Councillor's privacy notice

Personal data includes information about you, which can be used to identify you as an individual. Examples include:

• Your name
• Your date of birth
• Your contact details
• Your image.

Special category data is the most sensitive type of personal data and includes:

• Information about your health or any social care services that you may use
• Information that could identify your racial or ethnic origins
• Information that could identify your political beliefs
• Information that could identify your religious or philosophical beliefs
• Information that could identify your trade union membership
• Genetic data
• Biometric data (where used to identify you, e.g. use of fingerprints to access online services)
• Information about your sex life, or sexual orientation.

When you contact me, either in person at surgeries or in the community, or by telephone, email or letter, I will usually collect the following personal data from you:

• Name
• Contact details including email address and telephone number
• Your date of birth
• Any other personal and special category information that you provide that is relevant to your query.

I may also receive personal data about you from other organisations if it is necessary in order for me to resolve your enquiry.

I need to collect personal data from you so that I can process requests for assistance or respond to your enquiries. I will only collect the minimum amount of personal data needed to provide you with relevant information, services, or support.

Personal data

Under data protection law, I can only process your personal data if it is lawful to do so. Please see details below of the lawful bases that I rely on for processing different types of personal data.

For processing personal data, I rely on the following lawful basis(es):

• UK GDPR Article 6(1)(a) – where you have provided consent for me to process your information for a specific purpose
• UK GDPR Article 6(1)(e) – where processing is necessary for me to perform a task which is in the public interest, or for my official functions as an elected representative, where that task has a clear basis in law (public task)
• UK GDPR Article 6(1)(f) – where processing is necessary to meet my legitimate interests which are not part of my public function.

Special category data

When I process special category data, I rely on the following additional lawful basis(es):

• UK GDPR Article 9(2)(a) – where you have provided me with explicit consent to process your information for a specific purpose
• UK GDPR Article 9(2)(g) – where processing is necessary for reasons of substantial public interest, specifically:

1. for statutory and government purposes (Schedule 1, Part 2, section 6, DPA 2018)
2. for the safeguarding of children and of individuals at risk (Schedule 1, Part 2, section 18, DPA 2018)

• where processing is necessary for purposes relating to political activities, including case-work (Schedule 1, Part 2, section 22, DPA 2018)
• where processing is necessary for an elected representative to respond to a request (Schedule 1, Part 2, section 23, DPA 2018).

Criminal offence data – general processing

I may also process criminal offence data if it is necessary for you to provide it so that I can assist you with your query. This may include:

• Information about any criminal record or criminal history
• Allegations of criminal behaviour, including unproven allegations
• Absences of convictions, for example the results of DBS checks, or Police National Computer checks
• Personal data of victims and/or witnesses
• Personal data about criminal penalties that may have been awarded.

In addition to the lawful bases that I have identified under “Personal data” above, I process criminal offence data under the following condition(s) of Schedule 1 of the DPA 2018:

• where processing is necessary to carry out specific statutory and government purposes (Schedule 1, Part 2, section 6, DPA 2018)
• where processing is necessary for the safeguarding of children and individuals at risk (Schedule 1, Part 1, section 18, DPA 2018)
• where processing is necessary for purposes relating to political activities, including case-work (Schedule 1, Part 2, section 22, DPA 2018)
• where processing is necessary for an elected representative to respond to a request (Schedule 1, Part 2, section 23, DPA 2018).

Sometimes, I rely on legitimate interests (either yours, or mine as a councillor) as a lawful basis for processing your personal data. The legitimate interest basis under the UK GDPR allows councillors to process personal data in ways that you would reasonably expect and that have a minimal impact on you, or where there is a justified reason for processing your data.

I only rely on legitimate interests when processing personal data is necessary to achieve that interest, and where it does not override your rights.

Where I rely on consent to process your personal and special category data, you have the right to withdraw your consent at any time.

If you would like to withdraw consent for me to process your personal data, please contact me to let me know.

I may need to pass on your personal details and the circumstances of your query/complaint to third parties so that they can look into the matters you have raised. These third parties may include:

• Suffolk County Council
• Other local authorities
• Government agencies
• Public bodies
• Health trusts
• Regulators.

Apart from the above, I will not pass your personal details on to anyone else unless I am required to do so in particular circumstances. These circumstances may include:

• Court proceedings
• Detection and/or prevention of crime or fraud
• To protect a child or a vulnerable adult who may be at risk.

Please note: if you specifically ask me not to disclose information identifying you to other third parties, it may not be possible for me to progress your requests or queries on an anonymous basis.

I do not transfer any personal data to any countries or international organisations outside of the EU or the EEA (European Economic Area), or to any other country that does not have an equivalent level of data protection to the UK.

I will only keep your personal data for as long as I need it to fulfil my obligations, and to comply with any legal requirements for keeping certain types of data.

When your data is no longer required, I will destroy it securely.

I will not use automated decision-making processes and/or profiling in respect of your information.

Under data protection law, you have several rights in relation to your personal data. These are:

• Access to records - you can ask for copies of information I hold about you.
• Correction of inaccurate information - if you think information that I hold about you is inaccurate or incomplete, you can ask for this to be corrected.
• Portability - you can ask me to provide any electronic data I may hold about you in a format that allows you to transfer it to another organisation.
• Right to be forgotten - you can ask for your personal information to be deleted or removed in some circumstances.
• The right to object to processing - you can ask me to stop processing your information for certain purposes, such as direct marketing.
• The right to restrict processing - you can ask me to restrict the processing of your data.
• Automated decision making and profiling - you are entitled to protection against damaging decisions being made about you due to automated processes based on digital or other information I hold, and without human intervention, except for some situations where this is authorised by law.

If you would like to exercise your rights in relation to any information that I might hold in my capacity as a representative of Suffolk County Council, you can find information about how to exercise those rights by looking at the council’s corporate privacy notice.

If you would like independent advice on this privacy notice or in respect of other matters about how I process your personal data, including how to make a complaint, you can contact the Information Commissioner's Office at:

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Email: casework@ico.org.uk

If you are dissatisfied with how I have used your personal information whilst transacting business for the council, please contact the Data Protection Officer:

Suffolk County Council
Endeavour House,
8 Russell Road,
Ipswich,
IP1 2BX
Email: data.protection@suffolk.gov.uk

Under data protection legislation, individuals have the right to request access to information about them that we hold. To make a request for your personal information contact data.protection@suffolk.gov.uk.

You also have the right to:

• object to processing of personal data that is likely to cause, or is causing, damage or distress
• prevent processing for the purpose of direct marketing
• object to decisions being taken by automated means
• in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed, and
• claim compensation for damages caused by a breach of the Data Protection regulations.

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office.

Contact details for the council’s Data Protection Officer and Compliance Manager can be found in the council’s corporate privacy notice, which is available on the council’s website.