Brent corporate privacy policy

Personal information is collected to enable the Council to provide a range of services to local people and businesses as required to fulfil our duties under UK legislation, statutory or contractual requirement or obligation. This includes:

• maintaining our own accounts and records
• supporting and managing our employees current past and prospective employees and persons contracted to provide a service
• promoting the services we provide
• marketing our local tourism
• carrying out health and public awareness campaigns
• ensuring Trading Standards
• managing our property
• providing leisure and cultural services
• provision of education
• carrying out surveys
• administering the assessment and collection of taxes and other revenue including benefits and grants
• licensing and regulatory activities
• provision of planning and building control
• local and national fraud initiatives
• the provision of social services
• provision of housing services
• provision of library services
• crime prevention and prosecution of offenders including the use of CCTV
• corporate administration and all activities we are required to carry out as a data controller and public authority
• undertaking research
• the provision of all commercial services including the administration and enforcement of parking regulations and restrictions
• the provision of all non-commercial activities including refuse collections from residential properties
• internal financial support and corporate functions
• managing archived records for historical and research reasons
• data matching under local and national fraud initiatives

If you fail to provide the personal data, the Council may not be able to deliver accurate services to you and may take action if it is required to do so by law.

The council is required to maintain a Record of its Processing Activities (ROPA), covering areas such as processing purposes, data sharing and retention. A copy can be obtained from our Data Protection Officer via dpo@brent.gov.uk

We collect and use information under one or more of the following legal bases.

• Legal obligation – we need to process your information to comply with the law
• Public task – we need to process your information to provide you with council services
• Public Interest- we need to process your information when there is a significant public interest in doing so
• Contract – we need to process your information as part of a contract such as contract of employment.
• Vital interest – we need to process you information to protect someone’s life in an emergency.
• Consent – we need your permission to use your information

Where we require consent to use your information, we will make it clear that consent is required and explain how to go about withdrawing your consent.

We will only use your personal data for the uses and purposes set out above, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original use and purpose. 

The types of information we process include:

• personal details
• family details
• lifestyle and social circumstances
• goods and services
• financial details
• employment and education details
• housing needs
• visual images, personal appearance and behaviour
• licenses or permits held
• student and pupil records
• business activities
• case file information

We also process ‘special’ categories of information that may include:

• race
• ethnic origin
• politics
• religion
• trade union membership
• genetics
• biometrics (where used for ID purposes)
• health
• sex life or
• sexual orientation

The UK GDPR rules for ‘special’ categories of information do not apply to information about criminal allegations, proceedings or convictions. Instead, there are separate safeguards for personal data relating to criminal convictions and offences.

We process personal information about:

• customers
• suppliers
• current past and prospective employees, persons contracted to provide a service
• claimants
• complainants, enquirers or their representatives
• professional advisers and consultants
• children and parents
• students and pupils
• carers or representatives
• landlords
• recipients of benefits
• witnesses
• offenders and suspected offenders
• licence and permit holders
• traders and others subject to inspection
• people captured by CCTV images
• representatives of other organisations

Where necessary or required we share information with:

• customers, service users and employees
• representatives of customers, service users and employees
• legal representatives
• trade unions
• current past and prospective employers
• healthcare, social and welfare organisations
• educators and examining bodies
• providers of goods and services
• data processors
• local and central government
• ombudsman and regulatory bodies
• financial organisations
• debt collection and tracing agencies
• credit reference agencies
• press and the media
• law enforcement and prosecuting authorities
• international law enforcement agencies and bodies
• courts and tribunals
• housing associations, landlords and tenants panels
• charitable, religious and voluntary organisations
• political organisations
• elected members including members of parliament
• survey and research organisations

Once your information has been collected by the council, it may be used by other council departments, where necessary, to provide a complete service to you. It is for this reason that we link your information together, for example, to save you providing your information more than once.

• The council carries out checks to prevent and detect fraud. If fraud is detected, you could be refused certain services, finance or employment. The personal information we have collected from you will be shared with fraud prevention agencies. Further details of how your information will be used by us, fraud prevention agencies, and your data protection rights can be found on our website and Cifas.

Brent Council does not process your information with third countries outside of the UK without the safeguards being in place that are equivalent to the Data Protection legislation or the UK General Data Protection Regulations (UK GDPR).

There’s often a legal and/or business reason for keeping your information for a set period of time, we try to include all of these in our retention schedule. A copy can be obtained from our Data Protection Officer.

We are committed to ensuring that your personal data is secure. To prevent unauthorised access or disclosure, we have put appropriate technical and organisations measures in place to safeguard your information. The council assures this by complying with relevant security best practice standards.

If a data breach does occur, we will do everything in our power to limit the damage and comply with the Information Commissioner’s guidance. In the case of a high-risk data breach, and depending on the circumstances, we will inform you about the remedial actions to prevent any further damage. We will also inform the Information Commissioner’s Office of qualifying data breaches.

Unfortunately, no security measures are completely breach proof. We therefore cannot fully guarantee that your personal data will not be compromised, misused or lost by accident or by the unauthorised acts of others.

