Middlesbrough Council is committed to protecting your privacy when you use our services.
The Privacy Notice below explains how we use information about you and how we protect your privacy.
You will see on this web page a list of other privacy notices for each of the services we provide. These will give you more information about how we use your information should you use these services, who we may share information with and why.
We have a Data Protection Officer who makes sure we respect your rights and follow the law. If you have any concerns or questions about how we look after your personal information you can speak to them, their contact details are at the end of this notice and at the end of each services notice.
What type of personal data do we collect and how do we collect it?
Do you know what personal information is?
Personal information can be anything that identifies and relates to a living person. This can include information that when put together with other information can then identify a person. For example, this could be your name and contact details.
What type of personal data do we collect
We will collect information about you when you request or receive a service, we also collect information from people who contact us requesting information about Middlesbrough, the Council, or themselves.
This information can include your name, address, email address, telephone number and other contact information that allow us to meet our organisational and statutory obligations to you.
How we collect your personal data
We can collect your data in multiple ways, including:
- online forms
- website cookies
- other forms of image and voice recordings
This data can be collected directly from you or may be gathered from other sources, we may also need to ask other agencies or organisations for relevant data about you in order to fulfil our legal responsibilities or provide services.
Did you know some of your personal information might be ‘special’?
Some information is ‘special’ and needs more protection due to its sensitivity. It’s often information you would not want widely known and is very personal to you. This is likely to include anything that can reveal your:
- sexuality or sexual health
- religious or philosophical beliefs
- physical or mental health
- Trade Union membership
- political opinion
- genetic/biometric data
- criminal history
How the law allows us to use your personal information
There are a number of legal reasons why we need to collect and use your personal information.
The privacy notice from each service explains which legal reasons are being used.
- you, or your legal representative, have given consent
- you have entered into a contract with us
- it is necessary to perform our statutory duties
- it is necessary to protect someone in an emergency
- it is required by law
- it is necessary for employment purposes
- it is necessary to deliver health or social care services
- you have made your information publicly available
- it is necessary for legal cases
- it is to the benefit of society as a whole
- it is necessary to protect public health
- it is necessary for archiving, research, or statistical purposes
- it is in our legitimate interests
If we have relied on consent to use your personal information, you have the right to remove it at any time. If you want to remove your consent, please contact our Data Protection Officer and tell us which service you’re using so we can deal with your request.
Where withdrawal of consent will have an impact on the services we are able to provide, this will be explained to you, so that you can determine whether it is the right decision for you.
If we have relied on legitimate interests to use your personal information, we will only do this where we do not have an existing legal duty or power covering the specific service that we are providing. Before using legitimate interest, we will first carry out an assessment to check that it is necessary and there is an appropriate balance between our interests and your rights.
What is your personal data used for
When we collect personal data from you we will use it to provide you with services you have requested or require. We will not collect data from you that we do not need.
We will use the information you provide in order to:
- deliver our services – see our Statement of Public Task for further details
- maintain and update your customer records or contact details
- contact you where necessary
- obtain your opinion and feedback about the services we provide
- ensure that we fulfil our legal obligations
It may not always be possible to provide you with a services if you do not provide us with the information required to do so.
Will your personal data be shared
Where necessary we may share your information with other organisations and partners that provide services on our behalf. When this happens, the information provided is only the minimum necessary for them to provide that service to you. These organisations are required to keep your information safe and only use to provide a service to you.
The Council is also required by law to protect the public funds from fraud. More information is available from the National Fraud Initiative website.
How do we keep your personal data secure
Under the General Data Protection Regulations (GDPR) we have a legal duty to protect any information that we hold about you. We take measures to safeguard your data and implement security standards and controls to prevent any unauthorised access to it. Information which you have provided the council will be stored securely. It will only be used for the purpose(s) stated when the information was collected.
How long will we keep your personal data
The amount of time data is kept before being disposed of will vary depending on why it was collected, how it is used, and in line with any applicable UK laws. Our retention and disposal schedule gives details about how long we keep data. This information will also be available from individual services own Privacy Notices.
Is your personal data processed overseas
The Council will only process your information overseas where the country it is transferred to has adequate data protection measures in place or where the suppliers are bound by model contract security clauses or where the supplier has signed up to an approved certification scheme or where requested by an external organisation under a legal requirement or at your request.
We will only send you information about our services and/or products if you have agreed for us to do so or we are sending you information in relation to similar services you have received in the past. You can opt out of this at any time by letting us know by unsubscribing or replying with your request.
What are your information rights
You have the right to be given information about how and why we process your personal information. Where you have a choice about how your information will be used, we will ask you for consent. Where you do not have a choice (for example, because we have a legal obligation to process the data), we will provide you with a privacy notice. A privacy notice is a statement that explains how we use personal your information.
