CoPilot Privacy Notice
This notice should be read in conjunction with the Council’s Corporate Privacy Notice.
Who are we?
Redcar and Cleveland Borough Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR). The Council is using Microsoft 365 Copilot to enhance staff productivity and efficiency. Microsoft acts solely as a Data Processor, with the Council acting as the Data Controller.
What is Microsoft 365 Copilot?
Copilot is artificial intelligence (AI) software. Copilot uses large language models (LLMs) that uses deep learning techniques to understand, summarise, predict and generate content. Copilot works with everyday software that many staff use at work such as Microsoft Word, Excel, Outlook and Teams.
How we use Microsoft 365 Copilot
The Council uses Copilot to enhance staff productivity and efficiency. For example,
- Meetings: Copilot assists with meetings by taking minutes, producing summaries and actions, and helping staff catch up on missed meetings.
- Writing: Copilot helps with writing documents and emails, such as suggesting ways to word something, helping to create drafts and formatting documents.
- Summarising: Copilot is used to summarise the content of documents or emails and highlighting key themes or messages.
- Presentations: Copilot is used to speed up the time it takes to create presentations.
- Data Analysis: Copilot is used to analyse and visualise data, identify trends and creating reports or graphs.
How we use data
The Council’s data, used with Copilot, is stored within our secure Microsoft tenant, which is held within the UK. The data is under the control of the Council and is not used to train or improve Microsoft or other third party AI models.
We may process personal data when our staff use Copilot to help them do their job and to support the Council in delivering its services. For example, if a staff member uses Copilot to help draft a response to a resident’s enquiry, the tool may process the resident name, contact details and the nature of their enquiry, based on the information the Council already holds.
CoPilot combines user prompts with Council data already accessible to the user to help staff carry out their work. Where the Council uses resident or service user personal data with Copilot, we rely on the original lawful basis under which the data was collected and in line with service specific privacy notices.
Where Copilot is used to assist the Council with meetings, we may collect video recording or transcripts of conversations. These are used for the purposes of accurate minute taking and deleted when no longer required, in line with our retention schedule.
The use of Copilot is to enhance staff productivity and efficiency, and it will not be used to make decisions about staff, residents or service users. Copilot may generate inaccurate (hallucinations) or incomplete information. Any content generated by Copilot is always reviewed by staff to make sure it is accurate, appropriate and in line with Council policies.
We recognise that the potential uses of Copilot may evolve over time. Any new applications will be carefully considered and align with our commitment to data privacy and security.
How long we retain personal data
Copilot is used as a tool to support staff in completing their wok, such as drafting documents or summarising information. Any personal data processed by Copilot is retained only as long as necessary for the task it supports. Where Copilot is used to help create a document, email or report, the final version is saved and kept in line with the Council’s normal retention policies. Temporary draft or AI-generated suggestions are not kept unless they form part of the final record.
Your Rights
You have a number of rights that you may exercise in relation to your personal data. Some of the rights do not apply automatically and may not be available in certain circumstances where a lawful exception applies.
- You have a right to access your personal data. You can request a copy of personal data that we hold about you and ask us to explain how we use your data.
- You have a right to object to processing of your personal data. You have an absolute right to stop your data being used for direct marketing. In other cases where the right to object applies, we may be able to continue using your data if we have a compelling reason for doing so.
If we are relying on consent as the lawful basis to process your data you can withdraw your consent at any time, and we will stop further processing.
- You have a right to request the restriction or suppression of your personal data.
- You have a right to have your personal data erased, if we no longer have a legitimate use for it. This right is sometimes called the ‘right to be forgotten’.
- You have a right to rectification of your personal data if the information we hold in relation to you is inaccurate or incomplete.
- You have a right not to be subject to any decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. You can request human intervention or challenge any solely automated decision-making that significantly affects you.
The Council has appointed a Data Protection Officer. Their contact details are:
Data Protection Officer
Redcar and Cleveland House
Kirkleatham Street
Redcar
TS10 1RT
You can contact the team by emailing InformationGovernance@redcar-cleveland.gov.uk or by calling 01642 774774.
If you would like to request access to your personal data or exercise any of your other data protection rights, please contact the Information Governance Team:
Information Governance
Redcar and Cleveland Borough Council
Redcar and Cleveland House
Kirkleatham Street
Redcar
TS10 1RT
Email: InformationGovernance@redcar-cleveland.gov.uk
Telephone: 01642 774 774
You can seek advice and have the right to make a complaint to the Information Commissioner’s Office (ICO). The ICO is an independent body set up to uphold information rights in the UK. You can contact them through the ICO website www.ico.org.uk, their helpline on 0303 123 1113, or in writing to:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
For more information about how the Council uses your data, including your privacy rights and the complaints process, please see our Corporate Privacy Notice.