The purpose of this document
Norfolk County Council (the County Council) is committed to protecting the privacy and security of your personal information. By personal information, we mean information which, by itself or with other data available to the County Council, can be used to identify you.
This general privacy notice serves as a privacy notice:
- Under the UK General Data Protection Regulation (GDPR) for the County Council’s statutory functions relating to, for example, education, highways, transport planning, passenger transport, social care (children and adults), libraries, waste disposal and strategic planning
- Under Part 3 of the Data Protection Act 2018 (the DPA) for the County Council’s statutory functions relating to law enforcement
In summary, this privacy notice:
- Sets out how we promise to look after your personal information
- Describes how we collect, use and share your personal information, and
- Tells you about your privacy rights and how the law protects you
This privacy notice covers personal information we collect about:
- Visitors to our website
- People who use our services, for example, persons who receive services from us to help remaining at home
- People who complain about any aspect of a service we provide
- People who are subject to or have a connection with enforcement related activity
Who we are
The County Council is the "data controller" for the personal information held by the County Council. This means that we are responsible for deciding how we “process” (that is, collect, hold, use and disclose) your personal information.
Our address is Norfolk County Council, County Hall, Martineau Lane, Norwich NR1 2UA.
The kind of information we hold about you and who provides it
Personal information can include, but is not limited to, your name, address, telephone number, date of birth, and bank details which can be found within records that the County Council holds which may include electronic records, letters, emails, photographs, audio recordings and video recordings. It does not include information where the identity has been removed and you cannot be identified by this information and by any other information held by the County Council (anonymous information).
We may also hold more sensitive personal data known under the GDPR as “special categories” and under the DPA as “sensitive processing”. Special category data and sensitive data is personal data revealing:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic and bio-metric data
- Sex life or sexual orientation
- Health including disabilities
Under the GDPR and DPA we may also collect information relating to criminal offences and criminal convictions.
You can read the County Council’s policy setting out our procedures for compliance with the data protection principles and the retention and erasure of this data in respect of:
We may collect personal information about you from yourself directly or other individuals or organisations.
You can see more detail the kind of information we hold about you in relation to each County Council service and who we receive that information from can be found in our privacy notices for council service areas.
Use of Data for Planning and Commissioning Purposes
Organisations providing health and social care services within Norfolk and Waveney must submit certain information to its local Clinical Commissioning Group, which is used to plan, commission, and monitor the performance of services. These are known as national and commissioning datasets. These datasets do not directly identify you but can contain information regarding NHS numbers, gender, numbers of patients within an age bracket and clinical activity.
If you have raised a national data opt-out, your information will be excluded from the above datasets.
We receive this data from NHS Norfolk and Waveney Clinical Commissioning Group for the purposes of ensuring patients receive quality, effective and equitable care.
We may use this data to identify you, if we have an existing direct care relationship with you.
This means Norfolk County Council receives information from Norfolk and Waveney Clinical Commissioning Group (NWCCG) so we can provide suitable care. This information originally comes from your GP (or similar healthcare provider) who sends it to the NWCCG (unless you have signed up to the National Data opt-out.
What we use your personal information for
We use your personal information to:
- Provide County Council services and anything we must do by law
- Carry out our regulatory, licensing and enforcement roles
- Make payments, grants and benefits
- Act in connection with the prevention, detection and investigation of fraud
- Assess how much you must pay towards your County Council service if a charge is made for the service
- Listen to your ideas about the County Council’s services
- Deal with complaints
- Tell you about the County Council’s services.
In some cases, you may be under a statutory or contractual obligation to provide information to the County Council. Further detail of where this applies and the consequences of not providing it, together with information about why we use your personal data in relation to each of the County Council’s services can be found in our privacy notices for council service areas.
How the law protects you and the legal basis for processing your information
The GDPR and DPA place a legal obligation on us to process your personal information in accordance with the following data protection principles in that your personal data must be:
- Used lawfully, fairly and in a transparent way
- Collected only for valid purposes that we have explained to you and not used in any way that is incompatible with those purposes
- Relevant to the purposes we have told you about and limited only to those purposes
- Accurate and kept up to date
- Kept only as long as is necessary for the purposes we have told you about
- Kept securely
There must also be a lawful basis for processing personal information – a justifiable reason for us to collect, store, use and disclose your personal information. Our lawful basis for doing so will depend on what services we are providing to you, and what type of information we process about you, for example, an additional basis is required for ‘special category’ data described above.
The basis we process your information may include:
- Under GDPR:
- Necessary for the performance of a task in the public interest. There are statutory duties placed on and statutory powers provided to the County Council by various pieces of legislation including the Children Act 1989, the Care Act 2014, various education acts and Local Government Acts, the Localism Act 2011 and the Local Audit and Accountability Act 2014. Further detail about our legal duties and powers in relation to each County Council service can be found in our privacy notices for council service areas.
