Neurodiversity and Emotional Wellbeing Service Pilot - Privacy Notice

When processing your personal, special category personal or criminal/law enforcement data, Cumberland Council (‘the council’) is required under Articles 13 and 14 of the UK General Data Protection Regulation (UKGDPR) to provide you with the information contained in this Privacy Notice.

This notice explains what the council will collect, who it will be shared with, why we need it and how we will use it. The council will continually review and update this Privacy Notice to reflect service changes, feedback from customers and changes in the law.

The council is also required to comply with the data protection principles as laid out in the UKGDPR, to ensure that personal data is:

processed lawfully, fairly and in a transparent manner
collected for specific, explicit, and legitimate purposes
adequate, relevant, and limited to the purposes for which it was collected
accurate and up to date
kept for no longer than is necessary for the purpose(s) for which it was collected
secured using appropriate technical or organisational measures

Registration

As an organisation that processes large amounts of personal, special category personal or criminal/law enforcement data, referred to in legislation as a data controller, the council is required to register with the Information Commissioner’s Office (ICO).

Where services are hosted by either Westmorland and Furness Council or Cumberland Council, the authorities may be processing personal data jointly, making them Joint Data Controllers, or where either Council is operating as a data processor for another party.

Name: Westmorland and Furness Council
Address: South Lakeland House, Lowther Street, Kendal, Cumbria, LA9 4DQ
Registration Number: ZB512761
The council’s Registration Certificate

Name: Cumberland Council
Address: Cumbria House, 117 Botchergate, Carlisle, Cumbria, CA1 1RD
Registration Number: ZB512758
The council’s Registration Certificate can be viewed on the ICO website.

About the Service

Cumberland Neurodiversity and Emotional Wellbeing Service Pilot is a 12 month pilot service which provides a Single Point of Contact and a Specialist Neurodiversity and Emotional Wellbeing Team. The service is open to children and young people aged 0-19 (25 with SEND (Special Educational Needs and Disabilities)), parents, carers, and all practitioners working with children and families. The SPOC (Single Point of Contact) provides immediate and timely advice, guidance and signposting to people who make contact with it, referring where appropriate to the Specialist Neurodiversity and Emotional Wellbeing Team who will provide specialist advice, guidance, assessment and support as appropriate, referring on to existing neurodiversity pathways for diagnosis as required.

All children and young people, parents and carers, teachers, health practitioners and other people working with children and young people across Cumberland and Eden can access the single point of contact and can receive immediate advice and guidance, with signposting to Digital, Council and Community based services in Cumberland or Eden respectively. If more intensive follow up support is required, residents of Cumberland can be referred to the pilot service’s Specialist Team. For the equivalent support in Eden, residents of Eden will be advised, and signposted appropriately, to access equivalent services in Westmorland and Furness.

Data Controller Arrangements

Cumberland Council is the Data Controller for this service. All organisations working in collaboration with Cumberland Council will become independent data controllers of information shared with them.

Personal data

UKGDPR Article 4 defines personal data as: any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person

Special category personal data

UKGDPR Article 9 defines special category personal data as: racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Criminal/law enforcement data

The council is a competent authority as described in Schedule 7 of the Data Protection Act 2018 and is permitted to process data for law enforcement purposes that include: the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Information we collect

The Cumberland Neurodiversity and Emotional Wellbeing Service Pilot is required to process either your personal, special category/sensitive or criminal/law enforcement data to meet legal obligations and make robust recommendations and decisions.

The Personal Data requirements are:

name
address
telephone number
email address
date of birth
contact details for members of your carers, family and support network, school and professionals working with you

The Special Category Data requirements are:

what matters to you
information about your racial or ethnic origin, religious or philosophical belief
your sexual orientation
information about you and your circumstances
information about relevant health and safety concerns
information about your needs and wishes
information about your finances, for example benefits
information about health conditions or disabilities that may apply to you
your experience of using the Cumberland Specialist Neurodiversity and Emotional Wellbeing Service Pilot

The Criminal/Law Enforcement Data requirements are:

charges
allegations
offences

How we collect your data

We collect data about you through the following ways:

at point of contact, from yourself or others
directly from other partner agencies
during conversations and assessments
via telephone, face to face contact, video call or electronic methods
online initial contact form
communication via the post

We collect data using a secure and approved system called Liberty Create, which securely stores your personal data.

