Data Protection at South Cambridgeshire District Council

Under the Data Protection Act we are legally obliged to be fully accountable concerning the methods in which we keep and use your personal data. South Cambridgeshire District Council is defined as a Data Controller under the Data Protection Act 1998. As a District Council, we require you to provide us with some of your personal data, enabling you to access all the services which you are entitled to. By law we must also collect personal data for purposes like Council Tax or Electoral Registration.

Sometimes we collect personal data for one council service and need to use it to give you another service. We may also use it for prevention and detection of fraud.


data

What is the Data Protection Act?

The development of data protection in the UK can be traced back to the 1970's. The first Data Protection Act
was published in 1984, this was superseded by the 1998 Data Protection Act.

There are eight principles within the Data Protection Act and these form the basis of the Act. Those principles
are that all personal data will be:

1. fairly and lawfully processed;
2. processed for limited purposes;
3. adequate, relevant and not excessive;
4. accurate;
5. not kept for longer than is necessary;
6. processed in line with your rights;
7. secure;
8. not transferred to countries without adequate protection.

mean

What do these eight principles mean?

First Principle

Personal data must be processed fairly and legally.

Processing means collecting, storing, retrieving or organising data. This can only happen if the individual concerned (data subject) gives their permission, or the processing is necessary for legal or contractual reasons. To be processed fairly, the data subject should know who is processing data about them, and why. The first principle upholds that individuals must not be deceived or mislead about why the data is needed. To be processed legally the data will not lead to any form of discrimination or other law breaking.

Second Principle

Personal data must only be processed for limited purposes and in an appropriate way.

There must be a valid reason why we are collecting your personal data and we will inform you what that reason is. Data collected for one reason cannot be used for any other unrelated purpose. For example, names and addresses held for a particular purpose will not be given to a mail order company without permission.

Third Principle

Personal data must be relevant and not excessive for the purpose

Only data really necessary for the purpose stated should be collected. Information which may be used later will not be collected at that time.

Fourth Principle

Personal data must be accurate and up to date.

Anyone from South Cambs District Council who is collecting and using information will take all reasonable steps to check it for accuracy, whether it originates from the individual concerned or some other source. Information liable to change over time will be monitored to ensure it is kept up to date, if it continues to be processed. Personal comments about an individual can be recorded if they are relevant, objective and kept up to date.

Fifth Principle

Personal data processed for any purpose should be kept no longer than is necessary to fulfil that purpose.

Out of date or redundant information will be destroyed in a confidential manner on a regular basis. For example, application forms from unsuccessful job applicants will be destroyed after a few months, unless otherwise stated.

Sixth Principle

Personal data must be processed in accordance with the rights of the individual

These rights include the right of access by the individual to information held about them, as well as the right to prevent processing likely to cause damage or distress to themselves or anyone else. There are exceptions to these rights. For example, individuals do not have such strong rights in cases of crime detection or taxation assessment.

Seventh Principle

Personal data must be kept securely

Controls may be technical (e.g. built into computer systems) or organisational (e.g. management structures and physical security in the work-place) in nature but the District Council will ensure that all personal data is securely kept.

Eighth Principle

Personal data can only be transferred to countries have suitable data controls.

Not all non-European or European countries have data protection legislation, so the District Council will ensure that any transfer of personal data will only go to countries that have the appropriate controls.

personal

What is Personal Data?

Personal data is anything which identifies you as an individual, this is either on it's own or is referenced to other information which is kept by the district council. Some of the examples of personal data which we might hold about you are: name, address, Council Tax reference number, rent payment records, etc. It might also include expressions of opinion about you and the council's intentions towards you.

The Act recognises that some types of personal data are more sensitive than others. There are extra rules for processing data about your ethnic origin, religious beliefs, trade union membership, party political opinions, sexuality, health, involvement in court proceedings, etc.

processing

What do you mean by processing data?

Collecting, storing, accessing, amending and destroying any information/data about you is is meant by processing data. The amount of personal data we have about you and how we process it depends on which council services you use. Sometimes we collect personal data for one council service and need to use it to enable you to get another service from the council. We will always try to tell you if we share your personal data between different council services.
From time to time we will ask you to tell us your opinions on a variety of council services, any information you give us will confidential or if your statements are quoted in a publication you will remain anonymous.

lawful

How do I know that my personal data is being processed fairly and lawfully?

You will know that you personal data is being processed in a fair and lawful manner through when you first provide us with your personal data. We will inform you the purpose for you supplying us with personal data.

We are regularly audited in terms of our data protection practices and it is the role of the Data Protection Officer to ensure that as an organisation we comply the rules of data protection.

affect

How does it affect me?

The Data Protection act places a responsibility on all organisations that process personal data that it holds in a lawful and proper way.

view

How can I view what personal data the council holding about me?

You can view what the council holds in terms of personal data through requesting that a Subject Access Request (SAR) be carried out on all systems in the District Council. As a District Council we have 40 days in which we will respond to your subject access request.

We will acknowledge receipt of the completed SAR form in writing and will send you a written response within 40 working days.

The response will include:

  • a description of the personal data
  • why the data is held
  • who else the data might have been given to
  • a copy of the data
  • an explanation of any technical terms or abbreviations
  • any information about the original source of the data


We can withhold some data if it refers to other people who have not consented to disclosure, if disclosure might cause serious harm to you or anyone else or might prejudice crime prevention or court proceedings. Even if we cannot provide you with copies of the data, we will confirm what type of data we hold and why we hold it.

initiate

How do I initiate a Subject Access Request?

Download this Data Protection Form.
Email: data.protection@scambs.gov.uk
Phone: 08450 450 500

correct

How do I correct my personal data which is kept by the Council?

If we hold personal data which is not correct please email or telephone us (details above) to tell us what the correct personal information should be. To help us to correct this mistakes please could indicate which services you believe have this incorrect personal data.