Fair Processing Notice

Council's Response to Data Sharing in Response to Coronavirus (COVID-19)

In accordance with government order we will be sharing personal data with the NHS, public health and other relevant responsible public and third sector bodies to help our response to Covid-19. The council remains committed to maintain high standards in its use of personal data. The council also recognises that sharing personal data in a timely way is critical to protecting those deemed vulnerable, by ensuring it can work with its partners and individuals across the public, voluntary and private sectors. 

Data protection legislation does not prevent the council from utilizing information it already holds, as well as collecting new information to share with agencies in its response to the emergency. The council will assess the risks and the potential harm that may arise if it does not share information. The information we agree to share will take into account proportionality and necessity. The council will be accountable in its sharing by ensuring that our decisions are recorded and where necessary signed off at a senior level. The council will continue to share information using the most appropriate and secure methods.

Introduction

As a Local Authority the Royal Borough Kensington and Chelsea collects, holds and processes a considerable amount of information, including personal information about residents, people it provides services to, and other people. It does this to provide its services in the most effective and efficient way that it can.

The Council recognises that it has a duty to people whose information it holds to treat that information responsibly, keep it safe and secure, and process it correctly and proportionately. This Fair Processing Notice broadly explains what information we collect, the purpose for processing, categories of personal information and who we may share it with.

To understand how your own personal information is processed you may need to refer to any personal communications you have received, check any privacy notices the Council has provided or contact the department directly to ask about your personal circumstances. 

Identity and Contact Details

The Royal Borough Kensington and Chelsea are registered as a Data Controller under the General Data Protection Regulation and Data Protection Act 2018. Our contact details are:

Data Protection Officer 

Bi-borough Legal Services

Royal Borough of Kensington and Chelsea

Town Hall

Hornton Street

London W8 7NX

Email: [email protected].

How we collect your information

In order to fulfil our functions as a Local Authority, as well as pursue other lawful/legitimate interests on behalf of our residents and service users we collect information about individuals in a number of ways, for example, by letter, email, face-to-face, telephone, online forms, social media and through referrals made by third parties, and other key stakeholders acting jointly or on behalf of the Council.

Purpose for processing your information

We may collect personal data about you which covers basic details such as name, address, telephone number, and date of birth. We also collect some sensitive information also known as special category data, such as health data, ethnicity or religious beliefs - but only where it is needed to provide a service, fulfil a legal obligation and/or for monitoring equality of both for customers and employees. We will always explain to you why and how this information will be used. We will always demonstrate to you what our lawful basis is for processing this type of information and where appropriate seek your consent. 

As described above we collect and process information about you, so that we can carry out our public task functions as a Local Authority and to deliver public services. This includes but is not limited to:

• administering the assessment and collection of taxes and other revenue including benefits and grants
• the provision of social services and education
• the provision of all commercial services including the administration and enforcement of parking regulations and restrictions 
• the provision of all non-commercial activities including refuse collections from residential properties 
• local and national fraud initiatives and data matching under these initiatives
• to prevent and detect fraud or crime and prosecution offenders including the use of CCTV
• licensing and regulatory activities
• providing leisure and cultural services 
• carrying out health and public awareness campaigns 
• managing our property
• maintaining our own accounts and records
• supporting and managing our employees
• promoting the services we provide
• marketing our local tourism
• carrying out surveys
• undertaking research (including research relating to health) 
• internal financial support and corporate functions
• managing archived records for historical and research reasons
• corporate administration and all activities we are required to carry out as a data controller and public authority 

We collect and process the following categories of personal information:

• Personal and family details
• Lifestyle and social circumstances
• Goods and services
• Financial details
• Employment and education details
• Housing needs
• Visual images, personal appearance and behaviour
• Licenses or permits held
• Student and pupil records
• Business activities
• Case file information

In some circumstances we also collect and process special categories and conviction data. This type of personal information includes:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data, biometric data for the purpose of uniquely identifying a person
• Data concerning health
• Data concerning a person’s sex life or sexual orientation

Conviction Data

This type of personal data covers criminal allegations, proceedings or convictions and security measures.  For the council this is likely to be collected where the focus is on:  specific employment requirements; fraud investigations; safeguarding issues; equality initiatives; or the vital interests of the data subject or other individuals. 

For more information on the council’s GDPR commitment on how this type of information is processed please see our Appropriate Policy on the Processing Special Category Data page.

Collecting your personal information will always be for a specified purpose or set of related purposes. However if we intend to use it for any other new purposes we will normally ask you first. For instance in some cases, the Council may wish to use your information for improving and developing its services, or to prevent and/or detect fraud. Where practicable and reasonable we will always seek to inform you of any significant proposed changes to how we process or intend to process your personal data, in order to ensure full transparency over how we handle your information. This can be achieved either at the corporate or service level, i.e. whichever is relevant for notifying you of significant changes or where it necessitates obtaining your consent to the processing.

