How different services use your information
We collect more information for some services, less for others.
Here's how each service uses your information.
Coronavirus - services during the COVID-19 pandemic
Data required to help support individuals, control the spread of Covid-19 and monitor the health of people in Hertfordshire
We'll be seeking information about those who don't meet our normal criteria for service, but who have become vulnerable because their normal support from family or friends may be interrupted or reduced.
We are working actively with voluntary organisations, such as HertsHelp and local community voluntary services or Communities First to manage the on-going delivery of services to people who remain vulnerable and are without other support. We have agreements in place with these organisations to continue the provision of community support where it remains necessary.
We'll do this to make sure we can fulfil our statutory duties which relate to the whole of Hertfordshire during a period of increased risk to health and well-being. This will be identifiable data so that we know who to offer a service to, and how to get the service to them.
We'll receive information primarily from the Government Data Service; this may include data from both the NHS and other departments.
We'll also receive information from providers of care homes, nursing homes and domiciliary care services.
We will share information back to providers where we feel they can help us meet your service needs.
Our Public Health analysts will also be receiving data in order to understand and assist with the management of Covid-19 across the population of Hertfordshire as a whole. This will include identifiable data to enable us to assist with local test and trace operations and to enable district and borough councils to contact individuals who are unvaccinated or who have not had all doses of the Covid-19 vaccine.
Data may be shared with the police where necessary to investigate reported breaches of legislation intended to control the spread of the virus. It will also include anonymised data to enable analysis and identify patterns of infection, in order to assess the control measures. Data will not be kept longer than necessary for the tasks allocated to us or published in a way which identifies individuals.
Our lawful basis for processing the data for all of the above tasks is that it is part of our public task and official authority, under General Data Protection Regulation 6(1)(e) and 9 (2)(h) and (i); the Care Act 2014, Childrens Act 1989, and Health and Social Care Act 2012 and the current instructions issued by the Secretary of State for Health and Social Care (the COPI Notice issued July 2022).
Temporary changes to service delivery for normal services
All council departments are attempting to identify ways to replace services which have been temporarily removed. We will be replacing many face-to-face visits or activities with telephone or video conferencing. This includes some social care contacts; Services for Young People advice and other sessions for young people; library story times and school music tuition.
We are trying to find the most secure methods of delivering these services, and, again, only intend to use them for the duration of the pandemic.
You should be informed of how your data is used by these external parties and HCC in a Privacy Notice before we start providing the service. These services are being provided under the same lawful basis as the original face-to-face service.
If you have any concerns about the use of your data, please use the contact details at the bottom of the page to raise them.
Adult Care Services
We process personal data in order to provide social care assessments and support services and information to adults who have, or may develop, care and support needs as a result of a physical or mental impairment or illness.
This is in line with our responsibilities under the Care Act 2014 and the Care and Support (Eligibility Criteria) Regulations 2015 and includes the carers of adults with support needs.
We process data to investigate reported concerns about wellbeing and safeguarding vulnerable adults.
Our Money Advice Service processes data to provide advice and support for people with care and support needs or residents where additional financial support may be available to them through the benefits system.
We work in partnership with MacMillan Cancer Support to provide the Hertfordshire MacMillan Benefits Advice Service and share data with them in appropriate cases.
We process data to understand the quality and performance of our services and the experience of adults using our services. This helps us identify what we are doing well and where we need to improve and develop as a service to meet future needs and our duties under the Care Act.
Specifically, we are engaged in ‘proactive prevention’ work aimed at preventing carer breakdown. With the support of specialist expertise from Xantura and Newton Impact we will look at your information (carer and cared for). We may also in due course receive relevant information from organisations external to the Council and we will see what the risks are and what we can do to support you. We do this as part of our public task -supporting those in need. If you are concerned about our use of your data in this way or wish to opt- out please contact data.protection@hertfordshire.gov.uk
We do not identify any individual when we write reports and recommendations. Sometimes central government asks for some of these reports. Where we are inspected by external bodies such as the Care Quality Commission, we sometimes make records available to them. This is so they can assess how well we are performing.
How long we hold your data depends on the type of support you receive from us. See Section 3.30 onwards of the HCC data retention schedule (PDF 175kb) for more information.
We may process some of your information to identify what (if any) other financial support may be provided or open to you. For us to do this we will share your information with another Council team.
This information may be combined with other information that the Council (and others) hold about you. We do this as part of our public task- supporting those who may be in need.
If you object to the Council using your information in this way please contact the council’s data protection team at data.protection@hertfordshire.gov.uk
Sharing data and use of your NHS Number in Adult Care Services
Legislation and statutory guidance place a duty on us to work closely with Health colleagues to ensure the best level of care is delivered to our citizens.
If you're receiving support from us (Adult Care Services) then the NHS will share your NHS Number with us. This is so we use the same number as the NHS to identify you whilst providing your care. By doing this, we can work together more closely with the NHS to improve your care and support, for example if you are admitted to, or discharged from hospital or your care needs change as a result of medical treatment.
We'll also share data with providers of health services where it's appropriate for your care. In particular we are a partner in the My Care Record partnership which facilitates sharing data for direct care across the Hertfordshire and West Essex area. But we also share across other borders where people travel to a hospital or specialist health provider.
Where they are funding your care, we may also be required to share some data with the relevant Clinical Commissioning Groups.
National Data Guardian’s opt-out – secondary use of data
You have the right to opt-out of allowing use of your confidential personal data (health and social care) for some secondary purposes such as service planning, research and risk stratification.
Information relating to opt-outs is held securely within NHS systems. Where our Adult Care Services need to use this data, they will run an automated check of a data set against the NHS list and remove data relating to any NHS numbers where an opt-out has been flagged, before producing statistical reports and similar information so that if you have opted out your information will not be included. This does not apply to data which has been anonymised in line with the ICO’s Code of Practice.
Local authorities do need to plan services in order to make best use of our budget for social care so that we can meet the needs of our residents for the future, so please consider this before deciding.
This is your data so if you wish to exercise your right to opt-out you must contact www.nhs.uk/your-nhs-data-matters – you'll need your NHS number or the email address / mobile number held by your GP practice to verify your identity on the website.
Opting out will not affect how your data is used and shared for your direct care.
Study of resource demand for Working Age Adults on the Whole Life Disability Pathway
The County Councils Network and Newton Europe Limited are conducting a study to analyse and understand the population of Working Age Adults across the Whole Life Disability Pathway that are supported by adult social care services.
As part of this study the Council will share personal data (some of which is ‘Special Category’ Data) with Newton for analysis.
