Privacy notices

Redcar and Cleveland Borough Council privacy notices.

Guide contents

Information Governance and Data Protection

This Privacy Notice is designed to help you understand how and why the Information Governance and Data Protection Team processes your personal data. This notice should be read in conjunction with the Council’s Corporate Privacy Notice.

Who are we? 

Redcar and Cleveland Borough Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR). The Information Governance and Data Protection Team supports the Council in managing information lawfully, securely and responsibly. 

The Team provides advice on data protection, information governance and records management; handles requests from individuals exercising their information rights; responds to information incidents and complaints; and supports Council services to create, manage, retain and securely dispose of records in accordance with relevant legislation, Council policies and good practice.

What personal information do we collect?

Dependant on the type of request, we will process the following information:

  • Name
  • Contact details (email address, phone number, postal address)
  • Type of requestor and organisation 
  • Confirmation of identity (for example, copies of documents such as passport, driving licence or other forms of accepted ID)
  • Forms of authorisation
  • CCTV footage
  • Personal data, including sensitive personal information, collated in the process of dealing with requests. 

Why do we collect your personal information? 

We may collect your personal information when we process:

  • Freedom of Information Act 2000 and Environmental Information Regulations 2004 requests. 
  • Requests from individuals exercising their rights under the Data Protection Act 2018 and UK GDPR. This includes subject access requests, CCTV footage requests, rectification requests, erasure requests or objects. 
  • Re-use of Public Sector Information 2015 requests
  • Information held in connection with personal data breaches
  • Third-party requests for information made under the provisions of the GDPR. 

We may also process your personal data to:

  • Respond to a request or a complaint 
  • To respond to the Information Commissioner's Office when dealing with complaints or investigations made under their regulatory powers. 
  • To help us assess the effectiveness of our services and to plan and improve future services. 
  • To review and securely dispose of information that has reached its retention period. 

Who do we obtain your information from?

We collect personal information from your directly (such as via our online request form, email or post) or from third parties either making a request on your behalf or requesting information under the provisions of the Data Protection Act 2018 and UK GDPR. We may also obtain your information from other council services when collating information for subject access or third party requests. 

Who do we share this information with?

Your information may be obtained from and shared with, the following organisations/services as necessary to deal with your request:

  • Other internal council services
  • The Information Commissioner’s Office (ICO)
  • Third parties that you have authorised to represent you 
  • Third parties where there is a legal basis to share information. This may include other local authorities, Police, Government departments, Solicitors, insurance companies, utility companies, Coroners Office, NHS and other health services. 

How long do we keep your information for?

Information is kept in line with the Council’s Retention Schedule and destroyed securely when no longer needed. 

Data held Retention period
Third-party requests made under Data Protection Act 2018 and UK GDPR 2 years 
Information Rights Requests, including subject access requests 3 years
Identification documents  6 months
Freedom of Information and Environmental Information Regulation requests 2 years 
Personal Data Breaches 6 years 
Data Protection Complaints 6 years 

What is our lawful basis for processing your information?

Redcar and Cleveland Borough Council relies on the following lawful basis to process your personal data:

  • UK GDPR Article 6(1)(c) Legal obligation: the processing is necessary for us to comply with the law
  • UK GDPR Article 6 (1) (e) - processing is necessary for the performance of a task carried out in the public interestUK GDPR Article 9(2)(g) – processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
    •  (6) Statutory and government purposes

The legislations, policies and guidance that relate to this service includes, but is not limited to:

  • Freedom of Information Act 2000
  • Environmental Information Regulations 2004
  • Data Protection Act 2018
  • UK General Data Protection Regulation (UK GDPR)
  • Re-use of Public Sector Information 2015

Your Rights

  • You have a number of rights that you may exercise in relation to your personal data. Some of the rights do not apply automatically and may not be available in certain circumstances where a lawful exception applies. 
  • You have a right to access your personal data. You can request a copy of personal data that we hold about you and ask us to explain how we use your data. 
  • You have a right to object to processing of your personal data. You have an absolute right to stop your data being used for direct marketing. In other cases where the right to object applies, we may be able to continue using your data if we have a compelling reason for doing so. 

If we are relying on consent as the lawful basis to process your data you can withdraw your consent at any time, and we will stop further processing. 

  • You have a right to request the restriction or suppression of your personal data. 
  • You have a right to have your personal data erased, if we no longer have a legitimate use for it. This right is sometimes called the ‘right to be forgotten’. 
  • You have a right to rectification of your personal data if the information we hold in relation to you is inaccurate or incomplete. 
  • You have a right not to be subject to any decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. You can request human intervention or challenge any solely automated decision-making that significantly affects you. 

The Council has appointed a Data Protection Officer. Their contact details are:

Data Protection Officer

Redcar and Cleveland House

Kirkleatham Street

Redcar

TS10 1RT 

You can contact the team by emailing InformationGovernance@redcar-cleveland.gov.uk or by calling 01642 774774.

If you would like to request access to your personal data or exercise any of your other data protection rights, please contact the Information Governance Team:

Information Governance 

Redcar and Cleveland Borough Council

Redcar and Cleveland House

Kirkleatham Street

Redcar

TS10 1RT 

Email: InformationGovernance@redcar-cleveland.gov.uk 

Telephone: 01642 774 774 

You can seek advice and have the right to make a complaint to the Information Commissioner’s Office (ICO). The ICO is an independent body set up to uphold information rights in the UK. You can contact them through the ICO website www.ico.org.uk, their helpline on 0303 123 1113, or in writing to:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF 

For more information about how the Council uses your data, including your privacy rights and the complaints process, please see our Corporate Privacy Notice.