Norfolk County Council (the County Council) is committed to protecting the privacy and security of your personal information. By personal information, we mean information which, by itself or with other information available to the County Council, can be used to identify you.
In summary, this document (known as a privacy notice):
This privacy notice has been produced in compliance with the General Data Protection Regulations (GDPR).
The County Council is the "data controller" for the personal information held by the County Council. This means that we are responsible for deciding how we “process” (that is, collect, hold, use and disclose to third parties) your personal information.
Our address is Norfolk County Council, County Hall, Martineau Lane, Norwich NR1 2UA.
The County Council’s Data Protection Officer (DPO) is Geoff Connell.
We process your personal information primarily to provide advice and guidance, assessments, services, support and safeguarding for your children and your families to better meet the needs of your children and family and to provide the help that you require as early as possible. This includes the provision of:
We also process this information to assess the quality of our services and evaluate and improve our policies and procedures.
We may also process this information in other ways compatible with the above. Mainly this will include supporting the work of other public bodies providing services to children. We provide more details of the services on our website at children and families.
You do not have to provide information to us for some of these services, but, if you do not provide information, we may not be able to or it may inhibit our ability to provide services to you or your child.
The information we hold includes information you have provided to us.
We also receive information from other public bodies and organisations providing services to you or your children. The categories of data we may receive from other public bodies and organisations are described further below.
The information we collect and use includes you and your child’s:
We may also collect data about racial or ethnic origin, religious or philosophical beliefs, sexual orientation, health data including any disabilities and medical conditions. This data is classed as “special category data” under the GDPR. We may only collect and use these types of data when it is relevant and such data will be collected as part of the case work records and information we hold. as part of the referral / assessment / case work records and information we hold.
We also collect information concerning criminal convictions.
There must be a lawful basis (or justifiable reason) for us to collect, store, use and disclose your personal information.
Our lawful basis to process this information is because it is necessary comply with a legal duty or fulfil a public task. This includes the:
We have legal grounds to process the special category and criminal convictions information where it is necessary for reasons in the substantial public interest. This will include where it is necessary to carry out any of our statutory functions.
The GDPR includes safeguards to protect the use of your special category data. Further details can be found in our policy document setting out our procedures for compliance with the principles of the GDPR and the retention and erasure of this information. This is on the County Council’s website.
Information concerning any criminal convictions is afforded a similar special level of protection, and we may collect and use this information where it is relevant, subject to the same safeguards.
Additionally, and where appropriate, we may seek specific consent to use your information in certain ways. This will normally be where the use of the data is not necessary for the above purposes but may be very useful or helpful to us to provide services. For example, all marketing and feedback where personal information is obtained alongside, and directed at, individuals, and where personal information, such as photographs/videos, are used for publicity purposes.
We may disclose your personal information to your family including persons with parental responsibility as well as public bodies and other organisations, in particular:
Your personal information may also be provided to a third party contracted by the County Council to provide a service to the Council or directly to you for example, transport providers like Norse Ltd and taxi drivers. These service providers are known as data processors and have a legal obligation under GDPR and to the County Council to look after your personal information and only use it for providing that service. An example of this is the County Council uses a case management system operated by a data processor for its social care services.
We may also share your information across different departments of the County Council, where it is necessary for our public tasks or functions to do so.
We disclose this information without your specific consent as it is reasonable and necessary to do so to fulfil our public tasks or it is otherwise in the substantial public interest to do so.
We do not transfer your information to countries outside of the UK
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
Once you are no longer require services from us, we will retain and securely destroy your personal information in accordance with our information retention schedule.
We do not use automated decisions about you and your family.
It is important that the personal information we hold about you is accurate and current.
Please keep us informed if your personal information changes during your working relationship with us. You can do to help us with this by:
You have the following rights (but note, these rights do not apply in all circumstances):
If you want to exercise any of these rights, please contact the Information Compliance Team by:
If you have any questions about this privacy notice or how we handle your personal information, you can write to the DPO by letter to the DPO, Norfolk County Council, County Hall, Martineau Lane, Norwich NR1 2DH or by email firstname.lastname@example.org.
You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. The ICO can be contacted by:
Where this notice applies to information collected or processed on a website, please note this privacy notice only applies to the County Council’s website and ceases to apply when you leave our pages. If you follow links to other organisations websites, even if you follow a link which we have provided, it is suggested you take the time to read the privacy notices on the websites you visit.
We keep this privacy notice under regular review and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.
This notice was last updated in January 2019.