Introduction
This document explains how Causeway Coast and Glens Borough Council obtains, holds, uses and discloses information about people (their personal data[1]), the steps we take to ensure that it is protected, and also describes the rights individuals have in regard to their personal data handled by the Council[2]. This document does not include data captured through use of Council’s website which has a separate privacy statement.

The use and disclosure of personal data is governed in the United Kingdom by the Data Protection Act 1998 (‘the Act’). The Council is registered with the Information Commissioner as a ‘data controller’ for the purposes of the Act. As such Council is obliged to ensure that Council handles all personal data in accordance with the Act.

Council takes that responsibility very seriously and takes great care to ensure that personal data is handled appropriately in order to secure and maintain individuals’ trust and confidence in the Council.

1. Why do we handle personal data?
The Causeway Coast and Glens Borough Council obtains, holds, uses and discloses personal data for two broad purposes:

1.1 The Council purpose which includes the following services areas and any duty or responsibility of the Council arising from common or statute law.

• waste collection and disposal
• recycling and waste management
• local planning functions
• civic amenity provision
• grounds maintenance
• street cleaning
• public conveniences
• food safety
• health and safety
• environmental protection
• environmental improvement
• estates management – building design and maintenance
• building control-inspection and regulation of new buildings
• dog control
• licensing, such as entertainment licensing
• enforcement byelaws such as those around litter
• sports, leisure services and recreational facilities
• parks, open spaces and playgrounds
• community centres
• arts, heritage and cultural facilities
• registration of births, deaths and marriages
• off-street parking (except park and ride)
• local economic development

Council also has a role in the following areas:

• community planning
• community development
• community safety
• sports development
• summer schemes
• tourism

1.2 The provision of services to support the Council Purpose – which include:

• Staff administration, occupational health and welfare
• Management of public relations, journalism, advertising and media
• Management of finance to and from council including payments and grants
• Internal review, accounting and auditing
• Training
• Property management
• Insurance management
• Vehicle and transport management
• Payroll and benefits management
• Management of complaints
• Management of information & communications technology systems
• Legal services
• Information provision
• Licensing and registration
• Pensioner administration
• Research, including surveys which may be carried out by an external agent on our behalf[3]
• Performance management
• Procurement
• System testing
• Security
• Health and safety management

2. Whose personal data do we handle?
In order to carry out the purposes described under section 1 above Council may obtain, use and disclose (see section 7 below) personal data relating to a wide variety of individuals including the following:

Staff including volunteers, agents, temporary and casual workers

• Suppliers
• Complainants, correspondents and enquirers
• Advisers, consultants and other professional experts
• Witnesses 
• Former and potential members of staff
• Other individuals necessarily identified in the course of Council enquiries and activity

Council will only use appropriate personal data necessary to fulfil a particular purpose or purposes. It will collect the minimum information necessary to fulfil that purpose. Anyone working for the Council may only use information which is necessary to carry out their official duties.

Personal data could be information which is held on a computer, in a paper record i.e. a file, as images, but it can also include other types of electronically held information i.e. CCTV images.

3. What types of personal data do we handle?
In order to carry out the purposes described under section 1 above the Causeway Coast and Glens Borough Council may obtain, use and disclose (see section 7 below) personal data relating to or consisting of the following:

• Personal details such as name, address and biographical details
• Family, lifestyle and social circumstances
• Education and training details
• Employment details, including performance and development
• Financial details
• Goods or services provided
• Racial or ethnic origin
• Political opinions
• Religious or other beliefs of a similar nature
• Trade union membership
• Physical or mental health or condition
• Sexual life
• Offences (including alleged offences)
• Criminal proceedings, outcomes and sentences
• Sound and visual images
• Other digital media
• Licenses or permits held
• References to manual records or files
• Information relating to health and safety
• Complaint, incident and accident details.

Causeway Coast and Glens Borough Council will only use appropriate personal data necessary to fulfil a particular purpose or purposes. Personal data could be information which is held on a computer, in a paper record i.e. a file, as images, but it can also include other types of electronically held information i.e. CCTV images.

4. Where do we obtain personal data from?
In order to carry out the purposes described under section 1 above Council may obtain personal data from a wide variety of sources, including the following:

• Central government, governmental agencies and departments
• Footage from CCTV and Body Worn Cameras
• Emergency services
• Individuals themselves
• Current, past or prospective employers of the individual
• Healthcare, social and welfare advisers or practitioners
• Education and training establishments
• Business associates and other professional advisors
• Employees and agents of Council
• Suppliers, providers of goods or services
• Persons making an enquiry or complaint
• Legal representatives
• Prosecuting authorities
• Courts
• Public Protection Multi Agency Sharing Hubs
• Auditors
• Financial organisations and advisors
• Credit reference agencies
• Survey and research organisations
• Trade, employer associations and professional bodies
• Voluntary and charitable organisations
• Ombudsmen and regulatory authorities
• The media
• Openly available information from the internet
• Data Processors working on behalf of the Council.