- Necessary for the performance of a contract we may have with you
- You consent/agree to the processing. The County Council will tell you if processing some of your personal data is not necessary to comply with a public task or to fulfil a legal duty or to fulfil a contract and is therefore optional. In these circumstances, we may ask for your consent to process it. The GDPR sets higher standards in relation to obtaining your consent to process your personal information. We have an obligation to ensure that when consent is required from you it is done so in a manner which is clear.
- Under the DPA
- For law enforcement purposes
- You consent to the processing
We also process special category information and information about criminal offences/convictions under the GDPR and sensitive personal information under the DPA.
The grounds for processing special category and criminal convictions data under the GDPR and sensitive data under the DPA differs from the grounds set out above. We have therefore set out our grounds for processing in relation to each County Council service and this can be found in our privacy notices for council service areas.
Who we share your personal data with
We may share your data with other services within the County Council so that we can keep our information on you as up-to-date as possible and so that we can improve our services to you. For example, if you tell the Customer Services Team that you have moved, they will update your records and inform other parts of the County Council that may be providing you with a service. Details of where we will do this can be found in our privacy notices for council service areas.
We may also share your personal data with, and receive your personal data from, organisations and individuals outside of the County Council. Further detail about data sharing in relation to each County Council service can be found in our privacy notices for council service areas.
Additionally, your personal information can be provided to a third party contracted by the County Council to provide a service to the Council or directly to you. These service providers are known as data processors and also have a legal obligation under GDPR and DPA and to the County Council to look after your personal information and only use it for providing that service. An example of this is the County Council uses a case management system operated by a data processor for its social care services.
If we transfer your personal information to other countries
Your personal information may be transferred outside of the UK and the European Economic Area. While some countries have adequate legal protections for personal data, in other countries steps will be necessary to ensure appropriate safeguards apply to the information. These include imposing contractual obligations to ensure that these safeguards apply. You can find details of what information the County Council may transfer to countries outside of the European Economic Area and the safeguards that apply in our privacy notices for council service areas.
How long we use your information for
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To work out the right retention period for personal data, we consider the following matters:
- The amount, nature, and sensitivity of the personal data
- The potential risk of harm from unauthorised use or disclosure of your personal data
- The purposes for which we process your personal data and whether we can achieve those purposes through other means, and
- Any legal or regulatory requirements.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
Once you no longer require services from us, we will retain and securely destroy your personal information in accordance with our data retention schedule.
Automated decision making
We may, in order to improve the efficiency and effectiveness of services, use automated decision-making processes, including profiling. If an automated decision is made about you that is significant (one that has a legal effect, or otherwise significantly affects you) you will be notified of this, together with your rights to challenge this decision.
Details of where and how the Council carries out automated decisions can be found in our privacy notices for council service areas.
Your responsibility to inform us of changes
It is important that the personal information we hold about you is accurate and current.
Please keep us informed if your personal information changes during your working relationship with us. You can do to help us with this by:
- Telling us when any of your details change; and
- Telling us if any of the information we hold on you is wrong
Your rights under the GDPR
You have the following rights (but note, these rights do not apply in all circumstances):
- Your right to be informed about the processing of your personal information. This is the purpose of this notice.
- Your right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed
- Your right to object to the processing of your personal data
- Your right to restrict processing of your personal information
- Your right to have your personal data erased (“the right to be forgotten”). As above, please note this right is subject to several restrictions, which we will discuss further with you if you choose to exercise it.
- The right to move, copy or transfer your personal information (“data portability”). This only applies to personal data processed under the GDPR and only in certain limited circumstances. This right does not apply to personal data processed under the DPA.
- Rights to be notified of, object to and challenge any automated decision made in respect of you, including profiling
- Your right to request access to your personal information and information about how the County Council processes it
- Your right to withdraw any consent you have given for the processing of personal data at any time
If you want to exercise any of these rights, please contact the Information Compliance Team by:
- Emailing the Information Compliance Team on email@example.com
- Writing to the Information Compliance Team, Norfolk County Council, County Hall, Martineau Lane, Norwich NR1 2UA
Questions or complaints
If you have any questions about this privacy notice or how we handle your personal information, you can write to the DPO by letter to the DPO, Norfolk County Council, County Hall, Martineau Lane, Norwich NR1 2DH or by email to firstname.lastname@example.org.
You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. The ICO can be contacted:
- By writing to the ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- By telephoning 0303 123 1113
- Online at ico.org.uk/global/contact-us/
Links to other websites
Where this notice applies to information collected or processed on a website, please note this privacy notice only applies to the County Council’s website and ceases to apply when you leave our pages. If you follow links to other organisations websites, even if you follow a link which we have provided, it is suggested you take the time to read the privacy notices on the websites you visit.
Changes to this privacy notice
We may amend this privacy notice at any time so please review it frequently. The date below will be amended each time this notice is updated.
This notice was last updated on 24 February 2023.