Our legal basis for processing personal data is that we (in common with the other councils) are pursuing a task in the public interest. We have a duty under the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 to improve the quality and safety of the services provided in order to secure and advance the health and welfare of the people of England and Wales.
For any Special Category Data the Council relies upon Article 9 of the UK GDPR namely that processing of such data is necessary for reasons of substantial public interest. Further detail is set out in Part 2 Paragraph 6 of Schedule 1 of the Data Protection Act 2018- as per the Act referred to above.
You have the right to opt-out of your data being used in this way and can exercise this right by contacting data.protection@hertfordshire.gov.uk
My Care Record
Hertfordshire County Council is part of My Care Record, an approach to improving care by joining up health and care information. Health and care professionals from other services will be able to view information from the records we hold about you when it is needed for your care. Please see www.mycarerecord.org.uk for more information.
Public Health
We process personal data to meet our statutory duties and, in line with our official authority for Public Health in Hertfordshire, under the Health and Social Care Act 2018, to monitor and improve the health of our citizens, including pupils in our schools, regardless of where they live.
This includes provision and commissioning of services which are delivered by other agencies and organisations such as:
- sexual health clinics
- drug and alcohol treatment
- primary school pupil height and weight measurement (part of the National Child Measurement Programme)
- health visitor services
- school nursing and healthy child services
- local healthy living initiatives
- health protection and emergency response services to public health incidents.
The Director of Public Health has a statutory duty to publish a report on the health of Hertfordshire. In order to report on public health, the Public Health Evidence and Intelligence team use data and information from a range of sources including information collected at the registration of a birth or a death and information recorded at hospitals. This helps us to understand more about the nature and causes of disease and ill-health in the area. This data can contain person identifiable data which may identify people such as home address, date of birth, date of death and / or NHS Number.
Our lawful basis for processing is a task in the public interest and in line with our official responsibility.
If there is a significant threat to health of the public, for instance an outbreak of an infectious disease, the Council has the legal right to use identifiable data under:
Section 42(4) of the Statistics and Registration Service Act (2007) as amended by section 287 of the Health and Social Care Act (2012) and Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.
We process information listed below that we receive from your GP and pass on to district and borough councils to use in connection with the Vaccine Tracing programme. Vaccine Tracers will contact individuals who are unvaccinated or who have not had all doses of the COVID-19 vaccine under the above ‘COPI’ regulations. Your GP provides us with the following information about you:
- name
- date of birth
- vaccination status
- gender
- address
- NHS number
- contact number
- ethnicity.
The public health intelligence team has access to the following data
- Primary Care Mortality Database (PCMD) – the PCMD holds mortality data as provided at the time of registration of the death along with additional GP details (GP code and GP practice code), geographical indexing and coroner details (coroner name, coroner inquest area and date of inquest) where applicable. Information held includes date of birth, date of death, place of death, address of deceased, causes of death, age, sex, GP and practice, occupation and place of birth. More information on this dataset.
- Births – information held includes date of birth, sex of child, birth weight, a birth in marriage indicator, country of birth of parents, occupation of parents, address and postcode of mother, place of birth, a still birth indicator and age of mother.
- Hospital Episode Statistics (HES) – a data warehouse containing details of all admissions, outpatient appointments and A&E attendances at NHS hospitals in England. This data is collected during a patient's time at hospital and is submitted to allow hospitals to be paid for the care they deliver. HES data is designed to enable secondary use, that is use for non-clinical purposes, of this administrative data. The HES data is accessed by the public health intelligence team via the NHS Digital Data Access Environment (DAE) and does not contain person identifiable data. Aggregation of HES data is performed in the DAE and only aggregated HES data are downloaded and stored on Hertfordshire County Council computers.
- Young People's Health & Wellbeing Survey (YPHWS) – the YPHWS collects data on a range of health and wellbeing issues for young people living in or using services in Hertfordshire. Information collected includes postcode of residence, but this is removed and replaced with Lower Super Output Area before analysis to remove person identifiable information from the data.
How your data is used
All information accessed, processed and stored by public health staff will be used:
- to measure the health, mortality or care needs of the population
- for planning, evaluating and monitoring health
- protecting and improving public health.
It's used to carry out and support:
- commissioning and delivery of services to promote health and prevent ill health
- health equity analysis
- health needs assessments
- health protection and other partnership activities
- identifying inequalities in the way people access services
- joint strategic needs assessment
- public health surveillance.
Statistics are presented in such a way that individuals cannot be identified from them and personal identifiable details are removed as soon as is possible in the processing of intelligence.
We do not use data for the purpose of automated decision making.
In relation to births and deaths, the data will only be processed by Local Authority employees in fulfilment of their public health function, and will not be transferred, shared, or otherwise made available to any third party, including any organisations processing data on behalf of the Local Authority or in connection with their legal function.
Data sharing
We do not disclose any data to a third party who is not identified on our license agreement with NHS Digital. Any data requests received from a third party will only receive anonymised and aggregated data to a level that complies with the Office of National Statistics disclosure guidance or we are required to do so for legal reasons.
We do share information with public sector colleagues in Hertfordshire districts and boroughs so that they may contact residents who are unvaccinated or who have not had all doses of the COVID-19 vaccine.
Retention
All identifiable data will be held in line with the retention schedules of the organisations sharing data with Hertfordshire County Council. These retention schedules determine the length of time data will be kept.
Children's Services and schools (except admissions)
Schools and education
Schools are responsible for their own compliance with Data Protection legislation. However, there are areas of education where we have a statutory responsibility – in these cases we share some pupil data with schools (and vice versa) to ensure that services are provided and reporting responsibilities are met. This includes:
- school place allocation and appeals processes
- pupil census and achievement data
- Education, Health & Care Assessments and/or Plans
- where there are safeguarding or wellbeing concerns.
- data on staff employed in schools as required for the annual school workforce census
We provide pupil census and achievement data and school workforce census data to the Department for Education to meet our reporting responsibilities according to their requirements. For more information on the school censuses please see www.gov.uk/education/data-collection-and-censuses-for-schools.
We share contact data for pupils in years 12 and 13 (age 16/17) with the relevant Electoral Roll Registration Services, as we're obliged to assist in the compilation of the electoral roll. The pupil will be invited to register to vote.
The Local Offer
We process the personal data of parents or guardians,children and young people to consider requests for assessment of education, health and care needs; to decide if an assessment is needed; to undertake the assessment itself; to create the Education, Health and Care Plan (EHCP) and to review it periodically. In addition, we may process personal data of the child or young person provided to us as part of the processes undertaken by professionals, such as teachers and those working within health.