The procedures and related standards include limiting access to data on a need to know basis and regularly testing and auditing our security practices and technologies.

Employees and temporary workers are required to follow policies and procedures and complete mandatory annual training to understand data protection and information security.

Brent Council shall process your information in adherence to your individual rights under the data protection legislation.

The right to be informed

This is your right know about how your data is being processed, who it is given to, for what purpose and anything else that guarantees your rights, this is sometimes referred to as a privacy notice or a fair processing notice. This web page provides a summary and both the Record of Processing Activities and the links to the service specific privacy notices gives further details. When you provide information the Council will ensure that you have access to a privacy notice.

The right of access

You have a right to access your personal data and relevant supplementary information. This is known as a Subject Access Request. Further information can be found at www.ico.org.uk

You can log in to My Account and submit a SAR request, which allows you to monitor the progress of your request online.

Alternatively, request an application form by sending an email to dpo@brent.gov.uk.

Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests as described under the ICO’s SAR code of practice. In this case, we will notify you and keep you updated within the month deadline.

In most cases we cannot charge you a fee to comply with a subject access request. However, where the request is considered manifestly unfounded or excessive we may charge a “reasonable fee” for the administrative costs of complying with the request. We may also charge a reasonable fee if you request further copies of your data following a request. We would base this fee on the administrative costs of providing further copies.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of the other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. As we are a large organisation with multiple departments and systems, we may also contact you to ask you for further information in relation to your request to help locate the information you have asked for.

The right to rectification

If you believe that any personal data we are holding about you is incorrect or incomplete, you have the right to request to have your personal data rectified if it is inaccurate or incomplete. We may require evidence from you. In most cases we will delete information, correct information or add additional notes indicating corrections. You can do this by contacting the service area that you are concerned about directly. Otherwise you can make a request by emailing the Data Protection Officer at: dpo@brent.gov.uk, or in writing to the Data Protection Officer, Brent Council, Civic Centre, Engineers Way HA9 0FJ

The right to erasure

This is also known as “the right to be forgotten”. Please note that there are circumstances when your information cannot be erased. This includes situations whereby the council is required to retain information for statutory purposes in accordance with its data retention policy. You can make a request by emailing the Data Protection Officer at dpo@brent.gov.uk, or in writing to the Data Protection Officer, Brent Council, Civic Centre, Engineers Way HA9 0FJ . You should receive a response within 1 calendar month.

The right to restrict processing

You have a right to request the council to ‘block’ or suppress processing of your personal data. Please note that this may not apply for most of the council’s processes because there is usually a legal duty to process information.

The right to data portability

You have the right to obtain and reuse your personal data for your own purposes. You have the right to receive your personal data in a structured, commonly used and machine-readable format. The Council will assist in the transmission of such data to another entity, upon request, to the extent technically feasible. Note that this right only applies to automated information which you initially provided consent for us to use, or where we need the information to perform a contract for you. You can make a request by emailing the Data Protection Officer at dpo@brent.gov.uk, or in writing to the Data Protection Officer, Brent Council, Civic Centre, Engineers Way HA9 0FJ.

The right to object to processing

You have the right to object to processing for certain circumstances as listed by the ICO. You can make a request by emailing the Data Protection Officer at dpo@brent.gov.uk, or in writing to the Data Protection Officer, Brent Council, Civic Centre, Engineers Way HA9 0FJ

The right to withdraw consent

If you have consented to the processing of your personal data via a consent form or process, you have the right to revoke such consent through a consent withdrawal process. This will be specific to the process you have consented to. If you withdraw your consent, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

Rights related to automated decision making including profiling

There are restrictions on automated decisions based solely on automated means without any human involvement. Also there are restrictions on profiling. You can make a an enquiry by emailing the Data Protection Officer at dpo@brent.gov.uk, or in writing to the Data Protection Officer, Brent Council, Civic Centre, Engineers Way HA9 0FJ

Public Funds

Brent Council is required by law to protect the public funds it administers. We may use any of the information you provide to us for the prevention and detection of crime. We may also share this information with other bodies that are responsible for auditing or administering public funds including the Public Sector Audit Appointments Ltd, National Audit Office, Financial Reporting Council, Cabinet Office, Department for Work and Pensions, and other local authorities, HM Revenue and Customs, and the Police.

In addition to undertaking our own data matching to identify errors and potential frauds we are required to take part in national data matching exercises undertaken by the National Fraud Initiative. 

Should you be dissatisfied with the outcome of your request for information or the way we have processed your personal information please contact the council’s data protection officer at dpo@brent.gov.uk, or in writing to The Data Protection Officer, Brent Civic Centre, Engineers Way, Wembley, HA9 0FJ. If the council is unable to resolve the matter you have the right to complain to the Information Commissioner directly.

The Information Commissioner can be contacted by:

Online: ICO contact us 

Email: casework@ico.org.uk

Telephone: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number

The Information Commissioner
Wycliffe House
Water Lane
Wilmslow, Cheshire
SK9 5AF