Privacy

Introduction

This Privacy Notice is provided within the context of the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA). It is subject to ongoing review to ensure it continues to align with the requirements of all applicable legislation.

This document sets out what personal information is processed by me in my capacity as a Councillor.

I am the Data Controller for the purpose of processing the personal data of my constituents who contact me as their Ward Councillor. 

Councillors often undertake activities on Council working groups and committees, in these circumstances, they will have access to information to fulfil their duties the same as an Officer of the Council.  In these circumstances, the Council is the Data Controller and this privacy notice should be read in conjunction with the Council’s Privacy Notice.

What personal data I collect

As a Councillor I might collect personal data from you in a number of ways, for example; when I meet you in the community or at a surgery, when you telephone or contact me via email/letter, from other constituents, groups or members of the public in relation to matters which they have been asked to pursue in the interests of individuals and groups who live in their Ward.

This will generally include;

• your name
• date of birth
• address 
• contact information
• details of your problem or concern. 

If it is relevant to your enquiry, I may also have information relating to your financial situation.

In some cases, such as assisting you with specific issues or specific organisations it may be necessary for me to collect what the GDPR has classed as special category data which includes: 

• race or ethnic group
• sexuality and sexual life
• religious or philosophical beliefs
• trade union membership
• genetic and biometric data
• physical or mental health
• as well as criminal convictions.  

Why I collect and use personal data

I use personal data collected within my constituency role when I’m representing the residents in my Ward, including:

•    dealing with casework for constituents and other members of the public
•    taking part in local community organisations
•    crime prevention
•    organising and taking part in community initiatives and events
•    providing local community leadership
•    acting as a consultee on matters affecting my Ward

Your personal information may also be included as part of details of cases of interest, as part of information provided by signatories on petitions, responses to questionnaires and contact details for the purpose of communicating news and updates.

The legal reasons for collecting and using your personal data

To be able to collect and use your personal data, it is necessary for a Councillor to have a lawful basis. The lawful basis that allows me to process your personal data are the following: 

• consent - you provide your personal data and ask me to act on your behalf.
• protect your vital interests - such as a life or death situation or to protect you from harm, or the vital interests of another person.
• a task in the public interest or where because of my role as an Elected Member – I am authorised to use your personal data.
• legitimate interests - I need your personal data for their legitimate interests, or the legitimate interests of a third party.

For the special category data, such as your medical information, they rely on the following conditions:

• explicit consent- this will usually be in writing.
• protect vital interests- when you are unable to give consent and you or someone else is at risk of harm.
• establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

If as a Councillor I am processing your data because you have consented for me to do so, you can withdraw that consent at any time by getting in touch with me. Unless there is another legal basis for me to process your data, a Councillor must stop processing your data when you withdraw consent and destroy the data. This may mean that I can no longer provide services to you.

Who I can share your data with

I may need to share your personal data with officers at Surrey Heath Borough Council in order to progress your enquiry. Where necessary, I will also share your data with other Councillors in my Ward.

I may also need to share your data with Surrey County Council, your local MP or other organisations, such as Housing Associations, DWP or the NHS, if the matter you have raised with me isn’t covered by the Borough Council. I will let you know who I will share your data with.

When sharing information I will make sure it is necessary and it is sent with appropriate security and only the minimal information will be shared.  

Keeping your personal data secure

If you provide data to me electronically, via e-mail to my Surrey Heath Borough Council e-mail address, this will be held securely in the cloud in accordance with the Surrey Heath Borough Council Information Security Policy and Records Retention Policy. 

Information I store locally either electronically or hard copy outside of Surrey Heath Borough Council is stored with appropriate security measure in place to prevent personal data from being accidentally lost, used or accessed in an unauthorised way.

How long I will keep your data for

I will keep your personal data for as long as it is necessary in relation to the issue you have raised.
Once the issue you have raised has been resolved I will dispose of your personal data within a reasonable time period. This is likely to be between 6 months (after your matter has been finalised) and 4 years, or to the end of my term as Councillor.

This is to allow me to build up case history and to return to your records should further matters arise.

Your Rights as an individual under UK GDPR

The DPA in conjunction with the GDPR grant you a number of rights including:

• The right to ask us to provide you with copies of personal information we hold about you at any time, known as a Subject Access Request;
• The right to object to the use of your personal information for certain type of processing, such as direct marketing or automated processing, including profiling;
• The right to ask us to delete, update and correct any out of date or incorrect personal information that we hold about you;
• The right to opt-out at any time where you have given consent and to have your data erased where you have given consent.

You are entitled to receive a copy of your records without charge and within a month. For more information on how your personal information is processed and how to make a subject access request, please contact me directly. My details can be found on Surrey Heath Borough Council’s website:
https://surreyheath.moderngov.co.uk/mgMemberIndex.aspx?bcr=1

Further information 

If you would like to know more about how I use your information, please contact me directly. My details can be found on Surrey Heath Borough Council’s website.

How do I complain?

You also have the right to complain to the Information Commissioner’s Office(external link), at:

The Information Commissioner,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF.
Telephone: 0303 123 1113