The Hertfordshire SEND partnership are committed to improving the quality of EHCP’s for children and young people in Hertfordshire; ensuring plans are of high quality and meaningfully capture children and young people’s: views, experiences, needs and outcomes, and specify provision.
To support with achieving this aim, there will be regular multi-agency audits of EHCP’s. These multi-agency audits involve professionals from education (school representatives, specialist advisory teachers, educational psychologists and members of the statutory SEND service), health, social care, SENDIASSand the Herts Parent Carer Involvement coming together to audit the quality of a random selection of EHCP’s. Professionals then work together to identify areas of good practice and areas where learning is required. These events are crucial for supporting improvements in practice across the system.
This may therefore mean that your child’s plan could be selected for audit and shared with the above professionals for auditing purposes.
All professionals involved in multi-agency audits of EHCPs are required to comply with Data Protection legislation and confidentiality duties, which restrict the sharing of information pertaining to your child's EHCP outside of the auditing activity.
If you wish to opt out and do not wish for your child's EHCP to be included in our quality assurance audits, please email the Quality Assurance Service at: policyandpractice@hertfordshire.gov.uk
Children in our care, or subject to other social work intervention
Where we are caring for children or we're taking action to ensure they are appropriately cared for (in accordance with the Children Act 1989 and related legislation), we'll keep detailed records relating to their needs and circumstances. That includes information about the wider family and action we have taken.
We'll keep these records for a considerable amount of time to ensure they're available to the child when they become an adult and to identify that actions taken were in their best interests at the time.
Where we act as parent to children in our care, we're entitled to information in the same way as a birth parent. That includes information about:
- their health
- any involvement in crime (as a victim or alleged perpetrator)
- education progress and attainment.
We will share information about children with other organisations involved in their care where it's considered to be in the best interests of the child, or where the law requires us to. Organisations might include:
- health providers
- schools
- housing authorities
- the police.
We may share data with the Home Office for the purpose of checking immigration status and eligibility for services.
We'll keep personal data relating to the care of children throughout the period they receive a service from us. That might range from 15 to 75 years (from date of birth) depending on the contact and responsibility we've had.
It can be 118 years for key adoption records.
This is so we can provide information on history of care after a child has reached adulthood and is ready to access their early history.
We'll also keep personal data relating to the education processes we're responsible for 3–35 years depending on how involved we've been in providing education support.
Additionally, we use some of your personal information to assess the adequacy of placements in the Eastern Region. This helps us develop a comprehensive strategy for the region.
We process your personal information because it is necessary for our public interest task of safeguarding and promoting the welfare of children in our area under the provisions of Part 3 of the Children Act, 1989.
The information we collect is combined with data from 10 other Eastern Region Local Authorities responsible for Children's Social Care, which includes:
- gender
- ethnicity
- age
- home and placement postcodes
- legal status.
This information is used solely for analysing Eastern Region Sufficiency.
We may process some of your information to identify what (if any) other financial support may be provided or open to you. For us to do this we will share your information with another Council team.
This information may be combined with other information that the Council (and others) hold about you. We do this as part of our public task- supporting those who may be in need.
If you object to the Council using your information in this way please contact the council’s data protection team at data.protection@hertfordshire.gov.uk.
School admissions
We have a statutory responsibility to coordinate the allocation of school places under the provisions of the School Standards and Framework Act 1998 and the School Admissions Code 2014. The Education and Inspections Act outlines our responsibilities regarding the provision of home-school transport for 5-16 year olds.
What we will do with your information
Our Admissions and Transport team will hold the information you give us and will use it for admissions and transport purposes. In order to deliver this service, we'll share your information with:
- schools within Hertfordshire for which you have made an application or the allocated school if this is different (for example, a Non Ranked Allocation)
- other local authorities, if a school you have applied for is outside Hertfordshire (who will share your information with any schools you applied for within their LA)
- our Appeals team and members of the Independent Appeal Panel, if your application for a school is unsuccessful and you submit an appeal
- the Environment department and transport contractor, if your child is entitled to home-school transport
- the software company, Allpay, that provides the direct payment cards and customer support if your child receives a Personal Travel Budget
- our database provider, The Access Group, to allow for maintenance, testing and development of the Hertfordshire allocation database.
We'll also share your data and it may be used:
- to cooperate with our partners in health and youth justice to improve the wellbeing of children in Hertfordshire, as required by the Children Act 2004. Information shared between partner organisations is proportionate and only given when it's necessary to help those partner organisations
- provide statistical data to other organisations (for example, the Department for Education, academic institutions or independent researchers with a legitimate need for information for their research, or for our own internal research, statistical analysis or statistical surveys)
- to consider the effectiveness of alternative admission arrangements to improve the service provided.
We may share information with third parties if we're legally obliged to do so, for example, if it's necessary to safeguard or protect a child.
We may share information with the police or other agencies if it's necessary for the following purposes:
- the prevention or detection of crime
- the apprehension or prosecution of offenders
- the assessment or collection of any tax or duty or any imposition of a similar nature.
Where children are currently attending primary schools in Essex, but have a Hertfordshire residential address, we will receive contact information from Essex County Council for pupils in Year 5. That's so that we can write to inform you of the Hertfordshire secondary school transfer arrangements.
All admissions application data is stored securely and maintained in accordance with data protection legislation.
Hertfordshire online systems that are publicly available for entry of personal application data are regularly independently tested to assess risk of penetration and to guard against unauthorised entry for access to personal or any other data. This includes ensuring that the username and password access meets industry level 3 standards.
We'll enter details directly into the online system for applicants who choose to make their applications on the paper form.
We won't share personal data for admissions and transport applications with anyone except schools and other admissions authorities that require the data in order to process applications for schools within their own authority.
How long we will keep your information
For the majority of pupils, we'll keep the information you supply us for 3 years after the end of compulsory education.
For pupils with an Education, Health and Care Plan, we'll keep the data for 35 years after the child’s date of birth.
Your legal rights
Further Education and Apprenticeships
We are able to access data from the Department for Education each term which identify the number of students enrolled on FE courses across Hertfordshire. These do not have identifiers for individual students, but do include age and gender of students on each course. We do not publish this data. We use this data as one source of information in developing the Hertfordshire Skills Strategy, which is published. We share aggregated data with Herts LEP in order to identify skills gaps within the workforce and to analyse take-up and completion of apprenticeships. We use aggregated data relating to adult learners within Step2Skills to assist in planning their programme. The DfE ensure the data is up to date and accurate. The privacy notice in respect of this data can be found here ESFA privacy notice - GOV.UK
Further Education support for young people with SEND
Support is available, subject to eligibility, for any young person with special educational needs and disabilities (SEND), up to the age of 19. From 19 onwards, students must have an education, health and care plan.