The Royal Borough of Kensington and Chelsea’s commitments under the GDPR and UK Data Protection Act 2018

The Royal Borough of Kensington and Chelsea's commitment will be to ensure that the data is:

• processed lawfully, fairly and in a transparent manner.
• collected for a specific and legitimate purpose. It will not be used for anything other than this stated purpose.
• relevant and limited to whatever the requirements are for which they are processed.
• accurate, and where necessary, kept up to date.  Any identified inaccuracies will be amended or removed without undue delay.
• stored for as long as required, as specified on our records retention policy.
• secured with appropriate solutions, which protect the data against unauthorised or unlawful processing and against accidental loss, destruction or damage. 

The Council will demonstrate its compliance with these principles.

The Royal Borough ofKensington and Chelsea commitment to processing personal data lawfully

The Council will ensure that it meets the conditions necessary for processing personal data lawfully and will ensure this is adequately recorded. There are a number of ways that processing can be lawful. Consent is one method, but it is important to know that consent is not always required and the Council can lawfully process personal data as long as a condition is met. For example, the Council would be unlikely to collect Council Tax arrears if residents could withdraw their consent for processing their data for this. You can find out more about the conditions on the ICO website.

Who we may share your information

We will sometimes need to share information between Council departments, services and elected Members, as well as other organisations such as our partners, third party contractors, government bodies, the police, health and social care organisations, housing associations, landlords and educational establishments.

We will only share information where it is appropriate and legal to do so. We may also share information, for example, if there is a risk of serious harm or threat to life, for the prevention and detection of fraud or crime, assessment of any tax or duty or if we are required to do so by any court or law.  Where this is necessary, we are required to comply with all aspects of the data protection laws.

Details for Transfers

It may sometimes be necessary to transfer personal information overseas. When this is needed, information may be transferred to countries or territories around the world. Any transfers made will be in full compliance with all aspects of the UK Data Protection Act 2018.

How long do we keep your information?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

We may also anonymise some personal data you provide to us to ensure that you cannot be identified and use this data to allow the Council to effectively target and plan the provision of services.

Your Rights and Access to your information

You have the right to request a copy of the information that we hold about you.

The new UK Data Protection Act 2018 also gives you additional rights that refer to how the Council holds and uses your information.

Consequently, under certain circumstances, by law you have the right to:

• withdraw consent and the right to object and restrict further processing of your data; however, where legally enforceable this may affect service delivery to you.
• request to have your data deleted where there is no compelling reason for its continued processing and provided that there are no legitimate grounds for retaining it.
• request your data to be rectified if it is inaccurate or incomplete.
• have your data transferred or copied should you move to another authority.
• not be subject to automated decision-making including profiling.

To submit a Subject Access Request visit our Subject Access Request page.

Automated Decision Making

Any Automated Decision Making carried out by the Council will be described in the relevant departmental Privacy Notice.

Contacting the Council – call recordings

There are various ways in which the Council may be contacted: by letter, face to face, email, telephone, online forms, voicemail, social media, such as Facebook, Twitter etc. In all cases the Council is committed to protecting the personal data you provide. When contacting the Council by phone, in line with Council policy, calls into our contact centres are recorded. The recording is needed to quality manage the performance of Council agents, to ensure the quality of service information provided and to measure and improve the quality of the customer experience. Recordings are retained for a specified timeframe and then deleted in line with Council policies.

View our Call Recording Policy for further information.

Personal information collected via online forms

Our policy is to respect and protect the privacy of anyone who visits our website. Where we ask you for personal information via an online form, this information will only be used for the purpose indicated and will be held in a secure manner. It will not be used for any other purpose without your permission and will not be kept for longer than necessary. If you are concerned about providing your personal information online please contact us and we will arrange alternative means for you to provide this information. 

Use of IP addresses and cookies

For information about your privacy and the cookies we use on the Royal Borough of Kensington and Chelsea website (webtest.rbkc.gov.uk). Please visit the Cookies and your privacy page.

Changes in your personal circumstances

You must notify us immediately if there are any changes in your circumstances and personal details so we can maintain an accurate and up to date record of your information. 

If you have any concerns

You have a right to complain to us if you think we have not complied with our obligation for handling your personal information; please email: [email protected]. 

If you are not satisfied with the Council’s response you have a right to complain to the Information Commissioner’s Office (ICO). You can report a concern by visiting the ICO website.

Changes to our Fair Processing Notice

As the Council creates new services, this may generate need to amend the Notice. Any changes with regard to how the Council processes personal data will be posted on this page.