Data Protection at South Cambridgeshire District Council

Under the Data Protection Act we are legally obliged to be fully accountable concerning the methods in which we keep and use your personal data. South Cambridgeshire District Council is defined as a Data Controller under the Data Protection Act 1998. As a District Council, we require you to provide us with some of your personal data, enabling you to access all the services which you are entitled to. By law we must also collect personal data for purposes like Council Tax or Electoral Registration.

Sometimes we collect personal data for one council service and need to use it to give you another service. We may also use it for prevention and detection of fraud.


data

What is the Data Protection Act?

The development of data protection in the UK can be traced back to the 1970's. The first Data Protection Act was published in 1984, this was superseded by the 1998 Data Protection Act.

There are eight principles within the Data Protection Act and these form the basis of the Act. Those principles are that all personal data will be:

1. fairly and lawfully processed;
2. processed for limited purposes;
3. adequate, relevant and not excessive;
4. accurate;
5. not kept for longer than is necessary;
6. processed in line with your rights;
7. secure;
8. not transferred to countries without adequate protection.

mean

What do these eight principles mean?

First Principle

Personal data must be processed fairly and legally.

Processing means collecting, storing, retrieving or organising data. This can only happen if the individual concerned (data subject) gives their permission, or the processing is necessary for legal or contractual reasons. To be processed fairly, the data subject should know who is processing data about them, and why. The first principle upholds that individuals must not be deceived or mislead about why the data is needed. To be processed legally the data will not lead to any form of discrimination or other law breaking.

Second Principle

Personal data must only be processed for limited purposes and in an appropriate way.

There must be a valid reason why we are collecting your personal data and we will inform you what that reason is. Data collected for one reason cannot be used for any other unrelated purpose. For example, names and addresses held for a particular purpose will not be given to a mail order company without permission.

Third Principle

Personal data must be relevant and not excessive for the purpose

Only data really necessary for the purpose stated should be collected. Information which may be used later will not be collected at that time.

Fourth Principle

Personal data must be accurate and up to date.

Anyone from South Cambs District Council who is collecting and using information will take all reasonable steps to check it for accuracy, whether it originates from the individual concerned or some other source. Information liable to change over time will be monitored to ensure it is kept up to date, if it continues to be processed. Personal comments about an individual can be recorded if they are relevant, objective and kept up to date.

Fifth Principle

Personal data processed for any purpose should be kept no longer than is necessary to fulfil that purpose.

Out of date or redundant information will be destroyed in a confidential manner on a regular basis. For example, application forms from unsuccessful job applicants will be destroyed after a few months, unless otherwise stated.

Sixth Principle

Personal data must be processed in accordance with the rights of the individual

These rights include the right of access by the individual to information held about them, as well as the right to prevent processing likely to cause damage or distress to themselves or anyone else. There are exceptions to these rights. For example, individuals do not have such strong rights in cases of crime detection or taxation assessment.

Seventh Principle

Personal data must be kept securely

Controls may be technical (e.g. built into computer systems) or organisational (e.g. management structures and physical security in the work-place) in nature but the Council will ensure that all personal data is protected against unauthorised or unlawful processing and against accidental loss, destruction or damage.

Eighth Principle

Personal data can only be transferred to countries which have suitable data controls

Personal data will only be transferred to a country or territory outside of the European Economic Area which has an equivalent or adequate level of protection.


personal

What is Personal Data?

Personal data is anything which identifies you as an individual, this is either on it's own or is referenced to other information which is kept by the district council. Some of the examples of personal data which we might hold about you are: name, address, Council Tax reference number, rent payment records, etc. It might also include expressions of opinion about you and the council's intentions towards you.

The Act recognises that some types of personal data are more sensitive than others. There are extra rules for processing data about your ethnic origin, religious beliefs, trade union membership, party political opinions, sexuality, health, involvement in court proceedings, etc.

processing

What do you mean by processing data?

Processing data includes collecting, storing, accessing, amending and destroying information.

The amount of personal data we may hold about you and the way in which we process it will depend upon the Council services you use. Sometimes we collect personal data for one Council service and need to use it to enable you to get another service from the Council. We will always try to tell you if we share your personal data between different Council services.

From time to time we will ask you to tell us your opinions on a variety of Council services. Any information you give us will confidential or if your statements are quoted in a publication you will remain anonymous.

lawful

How do I know that my personal data is being processed fairly and lawfully?

You will know that your personal data is being processed in a fair and lawful manner when you first provide us with your personal data.

affect

How does it affect me?

The Data Protection Act places a responsibility on all organisations to process personal data in a lawful and proper way. If you would like further information about how we handle your personal data, contact the Information Management team.

view

How can I find out what personal data the Council is holding about me?

You can find out what information is held about you by sending us a Subject Access Request (SAR). All requests must be submitted using the form below, and include proof of identification. Once received, we will acknowledge your request, and send you a written response within 40 calendar days.

The response will include:

  • a description of the personal data
  • why the data is held
  • who else the data might have been given to
  • a copy of the data
  • an explanation of any technical terms or abbreviations
  • any information about the original source of the data

We can withhold some data if it refers to other people who have not consented to disclosure, if disclosure might cause serious harm to you or anyone else or might prejudice crime prevention or court proceedings. Even if we cannot provide you with copies of the data, we will confirm what type of data we hold and why we hold it.

initiate

How do I initiate a Subject Access Request?


correct

How do I correct my personal data which is kept by the Council?

If we hold personal data about you which is not correct, please email or telephone us (details above). It would be helpful if you tell us the service for which we hold your personal data.

 

Stonewall, Gay and Lesbian Charity - opens in a new window Beacon Authority logo Investor in People logo