We receive information about students with SEND enrolled at colleges in Hertfordshire who may be entitled to support from HCC in order to continue their studies. This information is sent to us from:
- local further education colleges
- Independent Specialist Providers and Independent Learning Providers
- the Department for Education (DfE)
- Education and Skills Funding Agency (ESFA).
We process and analyse information about students with SEND to assess their eligibility for high needs funding and to understand the take up of places by students with learning disabilities and plan our services.
Our lawful basis for processing is to fulfil a task in the public interest and in line with our official authority under the Children and Families Act 2014 and Special Educational Needs and Disability Regulations 2014.
We will share data back to the relevant colleges of education providers.
We hold the data for 7 years.
Early Years Providers
What we will do with your information
- The information you give us will be held by the Early Years Service team (Children’s Services) of Hertfordshire County Council and will only be used to assess your eligibility to deliver Childcare Support entitlements and to derive statistics which inform decisions such as the funding of schools and early years providers.
- In order to deliver this service, we will share the information you provide on this form with The Department for Education (DfE) for statutory returns, other departments in Children's Services and your local Family Centre, who support the local authority by assisting families to access the services they are entitled to.
- We may also share information with third parties if we are legally obliged to do so, for example if it is necessary to safeguard or protect a child.
We may also share information with the police or other agencies if it is necessary for the following purposes:
a) The prevention or detection of crime.
b) The apprehension or prosecution of offenders.
c) The assessment or collection of any tax or duty or any imposition of a similar nature.
Why we need your information
The data on the form is gathered for the purpose of delivering childcare support. Hertfordshire County Council will use this information to monitor and evaluate the services on offer, ensuring that they meet the needs of the local community.
Hertfordshire County Council is obliged to collect and process this data under the following acts:
- Education Act 1996
- The Childcare Acts of 2006 and 2016.
- The Education (Information About Individual Pupils) (England) Regulations 2013
The information you have provided to us will be used alongside additional information obtained from your current and or previous early years Ofsted registration.
How long will we keep your information
The information that you supply us with will be kept on file for 25 years after your Ofsted registration has ceased, at which point it will be disposed of securely.
Childcare Support for 2 year olds - Supported Families
What we will do with your information
- The information you give us will be held by the Early Years Service team (Children's Services) of Hertfordshire County Council and will only be used to assess your eligibility for Childcare Support entitlements and to derive statistics which inform decisions such as the funding of schools and early years providers.
- In order to deliver this service we will share your information with The Department for Education (DfE) for statutory returns, other departments in Children's Services and your local Family Centre, who support the local authority by assisting families to access the services they are entitled to.
- We may also share information with third parties if we are legally obliged to do so, for example if it is necessary to safeguard or protect a child. This includes the police or other agencies if it is necessary for the following purposes:
a. the prevention or detection of crime
b. the apprehension or prosecution of offenders
c. the assessment or collection of any tax or duty or any imposition of a similar nature
Why we need your information
The data on this form is being gathered for the purpose of delivering Childcare Support. Hertfordshire County Council will use this information to carry out specific functions for which we are responsible.
Hertfordshire County Council is obliged to collect and process this data under the Education Act 1996, Section 13A of the Childcare Act of 2006 and 2016, including The Education (Information About Individual Pupils) (England) Regulations 2013.
The information you have provided to us will be used alongside additional information obtained from HM Revenue and Customs, the Department for Work and Pensions and any other sources as applicable, to validate entitlement for a 2 year old Childcare Support place, and subsequently for the purpose of Early Years Pupil Premium (EYPP) Entitlement.
How long will we keep your information
The information that you supply us with will be kept on file for 25 years after its creation, at which point it will be disposed of securely.
Family Centre Service
Data Controller
Hertfordshire County Council will be the Data Controller for this information and can be contacted at:
Hertfordshire County Council
Pegs Lane
Hertfordshire County Council SG13 8DN
What we will do with your information
• The information you give us will be held by the Early Years Service team (Children’s Services) of Hertfordshire County Council.
• To deliver this service, we will share your information, as appropriate, with other Hertfordshire County Council departments and organisations who support the local authority by assisting families to access the services they are entitled to and who we believe have the correct authority to act on your behalf. That includes (but is not limited to):
- Your local Family Hub/Centre
- Other departments in Children’s Services
- Public Health Nursing.
• We may also share information with third parties if we are legally obliged to do so, for example if it is necessary to safeguard or protect a child.
We may also share information with the police or other agencies if it is necessary for the following purposes:
a. The prevention or detection of crime.
b. The apprehension or prosecution of offenders.
c. The assessment or collection of any tax or duty or any imposition of a similar nature.
Why we need your information
The data on the form is gathered for the purpose of signing up your family with Hertfordshire’s Family Centres. Hertfordshire County Council will use this information to monitor and evaluate the services on offer, ensuring that they meet the needs of the local community.
Hertfordshire County Council is obliged to collect and process this data under the following acts:
• Section 1 of the Childcare Act 2006.
• The Apprenticeship, Skills, Children and Learning Act (ASCL) 2009.
• Section 72 of the Education and Skills Act 2008.
How long will we keep your information
The information that you supply us with will be kept on file for 25 years after its creation, at which point it will be disposed of securely.If you wish to withdraw consent at any time you can do so by contacting us. We will take no more than 5 working days to update your preferences in our systems.
Families First
Why we need your information
The data on this form is being gathered for the purpose of providing feedback on families first to help the development of our services. Hertfordshire County Council will use this information to take account of parent/carer experience of services and develop new services to meet identified need.
As a Local Authority Hertfordshire County Council has a responsibility to act in co-operation with other bodies to support the well-being of children and their familiesunder the provisions of Children Act 2004 and related legislation. The information you have provided will be used to allow us to fulfil this duty / responsibility.
What we will do with your information
The information you give us will be held within the Council by Families First and will only be used as described above. We may share anonymised data with our external partner groups, who also provide early help services but will not share identifiable information.
We may also share information with third parties if we are legally obliged to do so, for example if it necessary to safeguard or protect a child.
How long we will keep your information
The information that you supply to us will be kept on file for as long you remain part of the group.
Fostering
Norfolk County Council will act as the Lead Authority for the implementation of Foster East, which is fully funded by the Department for Education. Foster East contact details are provided at the end of this Notice.