Council may also obtain personal data from other sources such as its own CCTV systems, or correspondence.

5. How do we handle personal data?
In order to achieve the purposes described under section 1 Council will handle personal data in accordance with the Act. In particular we will ensure that personal data is handled fairly and lawfully with appropriate justification. We will strive to ensure that any personal data used by us or on our behalf is of the highest quality in terms of accuracy, relevance, adequacy and non-excessiveness, is kept as up to date as required, is protected appropriately, and is reviewed, retained and securely destroyed when no longer required. We will also respect individuals’ rights under the Act (see section 8 below).

6. How do we ensure the security of personal data?
Council takes the security of all personal data under our control very seriously. We will comply with the relevant parts of the Act relating to security and seek to comply with the Government standards.

We will ensure that appropriate policy, training, technical and procedural measures are in place, including audit and integrity monitoring, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so, and then under strict guidelines as to what use may be made of any personal data contained within them. These procedures are continuously managed and enhanced to ensure up-to-date security.

7. Who do we disclose personal data to?
When you provide information you will be told what it will be used for and whom it will be shared with. In order to carry out the purposes described under section 1 above Council may disclose personal data to a wide variety of recipients, including those from whom personal data is obtained (as listed above) between different sections of the council and with other agencies to help reduce crime or investigate fraud.

The Council works in partnership with other agencies and local economic development stakeholders to provide business support and advice to businesses based in the Borough.  Therefore, Council will centralise business enquires and share data among other business support partners and local stakeholders, only as required.

However, the council will not supply these organisations with your information unless it is satisfied that equal measures are in place to protect the information from unauthorised access. We may also disclose to other bodies or individuals where necessary to prevent harm to individuals. Disclosures of personal data will be made on a case-by-case basis, using the personal data appropriate to a specific purpose and circumstances, and with necessary controls in place.

The council has a responsibility to work in partnership with other councils and agencies such as the Police, Fire and Rescue Service, the voluntary services and the Health Service in order to preserve life, reduce accidents, reduce crime and disorder and improve health.

Where monies are due or outstanding the council reserves the right to use all the available information at its disposal to protect public funds.

The council will also not supply your information to any organisation for marketing purposes without your prior consent.

With the exception of using bulk mail systems e.g. MailChimp and MyEmma, which includes name and email address only Council does not disclose personal data to organisations based outside of the European Union. If in exceptional legitimate circumstances, personal data is transferred to such territories outside the European Union, Council will take proper steps to ensure that it is adequately protected as required by the Act. Council periodically undertake survey through online survey systems e.g. surveymonkey. Respondents should satisfy themselves re the privacy notices associated with any third party software provider.

Council will also disclose personal data to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and by court order. This may include disclosures to the Police, HMRC, Child Maintenance Service, the National Fraud Initiative and to the Courts. Council may also disclose personal data on a discretionary basis for the purpose of, and in connection with, any legal proceedings or for obtaining legal advice.

8. What are the rights of the individuals whose personal data is handled by the Causeway Coast and Glens Borough Council?
Individuals have various rights enshrined in the Act:

8.1 Subject Access
The most commonly exercised right is that used by individuals to obtain a copy, subject to exemptions, of their personal data processed by Causeway Coast and Glens Borough Council. Details of the application process, known as a ‘Subject Access’ request is available to download.

Alternatively individuals may contact the Information Governance Officer (see section 11 below).

8.2 Right to prevent processing likely to cause damage or distress
Under Section 10 of the Act an individual is entitled, in limited circumstances, to write to Council requiring that Council do not handle their personal data in a manner that was causing or would be likely to cause unwarranted substantial damage or substantial distress to themselves or another person.

Requests under Section 10 must describe the personal data involved; describe the handling to which the individual objects; state that the handling was causing or would be likely to cause substantial damage or substantial distress to him/her or another; describe the damage or distress; state that the damage or distress was/would unwarranted; and give reasons why the handling was causing/would cause such distress and was/would be unwarranted.

All requests of this nature may be sent in writing to the Council Information Governance Officer (see section 11 below). It is worth noting that the Act includes certain provisions which may mean in a particular case Council can continue to handle the personal data as intended despite the objection.