Why we collect your personal data

We need to collect your personal data for a number of reasons, including:

deliver services and support to you
manage the services we provide to you
train and manage the employment of our workers who deliver those services
help investigate any worries or complaints you have about your services
keep track of spending on services
check the quality of services
anonymised data will be used to develop and improve the service and to help with research and planning of new services

Who we collect personal data from

To provide the Cumberland Neurodiversity and Emotional Wellbeing Service Pilot personal data may be collected from or about the following:

businesses, customers and suppliers
family members, parents, carers or representatives
complainants, enquirers or their representatives
healthcare providers
professional advisers and consultants
representatives of other organisations
staff, persons contracted to provide a service
other departments within the council

Cumberland Neurodiversity and Emotional Wellbeing Service Pilot may receive personal, special category personal or criminal/law enforcement data about you from the third parties mentioned above and other public bodies and organisations. In this case, we will tell you the source of the information unless we are unable to do so by law.

We will only collect and use personal information if we need it to deliver a service or meet a requirement.

University of Cumbria will be helping us to evaluate our service and we may share anonymised information with them to help them do this. If we use your personal information for research and analysis, we will ensure you remain anonymous or use a different name unless you’ve agreed that your personal information can be used for that research.

We do not sell your personal information to anyone else.

We work collaboratively with a number of organisations to deliver services. Other organisations will have their own privacy notices.

Where required we will complete a Data Privacy Impact Assessment (DPIA) before we share personal information to make sure we protect your privacy and comply with the law.

Sometimes we have a legal duty to provide personal information to other organisations, service providers or partners. Examples are:

providers of goods and services
local and central government, and other public bodies
Ombudsmen and regulatory authorities
health bodies in the local area and sometimes nationally (NHS Trusts, GPs)
partners that are part of national or regional improvement projects
University of Cumbria researchers

We may also share your personal information when this is more important than protecting your privacy. This doesn’t happen often, but we may share your information:

to find and stop crime and fraud
if there are serious risks to the public, our staff or other professionals
to protect a child
to protect adults who are thought to be at risk

The risk must be serious before we can override your right to privacy.

If we are worried about your physical safety or feel we need to act to protect you from being harmed in other ways, we’ll discuss this with you and, if possible, get your permission to tell others about your situation before doing so.

We may still share your information if we believe the risk to others is serious enough to do so. There may also be rare occasions when the risk to others is so great that we need to share information straight away. If this is the case, we’ll make sure that we record what information we share and our reasons for doing so. We will keep you informed of what we have done and why if it is safe to do so.

Legal basis

Where the Cumberland Neurodiversity and Emotional Wellbeing Service Pilot identifies the requirement to process personal, special category/sensitive or criminal/law enforcement data, depending on the specific data being shared, it must have at least one of the following:

for personal data, a legal basis under UKGDPR Article 6
for special category/sensitive data, a condition under UKGDPR Article 9
for criminal/law enforcement data, a purpose under Data Protection Act 2018 - Schedule 8

If we are relying on consent to process your personal, special category personal or criminal/law enforcement data, you have the right to object at any time by contacting the service or officer the data was provided to.

If personal data is being processed the Cumberland Neurodiversity and Emotional Wellbeing Service Pilot must select at least one legal basis from the list below:

UKGDPR Article 6(1) (e) Public Task/Public Interest/Official Authority

Where the Cumberland Neurodiversity and Emotional Wellbeing Service Pilot is relying on UKGDPR Article 6(1)(c) all Relevant Legislation should be listed below.