To find out more about the project go to www.fostereast.org.uk
Purpose(s)
In Stable Homes, built on Love, the DfE recognised the need to recruit and retain more foster carers to boost fostering capacity. There is a need to transform the way we provide homes for children in care, so they are in the right homes, in the right places. When children cannot stay with their own families, they should have the opportunity to grow up in a fostering placement that can offer a stable family environment, as close to their existing community as possible.
Fostering Recruitment Support Hubs (Foster East) are centrally run recruitment services, working across groups of local authorities. They provide a single point of contact for people interested in fostering in a region, supporting them throughout the recruitment journey from initial enquiry to application.
The aim of the hub is to increase the number of foster carers recruited and provide more loving homes for vulnerable children. They also build and maintain relationships with prospective foster carers if they are not ready to foster at the point they enquire.
Foster East will collect and use your personal data in relation to your position as a person applying to be a foster carer. Before you can be approved as a foster carer, you must be assessed to consider whether you are suitable to foster children and young people. This involves the collection and recording of personal information about you, your family, and persons in your household.
The initial contact and enquiry information collected about you by Foster East will be collected on behalf of your Local Authority by Foster East who are a part of Norfolk County Council. The email address to contact them is foster@fostereast.org.uk.
If you are approved as a foster carer, the Partner Organisation (your Council/Local Authority) for your home address will continue to process further personal information to progress your application and they can provide you with any additional information about how they process your data.
The lawful basis for the processing is provided by: Children Act 1989 “22G General duty of local authority to secure sufficient accommodation for looked after children.
Whilst specific criminal conviction data is not being asked for within Foster East, potential foster carers are being asked if they have a criminal conviction (Y/N). The Information Commissioners Office is clear that information relating to the absence of convictions is still processing criminal conviction data.
Information sharing
Foster East will share personal information only with the relevant partner organisation (Council/Local Authority) for the area you would like to foster in:
- Bedford Borough Council
- Cambridgeshire County Council
- Central Bedfordshire
- Essex County Council
- Hertfordshire County Council
- Luton Council
- Norfolk County Council
- Peterborough City Council
- Southend-on-sea City Council
- Suffolk County Council
- Thurrock Council
For the purposes of the Data Protection Act 2018 and the UK General Data Protection Regulation, all participating local authorities are considered to be Data Controllers, in regard to the processing of personal data within Foster East. This is in recognition of the legal obligations for ensuring that personal information necessary for the Hub function, is processed and shared in accordance with data protection laws and related legislation.
Foster East will also share pseudonymised data with the Department of Education and Ofsted for reporting purposes. This means that we will replace information that could identify you with a 16 digit reference so that the DfE or OFTSED will not know who you are but your progression can be tracked without impacting on you.
How we store your information
Your information collected during initial Contact and Enquiry stages will be stored securely on a system called GOSS, this is the chosen platform governed by Norfolk County Council as the lead Local Authority for Foster East. All of your data is processed within the UK / European Economic Area.
Hertfordshire County Council are a Data Processor, acting as the data and performance lead for Foster East and will collect data about your fostering journey post Enquiry stage. The data will be pseudonymised and is collated to evidence fostering outcomes. The data will be securely submitted to Hertfordshire County Council by your Local Authority using an Excel CSV file and shared via our secure systems. The data provided will be collated and uploaded into the GOSS system for further processing by the Foster East team for reporting purposes.
The purpose of this process is to track the outcomes for each potential foster carer post Enquiry stage.
Each Local Authority will remain the data controller for the data they go on to process following the handover from the Foster East team to them. This can happen at different stages of the foster recruitment journey depending on your Local Authority. The Local Authority to whom you are referred to progress your application will have their own privacy notice that explains how they process your data.
Information will be retained by Foster East to allow for continuation of support by the Hub, for example, check in phone calls during the assessment process or offering exit interviews where an individual withdraws from the assessment process.
An example whereby this retention schedule will be utilised would be in the instance where a referral is made to a Local Authority which is deemed unviable due to information disclosed through either the Initial Visit, Application, Assessment or Approval stages of the assessment process which conflicts with local policy. This outcome will be returned to the Hub and captured for the purposes of reporting alongside the reason for not progressing. However, if the applicant would be a viable enquiring carer for another Local Authority in the Foster East partnership, whereby this policy of viability may differ, retaining information gathered will enable the Hub to recommend this enquirer to another Local Authority within the agreement.
Foster East uses DotDigital for marketing purposes. As such, your email address will be held on the DotDigital platform to enable us to send you email alerts and newsletters. You will receive messages from Foster East and may also receive messages from the Local Authority linked to where you want to foster. You will be given the opportunity to opt-in to this service when you register with us and you can unsubscribe at any time by following the links in each email that you receive, or by contacting us at foster@fostereast.org.uk.
Foster East will only use your data to promote regional services, data will not be used to market any other goods or services outside of the partnership.
Automated Decisions
All the decisions we make about you involve human intervention.
How long we keep your information for
Data generated by Foster East will be held for the 3 years, and for up to 10 years if you are successful in your application to become a foster carer.
In the event of termination of Foster East as a regional Fostering Hub, each Authority may continue to hold information originating from other parties for which they are Data Controller in accordance with their individual or required retention period.
GOSS interactive will only hold data for as long as they are contracted to do so. At the end of the contract period GOSS will cease to use the data and return all data to Norfolk County Council as lead authority for Foster East.
The Local Authority your information is shared with will hold your information in line with their retention period and you can contact them to find out this information.
Your Rights
If you have any queries relating to the way Foster East processes your information, you can contact Foster East at foster@fostereast.org.uk.
These queries may be regarding (but not limited to):
- exercising your rights in relation to the following:
- access to personal data
- right to rectification
- right to erasure (The right to be forgotten, unless there is a legal obligation to refuse this request)
- right to restriction of processing
- right to data portability
- right to object to profiling
If you have any concerns about Foster East’s use of your personal information, you can make a complaint to us at information.governance@norfolk.gov.uk
Or in writing to:
Foster East
County Hall
Martineau Lane
Norwich
Norfolk
NR1 2DH
Contact Number: 01603 222444
Website: www.fostereast.org.uk
Email: foster@fostereast.org.uk
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 111
www.ico.org.uk
Your responsibility to inform us of any changes to your data
Please keep us informed of your personal information changes during your working relationship with us. You can do this by contacting us at foster@fostereast.org.uk or calling us anytime 7 days a week from 8am – 8pm on 01603 222 444.
Opt-out rights for Foster East marketing
If you wish to opt out of email marketing, please contact us on the details provided above. You will also find an unsubscribe option at the bottom of all emails where you can choose to opt out at any time.