You have the right to be told whether we are processing your personal information and, if so, to be given the following information:
- the purposes of the processing;
- the categories of personal data concerned;
- who the information has been, or will be, disclosed to;
- how long the information will be kept for, or, if not possible, the criteria that will be used to determine the retention period;
- details of how to request that the Council corrects or deletes your information;
- details of how to object to the way the Council uses your information;
- how to make a complaint to the Information Commissioner’s Office;
- where the information came from, if it did not come directly from you; and
- whether any automated decision-making was involved and, if so, the logic and significance behind it.
Access to your information
You also have a right to be given a copy of the information. This is known as the right of subject access. Details on how to start this process are below.
Right to Rectification
If you believe that information we hold about you is inaccurate, you can contact us and let us know and we will try to put it right. You can also request that we complete any incomplete data. Once we have determined what we are going to do to rectify the data, we will contact you to let you know.
Right to Erasure
You can ask us to erase your personal data in the following circumstances:
- We no longer need the personal data for the purpose it was originally collected;
- You withdraw your consent and there is no other legal basis for the processing;
- You object to the processing and there are no overriding legitimate grounds for the processing;
- The personal data have been unlawfully processed;
- The personal data have to be erased for compliance with a legal obligation; and
- The personal data have been collected in relation to the offer of information society services (information society services are online services such as banking or social media sites).
- Once we have determined whether we are going to erase the data, we will contact you to let you know.
Right to restriction of processing
You can ask us to restrict the processing of your information in the following circumstances:
- You believe that the information is inaccurate and you want us to restrict processing until we determine whether it is indeed inaccurate;
- The processing is unlawful and you want us to restrict processing rather than erase it;
- We no longer need the information for the purpose we originally collected it but you need it in order to establish, exercise or defend a legal claim; and
- You have objected to the processing and you want us to restrict processing until we determine whether our legitimate interests in processing the data override your objection.
Once we have determined how we propose to restrict processing of the data, we will contact you to discuss and agree this with you. We will communicate this to anyone we have disclosed your personal data to, unless this proves impossible or would involve disproportionate effort.
The request to exercise the above rights can be done verbally or in writing. However, to handle your request more effectively, please complete the Exercise of Rights request form.
How to request a copy of your personal information (Subject Access Request)
Under the General Data Protection Regulation 2016 / Data Protection Act 2018 an individual has the right to request a copy of the information that Middlesbrough Council holds about them by making a Subject Access Request (SAR).
The request can be made verbally or in writing. However, to help us find and retrieve your information, please complete the Subject Access Request form providing as much detail as possible about the information you would like to access. The more specific you can be about the information you want to access, the quicker we will be able to provide you it, eg if you tell us that you would like one specific document from your case file, it will be much quicker than providing your entire case file.
When making your request, please specify what format you want to receive it in - electronic or hard copy.
Middlesbrough Council has a responsibility to verify the identity of the individual making the request, therefore please provide two forms of ID, one of which should be a Personal Identity Document, eg a passport or driving license and the other to show that you are ‘active in the community’, eg a utility bill or Council Tax bill.
There are two ways to complete the form:
- complete the Subject Access Request form electronically and return by email to firstname.lastname@example.org
- print, complete and return the Subject Access Request form by post to: Information Requests Team, Civic Centre, Middlesbrough, PO BOX 500, TS1 9FT
Should your request be for CCTV footage, a list of all the council’s CCTV camera locations is available on the Security and Surveillance page of the Council website. All data from the CCTV system is stored for a maximum of 28 days. If your request is for any of your personal data captured by the council’s CCTV systems:
- complete the Subject Access Request form electronically and return by email to email@example.com
- print, complete and return the Subject Access Request form by post to: CCTV Unit, Middlesbrough Bus Station, Middlesbrough, TS1 5EA
Please make sure you send your form to the right address, as listed above.
The Council will aim to respond to SARs without undue delay and within one month of receipt of the request. If the request is complex then the Council may need to extend this by up to two further months where necessary. If we do this we will always inform you and provide the reasons for the delay.
Please note that Middlesbrough Council cannot guarantee that the contents of your email will be safe in transit.
Disclosure of information for crime, taxation, or legal purposes
As allowed by exemptions in the Data Protection Act 2018, Middlesbrough Council may disclose personal information upon request for crime and taxation purposes (Schedule 2, Part 1, Paragraph 2 exemption), or in connection with legal proceedings (Schedule 2, Part 1, Paragraph 5 exemption). Please note that we are not obliged to comply with such requests, but will consider requests on a case by case basis in line with the requirements of the Act.
If you require disclosure of information under these exemptions, the request for disclosure form must be completed in full and returned to the Data Protection Team via email at firstname.lastname@example.org or the address above.
Making a complaint
If you have a concerns about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner's Office. Visit the website of the Information Commissioner's Office.
If you would like to discuss anything in this privacy notice, please contact
Data Protection Officer
PO Box 500, Middlesbrough, TS1 9FT
Phone: 01642 245432
Last updated: 03/02/2020