Privacy notice: Contact Môn/Cyswllt Môn (Corporate Transformation)
You have a right to know about the way information about you is used by us. Please read the following information as it refers to additional rights which you should know about.
This notice gives you information about the data we hold about you, how we use it, your rights in relation to it and the safeguards that are in place to protect it.
Isle of Anglesey County Council is the data controller and is registered as a data controller with the Information Commissioner's Office. Full details of the registration are available at the ICO register of data controllers.
In addition, Northgate Public Services is also a data controller for the processing of Blue Badges through the Blue Badge Improvement Service (BBIS); their address is Northgate Public Services (UK) Limited, People Building 2, People Building Estate, Maylands Avenue, Hemel Hempstead, HP24NW.
Purpose of processing
The council protects your information and decides on how it is used. The legal term for using information is processing. Also, the legal term for information about you is personal data.
How the council will use your personal information to
- Manage housing related enquiries
- Provision of education
- Administering the assessment and collection of taxes to include revenue, benefits and grants
- Administer and assess licences and registrations
- Administration of disability Blue Badges
- Managing archived records for historical and research purposes
- Planning, including applications
- Local fraud initiatives
- Use of CCTV
- Payments
- Collect data for the corporate CRM (My Anglesey Account) including name, address, date of birth, national insurance number, email, telephone number, transactional history, language choice (for additional information, refer to the Data Protection Policy and Privacy Notice)
- Accounts may be created on behalf of external organisations, with the customer consent
- Concerns, complaints, compliments and enquires
This is the intended purpose of processing. The information will not be used for purposes that are not compatible with why it is gathered in the first instance.
Legal basis of processing
The council collects and uses your personal information because it has a legal duty or right to do so; or to perform a public interest task; or because you have given your consent. The legal term for this is called legal basis of processing.
If your special category data is processed, in addition to one of the above, processing will be necessary because at least one of the following shall also apply:
- The data subject has given explicit consent to the processing of those personal data for one or more specified purposes
- To carry out the obligations and exercising specific rights of the controller or of the data subject in the field of employment, social security and social protection law
- To protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
- Processing relates to personal data which are manifestly made public by the data subject
- For the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
- Processing is necessary for reasons of substantial public interest
- Processing is necessary for the purposes of preventative or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services;
- For reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices
- For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Sharing your personal data
The council will collect and share information with public bodies that contains some personal data. Please note that the council will collect and share data with the Auditor General for Wales’ (AGW’s) in connection with their audit work and studies. Data sharing will also take place pursuant to the duty at Section 33 of the Local Government (Wales) Measure 2009.
The personal information you provide will not be shared with any other organisations unless the transfer of a valid Blue Badge is requested by the badge holder, in this instance the application may be transferred to the local authority area of new residence of the badge holder.
The council will not use your information for automated decision making or profiling. Profiling means any form of automated processing of your personal data to evaluate or analyse or predict things about you. This could include your economic situation, health, personal preferences, interests or behaviour.
The council will transfer your personal information to another country (or countries) only in relation to transfer of details relating to a valid Blue Badge, with prior consent from the individual concerned. The safeguards are set out in the Northgate Public Service and BBIS contract.
Retention period
The information you supply will be kept for as long as is required or necessary, and will be destroyed securely. The retention periods are set out in the council’s list of retention periods, known as a retention schedule. For further information please contact the Data Protection Officer.
Your legal rights
You have legal rights, and it is important that you know what they are.
You have the right to obtain confirmation that information about you is being used
The council will provide confirmation if you ask for it.
You have the right to obtain a copy of your personal data
You will be provided with copies of your personal data within the statutory period of one month (or if providing your personal data is a complex matter, this will be done as soon as is reasonable within 3 months).
Your personal data will be provided to you free of charge, however, if your request is deemed manifestly unfounded or excessive, a reasonable fee will be charged. You ask to obtain your personal data by contacting the council’s Data Protection Officer.
You have the right to have information about you corrected. This is known as the right of rectification
You have the right to ask that your personal data is rectified if it is incorrect or incomplete. This will be done within 1 month, or if your request is complex, within 3 months.
The right to have personal data erased
You have a right to have personal data erased in specific circumstances:
- Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
- When you object to the council’s processing and there is no overriding legitimate interest for continuing the processing
- If the personal data was unlawfully processed
- When the personal data has to be erased in order to comply with a legal obligation or
- When the personal data is processed in relation to the offer of information society services to a child, for example an 'app' developed specifically for children.
The right to restrict processing
Where it is claimed that data is inaccurate or the right to erasure has been exercised you can require the council to restrict processing until verification checks have been completed.
The right to object
In addition to the right to object to your information being used for direct marketing, you have the right to object to processing based on the performance of a task in the public interest/exercise of official authority (including profiling), and processing for purposes
of scientific/historical research and statistics.
Rights in relation to automated decision making
You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects on you or affects you in a significant way.
Please contact our Data Protection Officer by email, post or telephone if you have any queries about this Privacy Notice or the information we hold about you.
The council’s Data Protection Officer (DPO) can be contacted by email: DPO@anglesey.gov.uk or SDD@ynysmon.gov.uk .
We hope that our DPO can resolve any query or concern you may raise about our use of your personal information.
The General Data Protection Regulation also gives you the right to lodge a complaint with a supervisory authority where you work, normally live or where any alleged infringement of data protection laws occurred.
The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Email: casework@ico.gsi.gov.uk
Telephone: 0303 123 1113.
This Privacy Notice was published on 24 May 2018
Version v1
Date 24 May 2018