Updates to this Privacy Notice
We may update or revise this Privacy Notice at any time so please refer to the version published on our website for the most up to date details.
Births, deaths and marriages
Personal information collected from you in order to register an event is required by law. The main legislation which governs the collection of registration information is the Births and Deaths Registration Act 1953, the Marriage Act 1949 and the Civil Partnership Act 2004.
You may be legally obliged by these acts, and other legislation, to provide certain pieces of information. If you fail to provide information you are required to give us, you may be liable to a fine or we may not be able to provide the service you are applying for (for example, a marriage or a civil partnership).
Personal information may also be collected from you if you apply to us, for example, for a certificate or to correct information contained in a register entry.
The information you provide will be held and processed by registration officers for this registration district.
Registration information is retained indefinitely, as required by law. Any other personal data will be held for no longer than 2 years.
Data sharing
We'll provide a copy of any register entry to any applicant, provided they supply enough information to identify the entry concerned and pay the appropriate fee. The copy may only be issued in the form of a paper certified copy (a “certificate”). You can also apply for a certificate to the General Register Office.
Indexes for events registered with us are publicly available to help members of the public identify the registration record they might need. Indexes are available in paper format.
A copy of the information collected by a registration officer will also be sent to the Registrar General for England and Wales so that a central record of all registrations can be maintained.
We may share registration information with other organisations in the course of carrying out our functions, or to enable others to perform theirs.
We'll only share information where there is a lawful basis to do so for the following reasons:
- statistical or research purposes
- administrative purposes by official bodies e.g. ensuring their records are up-to-date in order to provide services to the public
- fraud prevention or detection, immigration and passport purposes.
Your rights
Contact the Registrations service for further information about the data we hold and a list of the organisations we share registration data with (along with the purpose and lawful basis for sharing the data).
You have the right:
- to request access to the personal information we hold about you
- to be informed about the collection and use of your personal information
- for incorrect information to be corrected (where the law permits)
- to request us to restrict the processing of your personal information.
In certain circumstances you have the right to object to the processing of your personal information. Your information will not be subjected to automated decision-making.
Data controllers
The superintendent registrar is the data controller for birth, marriage and death registrations and can be contacted at:
The Old Courthouse
St Albans Road East
Hatfield
AL10 0ES.
Hertfordshire County Council is the data controller for civil partnership registrations and can be contacted at:
Hertfordshire County Council
Pegs Lane
Hertford
SG13 8DN.
The Registrar General for England and Wales is the joint data controller for birth, marriage, death and civil partnership registrations and can be contacted at:
General Register Office
Trafalgar Road
Southport
PR8 2HH.
The Data Protection Officer is:
Elaine Dunnicliffe
County Hall
Pegs Lane
Hertford
SG13 8DN.
Highways and transport
We process personal data to meet our statutory obligations and public task as Highways Authority (Highways Act 1980 and subsequent legislation) including duties for Rights of Way such as footpaths and bridleways, and the maintenance of the Definitive Map.
This includes:
- maintenance of highways met at the public expense and the avoidance of obstruction on all highways and rights of way
- consultation on new traffic schemes and improvements or changes of route
- granting licences for temporary and permanent changes which affect the highway or pavement including skips and scaffolding, street cafes and street parties, approving and constructing dropped kerbs and disabled parking bays.
- granting temporary bus stop suspensions to ensure streetworks can be delivered in accordance with the Construction (Design and Management) Regulations 2015 and the Traffic Management Act 2004.
We'll share data with our third party contractors where it is necessary to provide a service to you, or to respond to your enquiries or complaints about our services.
We'll retain data as identified in our retention scheme according to the business purposes. Routine highways fault reports are held for 2 years but permit applications, including dropped kerbs, will be held for 7 years.
Transport
- We process personal data to meet our statutory obligations and public task as transport authority. This includes the issuing and management of concessionary and SaverCard bus passes.
- Some of this data is collected directly by third party contractors on our behalf. We'll also share data with our contractors where it's necessary to provide a service to you, or to respond to your enquiries or complaints about our services.
- We will hold data in respect of concessionary cards applications for seven years.
Libraries and Heritage Services
Libraries
We collect information about you so that you can use the services that libraries offer. Your data is kept safely and securely and will be deleted if you don’t use our services for two years. This means that your membership will be deleted and you will need to sign-up for a new membership to use Library Services.
What data do we collect?
Name
Address
Date of birth (this information is required so that we can apply any age-related concessions accurately)
Emails address
Gender (optional)
Phone number(s)
Ethnicity
Who do we share your data with?
We'll only share your information under specific circumstances:
with third party organisations who provide services on our behalf. Our contracts require them to treat your personal information with the same care that we do:
- Bolinda – supplier of our ebook and eaudiobook service
- Overdrive – supplier of magazines online
- PressReader – supplier of newspapers online
- Bibliotheca – supplier of library kiosks
- Lorensbergs – supplier of the public PC booking service in libraries
- Solus – supplier of the library app
- Nottinghamshire County Council – supplier of Hertfordshire Performing Arts online portal
with partner organisations where it will improve your service. We'll ask you for your consent before sharing:
- SELMS – consortium of library authorities who interlend books
with other organisations such as the police/and or security services where we are legally required to do so.
We’ll also ask for your consent to contact you about library services and events, and if you agree we will sign you up for our monthly enewsletter. You can unsubscribe at any time.
Hertfordshire Archives and Local Studies (HALS Hertfordshire County Council)
will collect and use the personal information that you give us for the purpose of administering the event booking and to inform future planning. This personal information may include name, address, email address, and phone number.
We will only share your information with third parties in order to process your order, take payment and provide the services that you have asked for, unless required by law. All data is stored in the UK. All financial transaction information including customer information is processed separately by Hertfordshire County Council’s payment system.
We supply goods and services by contract according to our terms and conditions, in line with UK law including copyright, data protection and consumer rights. Details of transactions provide evidence that HALS has provided services in line with these. For this purpose, booking data will be kept for seven years.
For any events that use items from the archive and library collections, we are also using data for the purpose of providing and monitoring archive and library services, and for document security. As a Local Authority Hertfordshire County Council (HCC) has a responsibility (public task) to deliver the service and ensure document security under the provisions of legislation as set out in the Collections Management Policy. The information you have provided will be used to allow us to fulfil these responsibilities. For this reason, personal data will be kept for 25 years.
If you would like to request copies of your data or request that your data is deleted please contact us by email at hals.enquiries@hertfordshire.gov.uk or by telephone on 0300 123 4049.
