This is a policy document under the Data Protection Act 2018 (the DPA) explaining, in respect of special category data and information about criminal offences, Norfolk County Council’s:
- Procedures for securing compliance with the principles in Article 5 of the General Data Protection Regulation (GDPR) and section 35(4) of the DPA - principles relating to processing of personal data - in connection with the processing of personal data in reliance on the condition in question, and
- Policies regarding the retention and erasure of personal data processed in reliance on the condition, giving an indication of how long such personal data is likely to be retained.
Personal data is any information by which a living individual can be identified. Individual identification can be by information alone or in conjunction with other information. Certain categories of personal data have additional legal protections when being processed. These categories are referred to in the legislation as “special category data” and are data concerning:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data
- Sex life or sexual orientation
The processing of criminal offence data also has additional legal safeguards. Criminal offence data includes information about criminal allegations, criminal offences, criminal proceedings and criminal convictions.
This policy meets the following requirements of the DPA:
- Paragraph 1 of Schedule 1 requiring that an appropriate policy document be in place where the processing of special category personal information necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection
- Paragraph 5 of Schedule 1 requiring that an appropriate policy document be in place where the processing of special category personal data is necessary for reasons of substantial public interest. The specific conditions under which data may be processed for reasons of substantial public interest are set out at paragraphs 6 to 28 of Schedule 1 to the DPA.
- Section 42 requiring that an appropriate policy document is in place in respect of processing of personal information for law enforcement purposes
Procedures for securing compliance with the principles in Article 5 of the GDPR
Article 5 of the GDPR sets out the data protection principles. These are our procedures for ensuring that we comply with them.
Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
The County Council will:
- Ensure that personal data is only processed where a lawful basis applies and where processing is otherwise lawful
- Only process personal data fairly and will ensure that data subjects are not misled about the purposes of any processing
- Ensure that data subjects receive full privacy information so that any processing of personal data is transparent
Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
The County Council will:
- Only collect personal data for specified, explicit and legitimate purposes, and we will inform data subjects what those purposes are in a privacy notice
- Not use personal data for purposes that are incompatible with the purposes for which it was collected. If we use personal data for a new purpose that is compatible, we will inform the data subject first.
Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
The County Council will only collect the minimum personal data that we need for the purpose for which it is collected. We will ensure that the data we collect is adequate and relevant.
Personal data shall be accurate and, where necessary, kept up to date.
The County Council will ensure that personal data is accurate, and kept up to date where necessary. We will take particular care to do this where our use of the personal data has a significant impact on individuals.
Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
The County Council will only keep personal data in identifiable form as long as is necessary for the purposes for which it is collected, or where we have a legal obligation to do so. Once we no longer need personal data it shall be deleted or rendered permanently anonymous.
Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
The County Council will ensure that there appropriate organisational and technical measures in place to protect personal data.
The GDPR states that the data controller must be responsible for, and be able to demonstrate, compliance with these principles. Our Senior Information Risk Officer and Caldicott Guardians (for social care personal data) are responsible for ensuring that the department is compliant with these principles.
- Ensure that records are kept of all personal data processing activities and that these are provided to the Information Commissioner on request
- Carry out a Data Protection Impact Assessment for any high risk personal data processing and consult the Information Commissioner if appropriate
- Appoint a Data Protection Officer to provide independent advice and monitoring of the departments’ personal data handling and that this person has access to report to the highest management level of the department
- Have in place internal processes to ensure that personal data is only collected, used or handled in a way that is compliant with data protection la
Data controller’s policies regarding retention and erasure of personal data
We will ensure, where special category personal data or criminal offences data are processed, that:
- There is a record of that processing and that record will set out, where possible, the envisaged time limits for erasure of the different categories of data
- Data subjects receive full privacy information about how their data will be handled, and that this will include the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period
- Where we no longer require special category or criminal convictions personal data for the purpose for which it was collected, we will delete it or render it permanently anonymous
- We retain personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To work out the right retention period for personal data, we consider the following matters:
- The amount, nature, and sensitivity of the personal data
- The potential risk of harm from unauthorised use or disclosure of personal data
- The purposes for which we process your personal data and whether we can achieve those purposes through other means, and
- Any legal or regulatory requirements.
Once services are no longer required from us by a person, we will retain and securely destroy their personal information in accordance with our data retention schedule.
For further information about the County Council’s compliance with data protection law, please contact us by:
- Emailing the Information Compliance Team at firstname.lastname@example.org
- Writing to the Information Compliance Team, Norfolk County Council, County Hall, Martineau Lane, Norwich NR1 2DH
Alternatively, if you wish to contact our Data Protection Officer, you may do so by:
- Emailing the DPO at: email@example.com
- Writing to the DPO, Norfolk County Council, County Hall, Martineau Lane, Norwich NR1 2DH
This notice was last updated in July 2018.