Corporate privacy notice

Each council service has its own set of privacy notices which will provide you with more detail about how we use your information. We keep our privacy notices under regular review to make sure they are up to date and accurate.

Who we are and what we do

Durham County Council (DCC) is registered as a 'data controller' under the Data Protection Act as we collect and process personal information about you (this applies to council staff and members of the public). Our registration number is Z1808275.

The council provides a range of statutory and other services to local people and businesses, and we collect personal information for many purposes. This notice explains how we use and share your information and makes sure you understand how we use your personal information. Information may be collected on paper or online forms (this includes the use of Microsoft Forms), by telephone, email, CCTV or by a member of our staff, or one of our partners.

The type of personal information we collect and how we collect it

When gathering and using personal information, we will comply with the data protection principles. This is not an exhaustive list, but we may collect some or all the following types of personal information:

• identity (name, date of birth, gender, passport, National Insurance (NI) number, family details)
• contact (residential address, email address, telephone number)
• technical (IP address)
• social data (lifestyle, housing needs)
• education (student and pupil records)
• commercial services data (services used)
• financial (bank account, payment card, transaction data, salary, benefits)
• staff records (pensions, appraisals, nationality)
• visual image, personal appearance and behaviour
• business activities (employment, licenses and permits held)

Additionally, we may need to collect and process the following special categories of data:

• medical (physical or mental health details)
• racial or ethnic origin
• trade union membership
• political affiliation
• political opinions
• criminal offences (including alleged offences)
• religious or other beliefs of a similar nature
• genetic or biometric data
• sexual orientation

We mostly collect personal information directly from the data subject, but we also may collect, process or share information with other organisations such as Department for Work and Pensions (DWP), Department for Education (DfE), HMRC, NHS, HM Courts and Tribunals Services and education establishments such as schools. Additionally, we may collect, process or share information with partner organisations such as other councils and parish council.

If you wish to understand more about which personal information is being collected, please refer to the service specific privacy notice.

How we use your personal information

We will use (process) the information you provide in a manner that conforms to data protection legislation. We will endeavour to keep your information accurate and up to date and not keep it for longer than is necessary. In some instances, the law sets the length of time information must be kept.

This privacy notice covers all our services, from Adult, Health and Social Care (AHS), Children and Young Person Services (CYPS), Regeneration, Economy and Growth, Neighbourhoods and Climate Change (NCC), Resources and Chief Executive Services.

We need to collect and hold information about you in order to: (please note this is not an exhaustive list)

• manage your case
• provide a service to you
• respond to your correspondence or complaints
• to keep you safe (an example would be CCTV)
• financial transactions with you
• contract with you
• legally enforce the law

We may not be able to provide you with a product or service unless we have enough information. We will not disclose any information that you provide 'in confidence' to us, to anyone else without your permission, except in the few situations where disclosure is required by law, or where we have a good reason to believe that failing to share the information would put you or someone else at risk.

If you wish to understand more about how your personal information is used, please refer to the service specific privacy notice.

Some of our services use Artificial Intelligence (AI) tools to support us in our service delivery, the individual privacy notice for that service will include where AI is in use.

Personal data is processed to enable the council to deliver high quality services to individuals and communities and to inform managers and executives regarding service delivery at operational and strategic levels. To support this and to ensure we have the best understanding of the needs of service users, households and communities, data from our IT systems may be automatically extracted and matched. This will be done in accordance with the Data Protection Act and is to assist the council in planning new service developments and improvements moving forward.

What our lawful basis is to obtain and use your personal information

When we collect and use your personal information we rely on at least one of the following lawful bases:

• Consent - You or a legal representative have given consent (an example would be when you join a mailing list).
• Contract - Processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering the contract.
• Public Task - The processing is necessary for us to perform our official function.
• Legal Obligation - The processing is necessary to comply with a common law or statutory obligation.
• Vital Interest - The processing is necessary to protect someone's life
• Legitimate Interest - The processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual's personal data which overrides those legitimate interests.

The service specific privacy notice will always outline which lawful basis is being relied upon.

