Solihull Council Privacy Notice

As required by the General Data Protection Regulations (GDPR), this Privacy Notice provides details of how the Council uses personal information.

Principal activity: Local Government

Organisation Name: Solihull Metropolitan Borough Council

Address: Council House, Manor Square, Solihull, B91 3QB

County: West Midlands

Country: England

Data Protection Officer: Assigned to the Corporate Information Governance Manager

Nature of work

The Council works with residents and other parts of the public and private sector to determine and deliver local priorities. It provides a wide range of services, either directly through employees or by commissioning services from outside organisations. It has responsibility for the economic, social and environmental ’wellbeing’ of the borough.

Most Council services are mandatory. This means that the council must do them because they are under a duty to do so by law (e.g. to operate an alcohol licensing regime under the Licensing Act 2003). Some mandatory functions are tightly controlled by central government, resulting in a similar level of service across the country (e.g. the administration of housing benefit). Other mandatory requirements (e.g. the library function) leave the council with some discretion over the level and type of service they provide.

Legal Basis for Processing

1. The legal basis for processing personal information for most of the Council’s work can be found in Article 6(1)(e) General Data Protection Regulations (GDPR) where: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
2. The Council’s legal basis for processing most ‘special category’ personal information can be found in Article 9(2) (GDPR): (g) processing is necessary for reasons of substantial public interest and is authorised by domestic law (see section 10 of the 2018 Act;
3. Section 111 Local Government Act and Section 1 Localism Act provide the legal powers which allow the Council to undertake the above.

Processing Information

We process personal information to enable us to provide a range of services to local people and businesses which broadly include:

th="">

Why we need your information

We will use your personal information for a limited number of purposes and always in line with our responsibilities, where there is a legal basis and your rights under Data Protection Legislation.

We will process personal information:

• for the purpose for which you provided the information, e.g. the processing of a benefit claim
• to enable us to communicate with you and provide the services you need or are entitled to
• to monitor our performance in providing services to you; to gather statistical information to allow us to plan future provision of services and to obtain your opinion about our  services
• to meet various legal requirements
• to enable us to perform statutory law enforcement functions for example licensing, planning enforcement, trading standards food safety, etc.
• for the prevention and/or detection of crime including fraud
• to process financial transactions including grants, payments and benefits directly involving  us or where we are acting on behalf of other government bodies such as Department for Works and Pensions
• for general processing where you have given your consent for us to do so
• where it is necessary to protect individuals from harm or injury
• where it is permitted under Data Protection legislation, for example, to comply with legal obligations  or for us to seek legal advice or undertake legal proceedings

We aim to always keep your information accurate and up to date.  You can help us to do this at any time by letting us know if any of the information you have given us, such as your address, changes.

Type/Classes of information processed

We process a variety of information relating to the above which may include:

• personal details
• family details
• lifestyle and social circumstances
• goods and services
• financial details
• employment and education details
• housing needs
• visual images, personal appearance and behaviour
• licenses or permits held
• student and pupil records
• business activities
• case file information
• Births and Deaths details

We may also process what is referred to as 'special categories' of information that may include data revealing:

• racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic data
• biometric data
• health or data concerning a natural person's sex life or sexual orientation

Who information is processed about

The classes of personal information we process include:

• customers
• suppliers
• staff, persons contracted to provide a service
• claimants
• complainants, enquirers or their representatives
• professional advisers and consultants
• students and pupils
• carers or representatives
• landlords
• recipients of benefits
• witnesses
• offenders and suspected offenders
• license and permit holders
• traders and others subject to inspection
• people captured by CCTV images
• representatives of other organisations
• Healthcare users/patients
• survey respondents

National Data Opt-out

The Council complies with the National Data Opt-out standard. This applies to organisations that handle data that originates within the health and adult social care systems in England. It provides a choice to patients about how their confidential patient information is used for purposes other than their individual care and treatment. Further details can be found here.

Who information may be shared with

What follows is a description of the types of organisations we may need to share some of the personal information we process with for one or more reasons.

