Privacy statement
The council is committed to protecting and respecting your privacy. Through this privacy notice we have sought to be as transparent as possible to fully explain how your personal information is held and processed. This notice explains how we collect, use and share your information and how we keep it and how we keep it secure.
This privacy notice also explains when and why we collect personal information about people who engage or come into contact with us, whether via applying or receiving our services, living or visiting the borough or our website. In addition to this privacy notice some services have their own dedicated privacy notice to tell people in more detail how they use your information and the legal basis for using the information.
What information do we collect about you?
We collect information about you when you register with us, contact us or use our services.
The information we collect may include your:
- contact details (including name, title, address, email address and telephone number)
- date of birth
- gender
- UK/EU/EEA residency details
- proof of identity
- national identifiers (including NHS number and NI number)
- Information about your family
- IP address and information regarding what pages are accessed and when
- lifestyle, social and personal circumstances
- financial details for purposes of receiving or making payments
- employment details(when you apply for jobs)
- education records
- next of kin information
- signature
- housing information relating your council tenancy
- visual images, personal appearance and behaviour
- licenses or permits
- business activities
- voice recording
- the services you receive
- Council data is shared for election register purposes as required by law
- video recordings at public meetings
- telephone call recordings
We may also record and monitor telephone calls to our Contact Centre for quality and training purposes and also collect information when you voluntarily complete customer surveys and provide feedback.
We may also collect sensitive personal data that may include:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- health or sex life and sexual orientation data
- criminal convictions and offences (including alleged)
From May 2018, genetic data and biometric data will be treated as sensitive personal data.
Why we need your information?
We need your personal data in order to provide you with council services that you apply for or receive from us and also where we are required to use information in order to meet our statutory obligations. We will only collect personal data that is absolutely necessary and any information we collect about you will be strictly in accordance with the data protection law and other statutory obligations which we are bound by.
In general we will use your information to:
- fulfil our legal duties and obligations (including safeguarding children)
- provide efficient and effective services
- help you access the right services
- collect debts
- prevent, detect and prosecute fraud, corruption or other crimes
- personalise repeat visits to our website
- deliver national government programmes and initiatives.
We process your information for the following services:
- Council tax
- business rates
- housing benefits
- social housing needs
- parking permit
- blue badge
- adults and childrens social care services
- planning applications
- building control applications
- licensing
- landlords Licensing
- voting and elections
- school admissions and education services
- youth services
- birth, marriages and deaths
- employment
- health and wellbeing
- bins, recycling and waste collection
- crime and public safety
- Housing Benefit
- Discretionary Housing Payments
- Council Tax and the Council Tax Reduction Scheme (CTRS)
- Business Rates
- Local Social welfare Schemes
- Environmental enforcement
- To manage your queries and complaints
To do so we may share your information between services and with other organisations, including:
- government departments, agencies and other public bodies
- other local authorities
- our subsidiary companies
- housing associations
- schools
- charities and voluntary organisations
- third party service providers.
Who your information may be shared with
The council has statutory obligations to collect, process and share personal information without consent, with our partners such as the NHS, housing associations, schools, central government, such as DWP, HMRC, Home Office, Dept. Of Education, Dept. of Health, other councils and law enforcement agencies such as the Police and the Crown prosecution service, for the following purposes:
- health and wellbeing and public health
- safeguarding of vulnerable adults and children
- the prevention and detection of crime
- the assessment of any tax or duty
- collection of debt
- if we are required to do so by any court or law
- prevention of fraud
- the national fraud initiative
- protect you or other individuals from serious harm
- protect public funds
- public safety and law enforcement
- criminal or civil prosecution of offenders
- national security
To ensure that the council provides you with an efficient and effective service we will sometimes need to share your information between teams within the council. We may need to share your personal details, and the circumstances of any query or complaint you have made between teams within the council in order to allow the Council to look into the issue. We may also need to share your personal details with other organisations to investigate and resolve your query or complaint.
We may also share your information with our partners to deliver national government programmes and initiatives such as the Troubled Families programme, or improving services we deliver, or provide the services you agreed to receive.
We may share with:
- NHS (GPs, Hospital, Mental Health, CCGs etc.)
- schools
- voluntary sectors
- central government
- other councils
- housing associations
In most cases this will be done where there is a lawful basis under the conditions set out in data protection laws. We may also share your information with third party service providers working on our behalf for the purposes of completing tasks and providing services to you on our behalf (for example; domiciliary care providers). However, when we use third party service providers, we disclose only personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure, as required by the Data Protection Act 1998 and General Data Protection Regulation 2016 (GDPR), and not to use it for any other purposes.
We will never use or share your personal information to third parties for marketing purposes without your permission.
We may share some of your information, for example your name and address, internally with other departments in the Council if this:
- helps you to access services more easily
- promotes the more efficient and cost effective delivery of services
- helps recover monies owed to the council
We match Council Tax data with Electoral Registration records
We are required by law to participate in National Fraud Initiative (NFI) data matching exercises. Council Tax information may be provided to the Audit Commission for NFI purposes and will be used for cross-system and cross-authority comparison for fraud prevention and detection.
We will also share our data with companies who undertake data matching exercises for Single Person Discount, this is to identify discrepancies. We share our data through LOCTA - the Local Authority Council Tax data sharing hub, who locate debtors who no longer reside in the council. For some debts, we also use external bailiff collection. We use an external provider to process our online claims and to identify changes in circumstances.
Lawful basis to process your information
The council must have a lawful basis for processing your information. In most cases the information will be collected and used where we have statutory obligations to collect, use or share your information; in those instances we have a public interest basis for processing your information. In some instances the services we provide are optional, which means that the council will only provide the service if the customer has requested the service or the customer consents to the service. In that instance, consenting to the service does not necessarily mean that the lawful basis for processing your information is consent; the council may rely on the public interest basis where it has specific powers to provide the service.
Where your consent is required to process your information we will seek your consent. However, where your consent is not required to process your information, for example the council has a lawful basis for processing your information, your consent will not be sought. Where we need to disclose sensitive or confidential information such as medical details to other partners, we will do so only with your prior explicit consent unless we are legally entitled to share the data.
The council may also process your information where processing is necessary for the performance of a contract and where processing is necessary to protect your vital interest or the vital interest of another person. The council may also process your information where we are obliged to process your information to comply with the law.
We have statutory authority to collect and process your personal information for the provision of our service, your consent therefore is not required to process your information. Where the service is optional, we will not process your information until you have consented to receive the service. Once we have your consent for the service, your information will be processed under our statutory authority to provide the service.
How long we keep your information
We review our retention periods of the information we hold about you on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations. We will hold your personal information on our systems for as long as it is necessary for the relevant activity or service that we provide to you, or as required by law.
We will retain your information for the period in which your information is being used for service provision or for our wider functions including debt collection. We have legal authority to process your information; your right to be forgotten does not apply to our functions and services
Call recording
For the purpose of training and security calls to and from our contact centres are recorded.
How to contact us
Please contact us if you have any questions about our privacy policy or information we hold about you by email or write to us at:
Data Protection Officer,
Digital and IT,
London Borough of Sutton
Civic Offices, St. Nicholas Way,
Sutton SM1 1EA.
If you would like to know more about your rights under the Data Protection law, and what you should expect from us, visit the ICOs website.