8.3 Right to Prevent Processing for the Purposes of Direct Marketing
Although Council engages in limited direct–marketing, under Section 11 of the Act and subject to certain exemptions, an individual has the right to request in writing that Council stops within a reasonable time, or does not start, using their personal data for direct marketing purposes. This includes the communication by any means (e.g. mail, email, telephone, door-to-door canvassing) of any advertising or marketing material directed at particular individuals.

Any requests under Section 11 may be sent to the Information Governance Officer (see section 11 below).

8.4 Rights in relation to automated decision-taking

Although Council is unlikely to carry out any automated decision-taking that does not involve some human element, under Section 12 of the Act and subject to certain exemptions, an individual has the right to require that Council ensures that no decision that would significantly affect them is taken by Council or on its behalf purely using automated decision-making software. The right has to be exercised in writing. If there is a human element involved in the decision-making the right does not apply. Requests under Section 11 may be sent to the Information Governance Officer (see section 11 below).

8.5 Right to take action for compensation if the individual suffers damage by any contravention of the Act by data controllers
Under Section 13 of the Act any individual who believes they have suffered damage and / or distress as a result of any contravention of the requirements of the Act may be entitled to compensation from Council where the Council is unable to prove that it had taken such care as was reasonable in all the circumstances to comply with the relevant requirement. Any claim for compensation arising from this provision may be sent to the Legal Services, Causeway Coast and Glens Borough Council, Civic Headquarters, Cloonavin, 66 Portstewart Road, Coleraine, BT52 1EY

8.6 Right to take action to rectify, block, erase or destroy inaccurate data
Under Section 14 of the Act an individual has the right to seek a court order for the rectification, blocking, erasure or destruction of their inaccurate personal data handled by Council. The right cannot be exercised directly to Council.

8.7 Right to request the Information Commissioner to assess a data controller’s Processing
Under Section 42 of the Act any person can request the Information Commissioner to make an assessment if they believe that they are / have been adversely affected by the handling of personal data by Council. Such requests should be made direct to the Information Commissioner whose contact details can be found below.

Generally if individuals have any concerns regarding the way their personal data is handled by Council or the quality (accuracy, relevance, non-excessiveness etc.) of their personal data they are encouraged to raise them with the Council Information Governance Officer (see section 11 below).

The Information Commissioner is the independent regulator responsible for enforcing the Act and can provide useful information about the Act’s requirements. The Information Commissioner’s Office may be contacted using the following:

The Information Commissioner’s Office
Wycliffe House
Wilmslow
Cheshire. SK9 5AF
t: 0303 123 1113
w: www.ico.gov.uk

9. How long does Council retain personal data?
Causeway Coast and Glens Borough Council keeps personal data as long as is necessary for the particular purpose or purposes for which it is held and will be disposed of in a secure manner when no longer needed. The periods for retention of information are specified in the council’s Retention Schedule which was laid before the Northern Ireland Assembly in 2016.

10. Monitoring
Causeway Coast and Glens Borough Council may monitor or record and retain telephone calls, text, emails and other electronic communications to and from the Council in order to deter, prevent and detect inappropriate or criminal activity, to ensure security and to assist the purpose described under section 1 above.

11. Contact Us
Any individual with concerns over the way Causeway Coast and Glens Borough Council handles their personal data may contact the Information Governance Officer as below:

Information Governance Officer
Civic Headquarters, Cloonavin,
66 Portstewart Road,
Coleraine, BT52 1EY
t: +44 (0) 28 7034 7034
e: info@causewaycoastandglens.gov.uk
w: www.causewaycoastandglens.gov.uk

[1] ‘Personal data’ is defined under Section 1 of the Data Protection Act 1998. In practical terms it means information handled by Council that relates to identifiable living individuals. It can include intentions and expressions of opinion about the individual. The information can be held electronically or as part of paper records, and can include CCTV footage and photographs. For ease of readers this document refers to the handling, use, holding etc of personal data – Section 1 of the Act uses the term ‘processes’ to effectively cover any usage of personal data.

[2] 2 This document is designed to help satisfy the ‘Fair Processing Requirements’ as required by Schedule 1 Part 2 Paragraphs 1 to 4 of the Data Protection Act 1998 and may be regarded as a generic over-arching ‘Fair Processing Notice’ for Council. . Additional more specific Fair Processing Notices may appear in other circumstances such as on forms, policies, correspondence, or CCTV signage.

[3] Council is required to conduct Customer Satisfaction Surveys to evaluate our performance and effectiveness. We may contact individuals, such as services users, or those reporting complaints, and ask them to give us their opinion of the service we are providing to the public. We use the information given to improve our services wherever we can. Council like many local authorities, use a private company to undertake such surveys on our behalf with strict controls to protect the personal data of those involved.