Data Protection Policy 2024

Data Protection Policy

1. Introduction

Hellesdon Parish Council is fully committed to compliance with the requirements of the
General Data Protection Regulation 2016/679 (GDPR) and the Data Protection Act 2018 (the
DPA). The Parish Council will, therefore, follow procedures which aim to ensure that all
personal data collected about council members, staff, visitors and other individuals is
processed fairly, lawfully and transparently.
The GDPR, the DPA and Article 8 of the Human Rights Act 1998, stress that the processing of
personal data needs to strike a balance between the needs of the Parish Council to function
effectively and efficiently and respect for the rights and freedoms of the individual. This
policy sets out how the Parish Council intends to safeguard those rights and freedoms.
Obligations and responsibilities under the General Data Protection Regulation are not
optional; they are mandatory. There can be harsh penalties, up to €20 million or 4% of
global turnover for the preceding year (whichever is the greater) in relation to breaches of
rights and obligations and up to €10 million or 2% of global turnover for the preceding year
(whichever is the greater) imposed for non-compliance regarding Control and Mitigation.
The Parish Council will therefore, follow procedures that aim to ensure that all members,
staff, visitors and any other person working for the Parish Council who have access to any
personal data held by or on behalf of the Parish Council is fully aware of, and abides by their
duties and responsibilities under the General Data Protection Regulation and Data
Protection Act.
All individuals permitted to access personal data in line with their work duties must agree to
comply with this policy and agree to undertake any relevant training that may be
appropriate to the role being undertaken.
As well as the Parish Council, any individual who knowingly or recklessly processes data
without appropriate consent or proper authorisation, for purposes other than those for
which it is intended or is deliberately acting outside of their recognised responsibilities may
be subject to the Parish Council’s disciplinary procedures or reporting to the monitoring
officer, whichever is appropriate.

Hellesdon Parish Council – Data Protection Policy
Reviewed December 2024
Next Review Date 2025/2026 M1
2. Scope
This policy applies to the collection and processing of all personal data held by the Parish
Council, falling within the scope of the GDPR and the DPA in all formats including paper,
electronic, audio and visual. It applies to all members, staff, volunteers and contractors.

3. Personal and special category personal data

The GDPR and DPA provides conditions for the collection and processing of any personal
data. It also makes a distinction between personal data and ‘special category’ personal data.
Personal data means any information relating to an identified or identifiable natural person
(‘data subject’); an identifiable natural person is one who can be identified, directly or
indirectly, in particular by reference to an identifier such as a name, an identification
number, location data, an online identifier or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that natural person.
Special category personal data is defined as personal data consisting of information as to:

   •   racial or ethnic origin;
   •   political opinion;
   •   religious or other beliefs;
   •   trade union membership;
   •   physical or mental health or condition;
   •   sexual life or sexual orientation;
   •   genetics
   •   biometric data (where used for ID purposes)
Although there are clear distinctions between personal and special category data for the
purposes of this policy the term ‘personal data’ refers equally to ‘special category data’
unless otherwise stated.
The GDPR and DPA rules for special category data do not apply to information about
criminal allegations, proceedings, or convictions. Instead, there are separate safeguards for
personal data relating to criminal convictions and offences, or related security measures.

4. Personal data processed by the parish council

The Parish Council processes personal data for a variety of Council purposes about our
employees, residents, suppliers and other individuals. A description of the types of personal
data processed and the purposes for processing are included in the Parish Council’s privacy
notices.
Personal data must be handled and dealt with in accordance with the GDPR and DPA and
this policy. There are safeguards within the GDPR and DPA to ensure personal information is

Hellesdon Parish Council – Data Protection Policy
Reviewed December 2024
Next Review Date 2025/2026 M1
collected, recorded and used whether it is on paper, computer records or recorded by any
other means.
The obligations outlined in this policy apply to everyone who has access to, holds copies of
or processes personal data. This includes those who work at/from home or have remote or
flexible patterns of working.

5. The Data Controller

The Data Controller is the person who determines the purposes for which and the manner
in which any personal data are or are to be processed. The Parish Clerk has been appointed
the Data Controller for Hellesdon Parish Council.
All Staff are responsible for:

• Collecting, storing and processing any personal data in accordance with this policy;
• Informing the Parish Council of any changes to their personal data, such as a change
of address.
• Contacting the Clerk and Responsible Officer in the following circumstances:
o With any questions about the operation of this policy, data protection law,
retaining personal data or keeping personal data secure
o If you have concerns that this policy is not being followed
o If you are unsure whether or not you have a lawful basis to use personal data
in a particular way
o If there has been a data breach
o Whether you are engaging in a new activity that may affect the privacy rights
of individuals
o If you need help with any contracts or sharing personal data with third
parties

7. Data Protection Principles

Anyone processing personal data must comply with the principles of good practice. These
principles are legally enforceable and can be summarised as follows:
1) Processed lawfully, fairly and in a transparent manner in relation to individuals;
2) Obtained for specified, explicit and legitimate purposes and not further processed in
a manner that is incompatible with those purposes; further processing for archiving
purposes in the public interest, scientific or historical research purposes or statistical
purposes shall not be considered to be incompatible with the initial purposes;
3) Adequate, relevant, and limited to what is necessary in relation to the purposes for
which they are processed;

Hellesdon Parish Council – Data Protection Policy
Reviewed December 2024
Next Review Date 2025/2026 M1
 4) Accurate and kept up to date; every reasonable step must be taken to ensure that
personal data that is inaccurate, having regard to the purposes for which they are
processed, are erased, or rectified without delay;
5) Kept in a form which permits identification of data subjects for no longer than is
necessary for the purposes for which the personal data are processed; personal data
may be stored for longer periods insofar as the personal data will be processed
solely for archiving purposes in the public interest, scientific or historical research
purposes or statistical purposes subject to implementation of the appropriate
technical and organisational measures required by the GDPR in order to safeguard
the rights and freedoms of individuals;
6) processed in a manner that ensures appropriate security of the personal data,
including protection against unauthorised or unlawful processing and against
accidental loss, destruction, or damage, using appropriate technical or organisational
measures. In accordance with the rights of data subjects under the GDPR and DPA.

8. Fair Processing

In meeting any obligation to ensure that processing of information is fair, due consideration
will be given to the adoption of any recognised standards or advice to provide individuals
with such information as is necessary to ensure that they are likely to understand: -
a) The purposes for which their personal data are to be processed;
b) The likely consequences of such processing and;
c) Whether particular disclosures can be reasonably envisaged

9. Notification

The national body for the supervision of GDPR is the Information Commissioners’ Office to
whom the Clerk and Responsible Officer notifies his/her purposes for processing personal
data.
This notification process serves to provide transparency and openness about the processing
of personal data. It is a fundamental principle of the GDPR that the public should know or be
able to find out who is carrying out the processing of personal data and for what purpose.
A copy of the Parish Council’s notification details is available on the Information
Commissioner’s website www.ico.org.uk The parish council ICO registration Z5665642.

10. Individuals’ Rights

The Parish Council recognises that access to personal data held about an individual is a
fundamental right provided in the Act. These rights include: -

   •   The right to be informed
                                                Hellesdon Parish Council – Data Protection Policy
                                                                     Reviewed December 2024
                                                               Next Review Date 2025/2026 M1
   •   The right of access to personal information
   •   The right to request rectification
   •   The right to request erasure
   •   The right to restrict processing in certain circumstances
   •   The right to data portability
   •   The right to object to processing
   •   Rights related to automated decision-making including profiling
The Parish Council will ensure that all requests from individuals to access their information
is responded to within one calendar month which is the time allowed in the legislation.
However the one month timescale will not commence until after receipt of all identity or
clarification of information sought is received. To minimise delays and unnecessary work all
requests from data subjects must:

• Be made in writing to clerk@hellesdon-pc.gov.uk.gov.uk or to;
The Clerk to the Council
Diamond Jubilee Lodge
Wood View Road
Hellesdon

NR5 6QB

• Be accompanied by adequate proof of the identity of the data subject where
required and, where applicable, the written authorisation of the data subject (if the
request is being made on their behalf by a legal or lawfully appointed representative
or, authorised agent).
• Specify clearly and simply the information required.
• Give adequate information to enable the requested data to be located
• Make it clear where the response should be sent.
The Clerk and Responsible Officer must be informed of any request to action against one or
more of these rights.
The Act allows exemptions from providing information to individuals making a subject
access request, and non-disclosure of information, in specific and limited circumstances.
When the Parish Council collects personal data, the Parish Council does not need to provide
the individual with any information they may already have.
When obtaining personal data from other sources, the Parish Council do not need to
provide individuals with privacy information if:

Hellesdon Parish Council – Data Protection Policy
Reviewed December 2024
Next Review Date 2025/2026 M1
 • The individual already has the information;
• Providing the information to the individual would be impossible;
• Providing the information to the individual would involve disproportionate effort;
• Providing the information to the individual would render impossible or seriously
impair the achievement of the objectives of the processing; or
• The Parish Council is subject to an obligation of professional secrecy regulated by law
that covers personal data
If a data subject remains dissatisfied with a response received, they may ask for the matter
to be reviewed, or, in the case of an employee a resolution may be sought using the Parish
Council’s complaints process.
Ultimately if a data subject continues to be dissatisfied, she/he has the right to ask the
Information Commissioner’s Office (ICO) to carry out an assessment of their case and/or
pursue a legal remedy.

11. Legal Requirements

The Parish Council may be required to disclose personal data by a court order, or to comply
with other legal requirements including the prevention or detection of crime, apprehension
of an offender or gathering of taxation.
External agencies or companies contracted to undertake processing of personal data on
behalf of the Parish Council must demonstrate, via a written agreement, that personal
information belonging to the Parish Council will be handled in compliance with the GDPR
and DPA and that it has the necessary technical and organisational security measures in
place to ensure this.
Any sharing of the Parish Council data with external partners for the purpose of service
provision must comply with all statutory requirements.
The Parish Council will follow relevant guidance issued by the Government and the ICO for
users of CCTV and similar surveillance equipment monitoring spaces to which the public,
residents, service users and employees have access and will also strive to ensure that
partner organisations involved in joint or multi-agency initiatives seek to do the same. The
Parish Council reserves the right to monitor telephone calls, email and internet access in
compliance with relevant legislation.
This will be handled in line with guidance issued by the ICO.
The legal basis for this policy is the GDPR and DPA which provides the legal parameters for
the processing of personal data. However, compliance with other legislation, Codes of
Practice, policies and guidance also has relevance, such as;-

• The Freedom of Information Act 2000

                                                Hellesdon Parish Council – Data Protection Policy
                                                                     Reviewed December 2024
                                                               Next Review Date 2025/2026 M1
   •   The Computer Misuse Ace 1990
   •   The Crime and Disorder Act 1998
   •   Human Rights Act 1998

12. Data Security

The Parish Council will process personal data in accordance with its Information Security
Policy. To ensure the security of personal data, the Parish Council has appropriate physical,
technical and organisational measures in place. All members and employees are required to
comply with the Information Security Policy.
The GDPR and DPA requires that appropriate technical and organisational measures shall be
taken to protect data against:

   •   Unauthorised access;
   •   Unauthorised or unlawful processing;
   •   Accidental loss, destruction, or damage
Appropriate technical and organisational security measures will include:

• using and developing technological solutions to ensure compliance with the data
protection principles
• using and developing physical measures to protect Parish Council assets
• ensuring the reliability of any persons who have access to Parish Council information
• reporting and investigating security breaches
These obligations include the need to consider the nature of the data to be protected and
the harm that might arise from such unauthorised or unlawful processing or accidental loss,
destruction, or damage.
All printout material, magnetic tape, diskettes, CD’s or DVD’s, manual files, hand written
notes etc, which contain personal data and are no longer required, will be treated as
confidential waste, and disposed of securely.
Where processing of Parish Council data is to be carried out by a third party on behalf of the
Parish Council, the Clerk and Responsible Officer must ensure that the third party provides
sufficient guarantees in respect of the technical and organisation measures governing the
processing to be undertaken.

13. Sharing Personal Data

The Parish Council will not normally share personal data with anyone else, but may do so
where:

• There is an issue that puts the safety of our staff at risk

Hellesdon Parish Council – Data Protection Policy
Reviewed December 2024
Next Review Date 2025/2026 M1
 • The Parish Council need to liaise with other agencies – the Parish Council will seek
consent as necessary before doing this
• Our suppliers or contractors need data to enable the Parish Council to provide
services to staff and residents, for example, IT companies. When doing this, the
Parish Council will:
o Only appoint suppliers or contractors which can provide sufficient guarantees
that they comply with data protection law
o Establish a data sharing agreement with the supplier or contractor, either in
the contract or as a standalone agreement, to ensure the fair and lawful
processing of any personal data the Parish Council share
o Only share data that the supplier or contractor needs to carry out their
service, and information necessary to keep them safe while working with the
Parish Council
The Parish Council will also share personal data with law enforcement and government
bodies where the Parish Council are legally required to do so, including for:

   •   The prevention or detection of crime and/or fraud
   •   The apprehension or prosecution of offenders
   •   The assessment or collection of tax owed to HMRC
   •   In connection with legal proceedings
   •   Where the disclosure is required to satisfy our safeguarding obligations
   •   Research and statistical purposes, as long as personal data is sufficiently
       anonymised, or consent has been provided
The Parish Council may also share personal data with emergency services and local
authorities to help them to respond to an emergency situation that affects any of our
members or staff.

14. CCTV

The Parish Council uses CCTV in various locations around the Parish Council sites to ensure it
remains safe. The Parish Council will adhere to the ICO’s code of practice for the use of
CCTV.
The Parish Council does not need to ask individuals’ permission to use CCTV, but the Parish
Council makes it clear where individuals are being recorded. Security cameras are clearly
visible and accompanied by prominent signs explaining that CCTV is in use the reason why it
is being used, and who to contact about the CCTV.

15. Personal data breaches

The Parish Council will make all reasonable endeavours to ensure that there are no personal
data breaches.
Hellesdon Parish Council – Data Protection Policy
Reviewed December 2024
Next Review Date 2025/2026 M1
In the unlikely event of a suspected data breach, the Parish Council will follow the
procedure set out in our Security Incident and Data Breach Policy.
When appropriate, the Parish Council will report the data breach to the ICO within 72 hours.
Such breaches in a Parish Council context may include, but are not limited to:

   •   The theft of a Parish Council or personal electronic device containing nonencrypted
       personal data about members/employees and/or residents
   •   Accidental disclosure of personal data to another person or organisation
   •   Inappropriate access to or use of personal data
   •   The theft of personal information, either paper based or electronic
   •   Accidental loss of personal data
   •   Information that has not arrived at its destination
   •   Fraudulent acquisition of personal data (Blaggers)

16. Governing Body

The governing body for Data protection is the Information Commissioner.
The Information Commissioner can be contacted at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire

SK9 5AF

Tel: 0303 123 1113
www.ico.org.uk

Hellesdon Parish Council – Data Protection Policy
Reviewed December 2024
Next Review Date 2025/2026 M1