If special category personal data is being processed the Cumberland Neurodiversity and Emotional Wellbeing Service Pilot must select at least one condition from the list below:

UKGDPR Article 9(2) (a) Explicit consent cumberland.gov.uk

If criminal/law enforcement data is being processed the Cumberland Neurodiversity and Emotional Wellbeing Service Pilot must select at least one condition from the list below:

UKGDPR Schedule 8(4) Safeguarding Children and Individuals at Risk

Relevant Legislation

Health and Social Care Act 2015
Children’s Act 2004
Children and Families Act 2014
Equality Act 2010 Mental Capacity Act 2005

CCTV and Surveillance

We operate surveillance equipment within some of our services for the purpose of either, public and staff safety, or the prevention and detection of crime. CCTV is also installed on the outside of some of our buildings for the purposes of monitoring building security and crime prevention and detection.

Civil Enforcement Officers (CEOs) who undertake the enforcement of Public Space Protection Orders (PSPO) and parking restrictions, are each equipped with a Body Worn Video Device (BWVD), which has both video and audio recording capability.

Images captured by CCTV will be kept in accordance with the council’s Retention and Disposal Schedule. However, on occasions there may be a need to keep images for longer, for example where a crime is being investigated.

Images can be requested by emailing dataprotection@cumberland.gov.uk

We will only disclose images and audio to other authorised bodies who intend to use it for the purposes stated above. Images and audio will not be released to the media for entertainment purposes or placed on the internet for public viewing.

We operate CCTV and disclose in accordance with the codes of practice issued by the Information Commissioner and Biometrics and Surveillance Camera Commissioner.

Individuals wishing to make enquiries about the deployment of CCTV and Surveillance, should in the first instance search the relevant council website, as listed below:

National Fraud Initiative/Data Matching

The Council participates in the Cabinet Office's National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud.

We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise.

For further information visit National Fraud Initiative: Public Sector Data Requirements.

Elected Members

In order for Elected Members to act on your behalf and resolve the issues you have raised they may need to collect some personal, special category personal or criminal/law enforcement data. This could include your name and address, and/or sensitive personal data, which could be concerning your health or ethnic origin.

In some circumstances your explicit consent may be needed to allow for the processing of your data. If this is needed the relevant Elected Member will contact you directly.

Elected Members will:

only share data with the organisations necessary to deal with your enquiry i.e., different council departments, and to resolve any issues you have raised
not share your data with third parties, unless it is required for law enforcement purposes to prevent or detect crime, to protect public funds or where required or permitted to share data under other legislation
keep your data secure using the council's secure IT and email systems
retain/destroy your data in accordance with the council's Retention and Disposal Schedule

You have the right to access your personal, special category personal or criminal/law enforcement data and to rectify mistakes, erase, restrict, object or move your data in certain circumstances.

You can withdraw your consent for your personal, special category personal or criminal/law enforcement data to be processed as described above at any time. If you would like this to happen or you have a complaint about how your data is handled, please contact your Elected Member.

If you are not satisfied with the response or believe the Elected Member is not processing your personal, special category personal or criminal/law enforcement data in accordance with the law you can complain to the Information Commissioner's Office (ICO).

Data Transfers

It may sometimes be necessary to transfer personal, special category personal or criminal/law enforcement data beyond the UK to comply with legal or other obligations.

Where data is required to be transferred to the European Union or other adequate countries the council will ensure that all relevant safeguards are in place before this takes place and that all aspects of the UKGDPR/Data Protection Act 2018 are complied with.

Data requested for transfer to non-adequate countries will be subject to a Transfer Impact Assessment, that includes the identification of appropriate safeguards prior to data being authorised for transfer.

Data Security and Retention

The council is required by UKGDPR Article 32 to ensure that appropriate organisational and security measures are in place to protect your personal, special category personal or criminal/law enforcement data.

Security measures include: anonymisation, pseudonymisation, encryption, access controls on systems, regular testing of our systems, security training for all employees. You can find further information in the following documents:

If you access information online, the council website does not store or capture personal information, but merely logs a number called your IP address which is automatically recognised by the system. The system will record personal information if you:

subscribe to or apply for services that require personal information
report a fault and give your contact details for us to respond
contact us and leave your details for us to respond

For further information visit our Cookies Policy.

Cumberland Council will only store your information for as long as is legally required in accordance with the council's Retention and Disposal Schedule or in situations where there is no legal retention period established best practice will be followed.