Reasons we may share your personal information

We may need to pass relevant information about you to other people and organisations or where we have an information sharing agreement to deliver a service. These people and organisations are obliged to keep your details secure and use them only in accordance with data protection legislation so you can be confident they all comply with the same privacy principles. Sharing agreements are published where information is shared for specific purposes.

We may disclose information to other partners without consent where it is necessary, either to comply with a legal obligation, or where permitted under data protection legislation, e.g. where the disclosure is necessary for the purposes of the prevention and/or detection of crime.

In some cases, where we need to disclose sensitive or confidential information such as medical details to other partners, this will be done in accordance with the lawful basis as required within the legislation.

We may disclose information when necessary to prevent the risk of harm to yourself or another individual.

At no time will your information be passed to organisations for marketing or sales purposes or for any commercial use without your prior express consent.

If you wish to understand more about how your personal information may be shared, please refer to the service specific privacy notice.

Microsoft Office 365

Microsoft Office 365 is the platform used for many of the council's desktop and collaboration services. This cloud-based suite updates our previous versions of Microsoft Office and introduces new tools for a more collaborative working environment. View Microsoft's privacy information.

Processing personal information outside of the UK/EU

Your personal data is stored on our IT infrastructure and shared with our data processors, Microsoft and Amazon Web Services. It may be transferred and stored securely in the UK and European Economic Area (EEA). If your data is stored outside the UK and EEA, it will have equivalent legal protection through Model Contract Clauses.

We can share information outside of this area when there is an adequacy determination in place. The EU uses the term 'adequacy' to describe other countries, territories, sectors or international organisations that it deems to provide an 'essentially equivalent' level of data protection for people's rights and freedoms.

How your information is kept secure

The security of your personal information is important to us. This is why we follow a range of security policies and procedures to control and safeguard access to and use of your personal information.

We have multiple policies in place that define our commitments and responsibilities to your privacy and cover a range of information and technology security areas.

We also provide training to staff who handle personal information and treat it as a disciplinary matter if they misuse or do not look after your personal information properly.

Records management

We will not keep your information longer than it is needed or the law says we can. We will dispose of paper records or delete any electronic personal information in a secure way. You will be informed in the service specific privacy notice of how long your data will need to be kept prior to secure disposal.

Our Records management page provides more details of records management and information within the council.

Your information rights

Your Information Rights are set out in the law. Subject to some legal exceptions, you have the right:

• Your right of access - you have the right to ask us for copies of your personal information. This is also known as a Subject Access Request (SAR). You can make a SAR by completing the online form on our Find out what information we hold about you page.
• Your right to rectification - you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure - you have the right to ask us to erase your personal information in certain circumstances.
• Your right to restrict processing - you have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing - you have the right to object to the processing of your personal information in certain circumstances.

How your rights work depends on the legal basis for collecting and using your personal information. The following rights are modified depending on the legal basis:

Further information

If you wish to exercise your information rights, please contact the Data Protection Officer at DPO@durham.gov.uk or inforights@durham.gov.uk or alternatively write to:

DPO
Chief Executive's Services
Council Offices
Green Lane
Spennymoor
County Durham
United Kingdom
DL16 6JQ

You also have the right to request a copy of the personal information the council holds about you. To do this, you can apply online or download an application form from our Data Protection & Freedom of Information page or you can contact the data protection team at inforights@durham.gov.uk.

To learn more about these rights please see Information Commissioner's Office: Individual rights - guidance and resources. If you require general information about the Data Protection Act, information is available at Information Commissioner's Office: Individual rights - guidance and resources. Additionally, any complaints can be escalated beyond the ICO as outlined in GDPR Article 77 and GDPR Article 79.

We will provide further guidance on what information is shared with other organisations on data collection forms, privacy notices and specific service sharing agreements. You can also find further information on our service privacy notices on our Privacy notices and data protection page.

Changes to this privacy notice

We will continually review and update this privacy notice to reflect changes in our services and feedback from service users, as well as to comply with changes in the law.