The purpose of this notice is so that citizens and customers of Monmouthshire County Council are aware of their privacy rights. In this notice we will explain how we collect, use and store the data we hold about you.
Monmouthshire County Council is a Data Controller. The contact details for the Council’s Data Protection Officer are:
Data Protection and Information Manager
Digital Programme Office
What information does the Council hold about you?
The Council will collect a range of personal information from you. Common examples are:
· Contact detail, such as name, address and telephone number
· An identifier, such as a National Insurance number
· Financial information
· Information about you and your family
· Information about your health and medical conditions
· Information about criminal convictions
How do we get the information?
We sometimes collect the information from you directly, through a variety of ways such telephone calls, paper or online application forms. You may have made a complaint, or an enquiry or requested a service from us.
We may have received your information from a third party, such as another Local Authority, NHS Wales, HMRC or Welsh Government.
Your data protection rights
The GDPR and Data Protection Act 2018 affords all individuals certain ‘rights’ with regard to their personal data. Some of these will always apply regardless of why the personal information was collected. Your data protection rights are:
· You have the right of access. This right always applies regardless of the reason we collected your information. You have the right to ask for copies of your personal information unless there is an exemption. To make a subject access request please email firstname.lastname@example.org
· You have the right of rectification. This right always applies; you can tell us if your information is incomplete or inaccurate.
· You have the right to be ‘forgotten’ but you can only exercise this right to erasure in certain circumstances
· You have the right to ask us to restrict what we do with your personal information but only in certain circumstances
· You have the right to ask for your information to be provided to you in a portable format, only when you have provided the data to us and not when it relates to law enforcement
· You have the right to object to us processing your information if we have obtained your information by ‘public task’ or in our ‘legitimate interest’
· You have rights in relation to any automated decision made about you
· You have the right to make a complaint to the supervisory authority. This is the Information Commissioners Office.
· You can also make a complaint to us directly using the contact details in this notice
· If you gave us your consent you have the right to withdraw it at any time
If you want to understand your data protection rights in more detail, you can contact our designated Data Protection Officer. Alternatively, you can contact the Information Commissioner’s Office (as above).
We share your data …
We will share your information internally with our staff when we have a lawful basis to do so. For example, we may share your data captured by our customer services department with our service teams or with our internal audit department.
We will share your data with other organisations when we have a lawful basis to do so. The types of organisations we deal with regularly are HMRC, the National Fraud Initiative, the NHS, other Councils and the Welsh Government.
If we need to transfer your data outside of the EEA, we will do so only when we know your data is safe
You can make a complaint
You can make a complaint about how we handle your personal data.
If you wish to make a complaint, you can use the contact details at the top of this page.
We do routinely collect children’s information. We do this for the same reasons as we collect adult information. This is explained further in the next section below ‘legal basis for collecting your data’.
If we ask consent from a child to process and use their data, they must be 13 years old or older.
If you would like to know what information schools collect about children, please visit the school’s website.
Legal basis for collecting your data
Monmouthshire Council holds personal information about you for a variety of reasons. For example calculating your council tax or delivering key services to you and/or your family.
The GDPR requires all data to be collected using a ‘lawful basis’. Here are the lawful basis by which we will collect your data:
· We need to process your personal data to satisfy our legal obligations as the Local Authority
· We need to process your personal data to carry out a task in the public interest or in the exercise of official capacity as a public body
· We need to process your personal data to meet our contractual obligations to you
· We need to process your data as necessary, in order to protect the vital interests of the data subject or of another natural person
· We may process your data with your consent. If we do, it will be recorded and you can withdraw this at anytime
For how long will we keep your information?
We will only keep your data for as long as is necessary and in accordance with our retention schedule.
National Fraud Initiative
The National Fraud Initiative matches electronic data between public and private sector bodies to protect public funds and prevent fraud.
We will share your data using the lawful basis ‘legal obligation’.
We could potentially share your data with the Wales Audit Office, The Cabinet Office, DWP and HMRC.
Cookies Website and My Monmouthshire
For full privacy information on how we collect data on our website and use My Monmouthshire please see our Website and Cookies Privacy Notice.
More detailed privacy information
Many of our departments have written privacy notices that explain in more detail about what happens with your data and with whom it will be shared.
If you would like to see more, click the tiles below