
- Allegations of criminal behaviour, including unproven allegations
- Absences of convictions, for example the results of DBS checks, or Police National Computer checks
- Personal data of victims and/or witnesses
- Personal data about criminal penalties that may have been awarded
In addition to the lawful bases that I have identified under “Personal data” above, I process criminal offence data under the following condition(s) of Schedule 1 of the DPA 2018:
- where processing is necessary to carry out specific statutory and government purposes (Schedule 1, Part 2, section 6, DPA 2018)
- where processing is necessary for the safeguarding of children and individuals at risk (Schedule 1, Part 1, section 18, DPA 2018)
- where processing is necessary for purposes relating to political activities, including casework (Schedule 1, Part 2, section 22, DPA 2018)
- where processing is necessary for an elected representative to respond to a request (Schedule 1, Part 2, section 23, DPA 2018)
Legitimate interests
Sometimes, I rely on legitimate interests, either general or a recognised interest, as a lawful basis for processing your personal data.
These interests may include:
- responding to constituents outside of my formal council remit
- following up on enquiries
- undertaking community engagement
The general legitimate interest basis under Article 6(1)(f) allows me to process personal data in ways that you would reasonably expect and that have a minimal impact on you, or where there is a justified reason for processing your data.
The recognised legitimate interest basis under Article 6(1)(ea) allows me to disclose personal data to a public authority, for example Suffolk County Council, or to health organisations, where they need it in order to carry out their public functions.
Recognised legitimate interests apply only in limited circumstances defined in law.
I only rely on legitimate interests when processing personal data is necessary to achieve that interest.
Right to withdraw consent
In most cases, I rely on ‘public task’ to collect and use your personal data, however in some limited circumstances, I may rely on your consent.
Where I rely on consent to process your personal and special category data, you have the right to withdraw your consent at any time.
If you would like to withdraw consent for me to process your personal data, please contact me to let me know.
Sharing your information
I may need to pass on your personal details and the circumstances of your query/complaint to third parties so that they can look into the matters you have raised. These third parties may include:
- Suffolk County Council
- other local authorities
- government agencies
- public bodies
- health trusts
- regulators
Apart from the above, I will not pass your personal details on to anyone else unless I am required to do so in particular circumstances. These circumstances may include:
- court proceedings
- for the detection and/or prevention of crime or fraud
- to protect a child or a vulnerable adult who may be at risk