Museums Development
Museums Development Privacy Notice- August 2022
Hertfordshire Museums Development Service is a service of Hertfordshire County Council. We work in partnership with SHARE Museums East, part of Norfolk Museums Service, a Service of Norfolk County Council, to provide advice, support, and training to museums in Hertfordshire.
Use of personal information
The personal information we collect may include name, physical address, email address, phone number, information about interactions we have with you, records of your attendance at our training events or network events, information provided from any evaluation forms or surveys you have completed and details of correspondence that we have sent to you or received from you.
- We may use the information we hold about you to Process bookings for training events, including making provision for your stated needs and preferences as far as reasonably practicable.
- Maintain records of who attended our events, and which organisations they represent.
- Send you communications which we think you may find interesting via our e-newsletter or emails.
- Invite you to partake in any survey or research which will improve our service, including surveys, questionnaires, and evaluation forms.
- Carry out statistical analysis about who uses our services.
- Share information regarding the Museum Development programme with our funders SHARE as part of our grant contract with SHARE. This may include names of participants and organisations attending events or applying for grants.
- Where necessary, share information about you with other approved third parties such as trainers, consultants and contractors, to ensure they provide you with the best service possible. These third parties will only use your data for the specified purpose for which we have contracted, engaged or partnered with them, and will not use it for any other reason or share it with any other individuals or organisations. The information we share may include name and contact details. To enable us to operate effectively and to improve the services we offer, we use third party websites including Icaris CRM.
Personal information collected will only be shared with third parties in order to provide the services that you have asked for, unless required by law. All data is stored in the UK. The activities we deliver are publicly funded by Arts Council England and this information will be retained for a period of up to seven years. For audit and reporting purposes certain information, such as names of organisations participating in HMDS programmes and activities, may be retained for up to seven years beyond the end of the funding period.
Marketing
We use Update Me to send e-news about our service to subscribers. This is an opt-in service and people also subscribe via our website. We will only share this information with a third party to inform you about our events, services and news.
Your details will be kept until you opt out or unsubscribe from the service. You can opt out at any time by emailing hals.enquiries@hertfordshire.gov.uk
Environment, recycling and waste
We process personal data to meet our statutory obligations and public task as:
- Waste Disposal Authority
- Planning authority for Minerals Waste and the council’s other statutory responsibilities
- Lead Local Flood Authority.
This includes:
- consultations
- planning processes
- provision and management of Household Waste Recycling Centres, including operation of ANPR and CCTV cameras
- investigation of flooding incidents and associated risk management
- investigation of complaints relating to our services.
Some of this data is collected directly by third party contractors on our behalf. We will also share data with our contractors where it is necessary to provide a service to you, or to respond to your enquiries or complaints about our services.
We will only retain CCTV and ANPR data where there is an incident which requires investigation. We'll delete it once the matter has been fully resolved.
Other data is held as identified in our retention scheme according to the business purposes.
Fire & Rescue
Our activities cover the council’s responsibilities and authority under both fire-related legislation and as a Trading Standards authority, including weights and measures.
Most registration data will be held for 2 years. We'll hold data longer:
- where it is likely to have a significant impact on land underlying premises. In those cases, we may hold the data for up to 60 years (for example, diesel, petroleum and explosives licences)
- if the data relates to inspection, investigation or prosecution. In those cases, we'll hold data for 10 years after the final resolution of the matter.
Fire & Rescue Services Act 2004, Regulatory Reform Order (Fire Safety) 2005; Civil contingencies Act 2004 and related legislation
- We hold data in relation to properties where fire appliances have been called out, and some details of people affected by emergencies (if they've been provided).
- We hold data relating to businesses where premises are required to be inspected or licensed for flammable and explosive materials.
- We hold personal data where adults and young people have been offered or have taken up fire prevention checks or training courses. This includes safe and well visits and prevention programmes.
- We use statistical analysis of data, both manual and automated, to understand our local population, its safety risks and future needs.
- We'll request personal data from other organisations, and share personal data with them where necessary, when we need to manage incidents covered by the Civil Contingencies Act.
- Where we offer training on a commercial basis to employees of other organisations, we process data under our legitimate interests as a training provider.
If your household or business has accessed the fire and rescue service via an emergency call, your personal information will be shared with the Home Office for research and statistical purposes. The information is provided via the IRS (Incident Recording System), a website managed by the Home Office. It collects information on the incidents attended by fire and rescue services, for example fires, false alarms, road traffic collisions.
Some of this information is personal and sensitive so the Home Office is responsible for ensuring that all data is processed in line with data protection legislation. Full information on GOV.UK.
We may process some of your information to identify what (if any) other financial support may be provided or open to you. For us to do this we will share your information with another Council team.
This information may be combined with other information that the Council (and others) hold about you. We do this as part of our public task- supporting those who may be in need.
If you object to the Council using your information in this way please contact the council’s data protection team at data.protection@hertfordshire.gov.uk.
NHS England and Fire and Rescue Services (FRS) in England share data to allow us to identify households in Hertfordshire with a resident aged over 65 to allow Fire Service personnel to undertake home safety assessments for those who would most benefit from a visit. We do not receive any health related information only address and a year of birth before 1954. This information is updated annually and we delete old sets on receipt of the updated information.
Our lawful basis for processing this data is that we are carrying out a task in the public interest, and in line with our official responsibilities for fire safety and well-being.
The majority of fire deaths in the UK occur amongst the elderly population. However older people are also vulnerable to a number of other health risks. A home visit form the FRS helps people feels safer and can reduce risk significantly.
This work has been undertaken since 2007, and shown significant reductions in fire deaths and injuries so we know this work can save many lives. The FRS and NHS will continue to work together in the future to ensure the visits undertaken by the FRS are effective in helping to make people safe and well.
Trading standards
Our activities cover the council’s responsibilities and authority under both fire-related legislation and as a Trading Standards authority, including weights and measures.
Most registration data will be held for 2 years. We'll hold data longer:
- where it is likely to have a significant impact on land underlying premises. In those cases, we may hold the data for up to 60 years (for example, diesel, petroleum and explosives licences)
- if the data relates to inspection, investigation or prosecution. In those cases, we'll hold data for 10 years after the final resolution of the matter.
We process personal data to investigate, regulate and enforce a wide range of legislation which aims to protect consumers. That includes the restriction of age-related products, which may include processing young people's data.
We receive personal data from a number of other agencies who provide enforcement or advice services to enable us to take action on complaints or enquiries.
We also share data with organisations where we believe they have the correct authority to act on your behalf. That includes (but is not limited to):
- police
- other Trading Standards services
- central government
- local district or borough councils
- National Trading Standards Scams team
- National Fraud Intelligence Bureau
- Citizens Advice (local or national offices)
- RSPCA.
