Information Management Privacy Notice
Information management is the monitoring of the council’s compliance with data protection legislation. This includes the General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA), the Freedom of Information Act 2000 (FOIA) and Environmental Information Regulations 2004 (EIR).
Data Controllers
City of Lincoln Council are the controllers of your personal data for the purposes of Information management. We sometimes also act as joint controllers in respect of certain types of data and residents for example with North Kesteven District Council in relation to our Shared Revenues and Benefits Service.
What we use your personal data for
Personal data is needed for the processing of Data Subject Access Requests to access your own personal data and other information requests under the DPA.
Personal data may also be used in data breach investigations/records, complaints relating to the processing of personal data, auditing for the purposes of performance monitoring and in Freedom of Information requests under FOIA.
Our lawful basis for processing the personal data
We must have a legal basis to process your personal data. Where we use personal data for the purposes for Information management, the sections of the law that most commonly apply are:
GDPR Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the council is subject
GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the council
For special category data which is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (for example voice recordings) when processed uniquely to identify a person, data concerning health or a person’s sex life or sexual orientation:
GDPR Article 9(2)(g) – processing is necessary for reasons of substantial public interest, on the basis of UK law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide suitable and specific measures to safeguard the fundamental rights and interests of the data subject.
Who will we share your personal data with?
Data will be shared internally within the council and with contractors acting on behalf of the council. Where necessary and legally permitted personal data may also be shared with the UK regulator of information rights the Information Commissioner’s Office, the Local Government Ombudsman, the Police and other law enforcement agencies, fraud agencies, Court services, Department of Work and Pensions, HMRC, utility companies and other relevant government/local authority departments.
Using your personal information for other purposes
We will not process your personal data for any other purpose than that for which it was collected, unless any secondary purpose is fully compatible with this original purpose. This is except were we are required to disclose your personal data in accordance with legislation for example in relation to the prevention and detection of crime, counter terrorism, safeguarding, legal proceedings or to protect interests of you or another.
Transfers of personal data to a third country
Data is not routinely transferred to a third country (outside of Europe) but it is possible where a contractor is acting on behalf of the council. In these circumstances contractual safeguards would be made to ensure the safety of your personal data.
How long we will retain your personal data for
Data held for the purposes of Data Subject Access requests, other information requests under DPA and Freedom of Information requests will be kept for two years following completion of the case.
Any other data will be held for six years from completion of the case in accordance with the Limitation Act 1980.
What are my rights in relation to my personal data?
You have the right to access the personal data we hold about you; to request we rectify or erase your personal data; to object to or restrict processing in certain circumstances; and a right of data portability in certain circumstances.
For further information on your rights and how to make a Data Subject Access Request see the council’s website page ‘Data protection and Privacy notice’ at lincoln.gov.uk/privacy-policy
Who do I contact to obtain further information or to make a complaint?
If you want to know more about your rights relating to the personal data we hold about you or you have a complaint regarding the way we have handled your personal data, please contact our Data Protection Officer at:
Lincoln City Council, City Hall, Beaumont Fee, LN1 1DD, Telephone 01522 881 188 or email dpo@lincoln.gov.uk
If however you remain unhappy, then you have a right to complain to the Information Commissioner at:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5A
Telephone: 0303 123 1113 or visit ico.org.uk or email casework@ico.org.uk