Where necessary or required we share information with:

• customers
• family, associates or representatives of the person whose personal data we are processing
• current past and prospective employers
• healthcare, social and welfare organisations
• educators and examining bodies
• providers of goods and services
• financial organisations
• debt collection and tracing agencies
• private investigators
• service providers
• local and central government
• ombudsman and regulatory authorities
• press and the media
• professional advisers and consultants
• courts and tribunals
• trade unions
• political organisations
• professional advisers
• credit reference agencies
• professional bodies
• survey and research organisations
• police forces
• housing associations and landlords
• voluntary and charitable organisations
• religious organisations
• students and pupils including their relatives, guardians, carers or representatives
• data processors
• other police forces, non-home office police forces
• regulatory bodies
• courts, prisons
• customs and excise
• local and central government
• international law enforcement agencies and bodies
• security companies
• partner agencies, approved organisations and individuals working with the police,
• licensing authorities
• service providers
• press and the media
• healthcare professionals social and welfare advisers or practitioners
• current past and prospective employers and examining bodies
• law enforcement and prosecuting authorities
• legal representatives, defence solicitors
• police complaints authority
• the disclosure and barring service
• healthcare professionals
• register of births and deaths

How long we will keep your information

We will not keep your information any longer than needed. The length of time will vary from service to service and will be guided by either legislation which states how long records should be retained (e.g. adoption records 100 years, financial records 6 years) or by the business need to keep the information which will vary.

Transfers Overseas

It may sometimes be necessary to transfer personal information overseas. When this is needed information may be transferred to countries or territories around the world. Any transfers made will be in full compliance with all aspects of the data protection act.

Your rights

Privacy Notices

At the time personal information is collected, an individual has a right to be informed about how that information will be used, including, the purpose of the processing, legal basis for the processing, the recipients and categories of recipients of the information.

Access to information

Data Protection legislation provides individuals with a right to receive a copy of information an organisation holds about them. Any requests will ordinarily be dealt with within 1 calendar month, however, this may be extended by two further months where necessary, taking into account the complexity and number of the requests received. Details on how to apply can be found here

Rectification

Individual’s have a right to correct inaccurate personal information an organisation may hold about them.

Erasure

Subject to certain conditions, a person has a right to have their personal information erased without undue delay when:

• The information is no longer necessary in relation to the purposes for which it was collected.
• The use of the information is based upon consent which has since been withdrawn and where there is no other legal grounds for the processing of the information.
• The individual objects to the processing and there are no overriding legitimate grounds for the processing.
• The information has been unlawfully processed.
• The information has to be erased for compliance with a legal obligation to which the Council is subject.
• The personal information belongs to a child and has been collected by electronic means  for a service normally provided for remuneration.

Restrict Processing

A person has a right to restrict the use of their personal information where one of the following applies:

• The accuracy of the personal information is contested, for a period enabling the Council to verify the accuracy of the information.
• The processing is unlawful and the person opposes the erasure of the personal data and requests the restriction of its use instead.
• The Council no longer needs the personal information but it is required by individual in question for the establishment, exercise or defence of legal claims.
• The individual has objected to the use of the information and this objection is legitimate.

The Council shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal information has been disclosed, unless this proves impossible or involves disproportionate effort.

Obligations regarding rectification, erasure or restriction of processing

The Council will notify each recipient to whom the personal information has been disclosed, unless this proves impossible or involves disproportionate effort. Should an individual require it, the council will inform them about those recipients.

Right to Data Portability

When the processing of personal information is carried out by automated means an individual is allowed to receive personal information concerning him or her which he or she has provided to the Council in a structured, commonly used, machine-readable and interoperable format. This right applies where an individual provided the personal information on the basis of his or her consent or the processing is necessary for the performance of a contract. It will not apply where processing is based on a legal ground other than consent or contract.

It will also not apply to the processing of personal information carried out in the exercise of public duties or in the exercise of an official authority vested in the Council. Where technically feasible, the data subject should have the right to have the personal data transmitted directly from one controller to another.

Right to Object

A person has the right to object, on grounds relating to his or her particular situation, at any time to certain types of use of their personal. For example,  the right to object to personal information being used for Direct Marketing.

Automated Decision Making

A person has a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her unless the decision :

• Is necessary for entering into, or performance of, a contract between the individual and the Council, or
  Is authorised by law which also lays down suitable measures to safeguard the individuals rights and freedoms and legitimate interests, or
• Is based on the individual’s explicit consent.

In these cases a person has a right to ask for human intervention in the decision making or to all his or her point of view to be presented and to contest the decision.

Automated decisions will not be made that involve a person's racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying person, data concerning health or data a person's sex life or sexual orientation unless:

• The individual has provided their explicit consent, or
• Processing is necessary for reasons of substantial public interest and based upon a law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of individuals.

Report Concerns to the Regulator

If you have a concern about the way your information is being used you have a right to contact the Information Commissioner's Office (ICO). The ICO is the UK’s independent body set up to uphold information rights.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF.

• Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate).
• Website: www.ico.org.uk

See also

• Adult Care and Support
• Children's Services and Skills
• Economy and Infrastructure
• Public Health
• Resources
• Solihull Community Housing
• Solihull Council Consultations