To help you understand the Schedule the council has published a Retention Schedule - Quick User Guide.

If you have any questions about the Schedule or the Quick User Guide, email record.centre@cumberland.gov.uk

If you experience any problems in relation to your personal data or you see something that doesn't look right, email databreaches@cumberland.gov.uk

In order to protect your personal data, we put in place appropriate organisational and technical security measures. These measures include ensuring our internal IT systems are suitably secure and implementing procedures to deal with any suspected data breach.

We will make every effort to ensure that we hold records about you (on paper and electronically) in a secure way, and we will only make these records available to those who have a right to see them. Examples of our security include:

Encryption, meaning that information is hidden so that it cannot be read without special knowledge (such as a password). This is done with a secret code or what’s called a ‘cypher’. The hidden information is said to then be ‘encrypted’
Pseudonymisation means that we’ll use a different name, so we can hide parts of your personal information from view. This means that someone outside of the Council could work on your information for us without ever knowing it was yours
Controlling access to systems and networks allows us to stop people who are not allowed to view your personal information from getting access to it
Training for all of our staff in order to make them aware of how to handle information and how and when to report when something goes wrong
Regular testing of our technology and ways of working including keeping up to date with the latest security updates (commonly called patches)

In the unlikely event of a data breach, we will take steps to mitigate any loss or destruction of data and, if required, will notify you and any applicable authority of such a breach.

Although we use appropriate security measures once we have received your Personal Data, you will appreciate that the transmission of data over the internet (including by email) is never completely secure. We endeavour to protect Personal Data, but we cannot guarantee the security of data transmitted to or by us.

Contacting the Council

Emails

If you email us, we may keep a record of your contact and your email address and the email for our record keeping of the transaction. We suggest that you keep the amount of confidential information you send to us via email to a minimum and use our secure online forms and services. Where available, you can sign up for email alerts for selected services using an external service from GovDelivery, with control over your preferences.

Telephone

The council will inform you if your telephone calls are being recorded or monitored.

Your Rights - Data Subject Access

The UKGDPR provides you with the right to access the personal, special category personal or criminal/law enforcement data the council, as a public authority holds about you. Upon receipt of a valid request the council will:

provide you with a response within one month
let you know if your request is subject to an extension
make reasonable efforts to comply with the format of your request
inform you if your request is going to be refused or a charge is payable

We will not disclose:

any information that relates to a third party as this will breach their rights under UKGDPR/Data Protection Act 2018
where a professional thinks disclosure would cause serious harm to you or someone else
information that may hinder the prevention or detection of crime

Individuals wishing to submit a Data Subject Access Request, should in the first instance search the relevant council website, as listed below:

Your Rights

In addition to your right of access the UKGDPR gives you the following rights:

the right to be informed via the council's Privacy Notice
the right to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point
the right of rectification, we must correct inaccurate or incomplete data within one month
the right to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information. Where your personal data has been shared with others, we will ensure those using your personal data comply with your request for erasure
the right to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future
the right to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked
the right to object. You can object to your personal data being used for profiling, direct marketing or research purposes
you have rights in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention

Where our processing of your personal, special category personal or criminal/law enforcement data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent, we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on - in which case, we will let you know. Your withdrawal of your consent won't impact any of our processing up to that point.

Where our processing of your personal, special category personal or criminal/law enforcement data is necessary for our legitimate interests, you can object to this processing at any time. If you do this, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim.

Unless otherwise stated above you can exercise any of these rights by contacting:

Email: dataprotection@cumberland.gov.uk

Post: Cumbria House, 117 Botchergate, Carlisle, Cumbria, CA1 1RD

Verifying your identity

When exercising the rights mentioned above, please be aware that under UKGDPR Article 12(6) additional information can be requested to verify that you are the data subject if your identity is unconfirmed. Please note that:

additional documentation is only required when the council cannot verify your identity using internal council systems that relate to the service you are requesting information about
the council will contact you for this documentation prior to processing your request
the statutory deadline for responding to your request will start when you have provided the additional documentation
failure to provide additional documentation may lead to the council rejecting your request

Complaints

If you have concerns about the way the council has processed your data, please contact: