Luton Borough Council

Information Governance

Service privacy notices

Information Governance

We're committed to protecting your privacy when you use our services. We have a data protection officer who makes sure we respect your rights and follow the law.

If you have any concerns or questions about how we look after your personal information, please contact us at [email protected].

Personal data

Personal data

Information we collect about you may be provided by you or we may process your personal information provided by agencies for the purpose of responding to data protection complaints, data security incidents or for the prevention and detection of crime and fraud.

Processing covers everything we do with your data from collecting your data, to storing, managing and deleting it.

The information we collect will be the minimum we need to deliver our service. We currently collect and process the following personal data when dealing with requests for information under the Freedom of Information Act 2000, the Environmental Information Regulations 2004, UK General Data Protection Regulations and the Data Protection Act 2018.

Name, date of birth, address, email address, telephone number, formal proof of identity (such as driving licence, passport or birth certificate) and proof of address (such as a recent utility bill or council tax statement), letter(s) to authorise a third party to act on your behalf, visual and audio recordings.

We may process other categories of personal data, including special category data held by other teams within the council, for example when responding to a Subject Access Request or;

When dealing with a request for disclosure from another agency with investigative powers.

Special Category data

Although we do not request special category data for example your medical history or criminal convictions, we do recognise that you may choose to provide special category data when contacting us or it may reach us via other means outlined above.

Special category data includes information revealing/concerning a person’s racial or ethnic origins, political opinions, religious or philosophical beliefs, trade union membership, health or medical data (both physical and mental), sex life, sexual orientation and criminal convictions.

Purpose for using it

Information Governance uses your personal data to:

deal with all data protection matters including complaints, alleged data security incidents and/or personal data breaches
process a Freedom of Information (FOI) request or Environmental Information Request (EIR) – including reviews
respond to a subject access request (SAR) – including reviews
detect and prevent fraud and other criminal activity

Lawful basis

Information Governance uses your personal data under the following categories:

personal data: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or processing is necessary for the compliance with a legal obligation to which the controller is subject
special category: processing will take place on the basis of substantial public interest which will be proportionate to the reason for processing it. The processing of special category data is supported by the following legislation:

UK GDPR and the Data Protection Act 2018
Freedom of Information Act 2000
Environmental Information Regulations 2004

Who we share it with

The Information Governance team may share your personal data with the following:

other Teams and Services within Luton Council where law permits, or it is necessary and proportionate to do so to complete a request
someone acting on your behalf (providing it is evidenced you have asked them to do so)
regulatory bodies, for example, the Information Commissioner’s Office (ICO). Please note, the ICO can request personal data from Luton Council that is unredacted for the purpose of investigating complaints
agencies with investigative powers such as the police, other local authorities or the Home Office
the Information Governance team recognises the sensitivity of the information it processes, and we will only share the confidential information with others on a need to know basis to fulfil our purpose

Why we share it with them

We may have a statutory obligation to share your personal information with those listed above.

We may also share personal information when investigating data protection complaints, data security incidents or for the prevention and detection of crime and fraud.

Any automated decision making or profiling

None

Transfer of data to another country

The majority of personal information is stored on systems in the UK. But there are some occasions where your information may leave the UK either in order to get to another organisation or if it’s stored in a system outside of the EU.

We have additional protections on your information if it leaves the UK ranging from secure ways of transferring data to ensuring we have a robust contract in place with any third party who may transfer it out of the EU.

If we need to send your information to an ‘unsafe’ location we’ll always seek advice from the Information Commissioner first.

Retention period

Luton Council will only keep your personal data for as long as it is required to fulfil the purpose it was collected for or for as long as is required by legislation.

The data will be kept in accordance with our retention schedule.

Exercising your rights

You have the right to ask us to amend or delete your data as well transfer or limit its use. You also have the right to request a review of an automated decision where you think this is wrong.

Each request will be considered individually. Where we are required to keep your data by law we may be unable to action your request. In all circumstances we will explain our decision making in writing to you

Please see our main privacy statement using the green button below if you want more information on how:

we keep your data safe
to request a change to the records we hold
to make a complaint

Read our main privacy policy

Date of notice

This notice was last updated 18 December 2024

Downloads

Information-Commissioners-Office-(ICO)-Certificate.pdf

200 kB