This is work carried out in the public interest and in the exercise of our official authority
Council meeting webcast and recordings
We offer a live webcast of some formal council meetings and publish a copy of the broadcast on our website.
We do this in line with our statutory responsibilities to promote engagement with the democratic process and ensure information is accessible to as many citizens as possible.
- Recordings are published on the website for one year.
- The official record of the meeting is the published minutes which are available on our website.
Cameras – CCTV, ANPR and bodycams
We use surveillance cameras in a variety of situations and forms to protect our property and staff. This includes:
- CCTV inside and outside some public buildings
- CCTV on and inside fire appliances (fire engines)
- CCTV on roads to identify congestion by recording number plates and the time taken to travel between points. We don't continuously track vehicles and we can't identify who is within a vehicle. We only hold this data for 30 days – after that the data is overwritten. This data is processed in Canada which meets the EU standard for adequate Data Protection Legislation.
- CCTV outside household waste recycling centres to show customers if there's a queue. These are set to ensure no personal data is captured.
- ANPR at our recycling centres to avoid them being used for commercial use and permits are issued where vans or trailers are used.
- Some staff or contractors' staff wear bodycams.
- Security staff at Robertson staff will be wearing bodycams for the duration of its operation as a vaccine hub.
More about
Where CCTV is used on school transport, the transport operator is the Data Controller.
Profiling for service planning
We analyse our existing service data to make sure we can provide the services needed in the future.
Sometimes we may compare or combine this data with population data from other sources, official data from Office for National Statistics, NHS Digital or commercial sources.
We don't use this to identify individuals – only to forecast future demand (for example, demand for school places, social care and health trends.
We also profile to identify people who might be interested in supporting our work in specialised areas (for example, as foster carers or adoptive parents). We might also use profile data to identify people who would most benefit from a targeted service.
Some of this anonymous data is used on Herts Insight to help decision-makers across the county improve and target our service provision.
Whenever we do this it is to support our official authority and in the public interest. We would also make the opportunity available through other methods.
Channel and Prevent
HCC is a partner agency of Channel which aims to identify and support individuals at risk of being drawn into terrorism. When necessary we share data about individuals with other Channel partners including Police and Probation services; other local authorities and health providers; schools and colleges.
Channel does this with the knowledge of the individual where possible but we are able to share without informing people who do not wish to participate in the process where this is considered necessary. The Local authority has a statutory duty to participate in Channel under the Counter Terrorism and Security Act 2015.
The Channel programme is the responsibility of the Home Office. Please also see their Privacy Notice.
Law enforcement (including fraud)
Generally we process personal and sensitive data for the purposes of the prevention, investigation, detection, and, prosecution
of criminal offences. This includes safeguarding against and prevention of threats to public security.
The County Council is a participant in the 10 Community Safety Partnerships (CSP) which are a requirement of the Crime and Disorder Act 1998. These are led by the District and Borough Councils. The sharing of personal data is governed by Information Sharing Agreements with each Partnership. In addition to the District and Borough Councils these partnerships also include the Police, health trusts, housing providers, probation services and local voluntary organisations appropriate to each area.
Personal data is processed as it is necessary for the Council to do so for law enforcement purposes. Where any personal data is sensitive then it is processed as it is strictly necessary for law enforcement purposes and to exercise statutory functions as well as to prevent fraud.
Shared Anti Fraud Service (SAFS)
We process personal data for the above purposes. This is so as to protect public funds. This includes, but is not limited to, the investigation of
- council tax fraud
- blue badge misuse
- payroll and pensions fraud
- procurement and contract fraud
- social housing fraud.
We receive personal data from a number of other agencies who provide information to enable us to take action against alleged fraud.
We also share data with other law enforcement agencies or local authorities if required by law, such as:
- the police and judicial agencies e.g. courts
- district and borough councils
- the Department for Work and Pensions
- employers
- HMRC
- government agencies.
Our legal basis to process the data is set out above.
The personal information we obtain for the purpose of fraud investigation may also be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment. CIFAS, the anti-fraud organisation, has further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights.
In addition Hertfordshire County Council is a participant in the Cabinet Office’s National Fraud Initiative, which is a data matching exercise to assist in the prevention and detection of fraud. The Cabinet Office requires us to provide particular sets of data for this exercise, using its powers in Part 6 of the Local Audit and Accountability Act 2014.
We will hold your personal information for 10 years where personal data relates to law enforcement purposes. We may also be required to keep data for longer where we have a statutory duty to do so, for example to comply with criminal justice retention schedules or safeguarding.
See our policy on safeguarding use of personal data when meeting the Council’s law enforcement responsibilities (PDF, 142kb)
Special public interest conditions
This is the policy for Hertfordshire County Council’s processing of special
categories of personal data and criminal offence data.
As part of Hertfordshire County Council’s statutory and corporate functions we process special category data and criminal offence data in accordance with the requirements of Article 9 and 10 of the General Data Protection Regulation (‘GDPR’) and Schedule 1 of the Data Protection Act 2018 (‘DPA 2018’).
Some of the Schedule 1 conditions for processing special category and criminal offence data require us to have an Appropriate Policy Document (‘APD’) in place, setting out and explaining our procedures for securing compliance with the principles in Article 5 and policies regarding the retention and erasure of such personal data.
This explains our processing and satisfies the requirements of Schedule
1, Part 4 of the DPA 2018.
It supplements our website Privacy Notice and excludes processing for Law Enforcement Purposes.
Special category data
Special category data is defined at Article 9 GDPR as personal data revealing:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data for the purpose of uniquely identifying a natural person
- health details
- a natural person’s sex life or sexual orientation.
Criminal offence data
Article 10 GDPR covers processing in relation to criminal convictions and offences or related security measures, and section 11(2) of the DPA 2018 specifically confirms that this includes personal data relating to the alleged commission of offences or proceedings for an offence committed or alleged to have been committed, including sentencing. This is collectively referred to as criminal offence data.
Conditions for processing special category and criminal offence data
We process special categories of personal data under the following GDPR Articles:
- Article 9(2)(b) –performing or exercising obligations or rights which are imposed or conferred by law on HCC or a data subject in connection with employment, social security or social protection law.
This includes, but is not limited to, advice in respect of welfare benefits and the development of programmes to assist our residents including fuel poverty; access to free school meals and other education support; supporting the work of elected members.
- Article 9(2)(g) - reasons of substantial public interest.
HCC has statutory functions under a wide range of legislation, the areas where we are most likely to process this data includes safeguarding vulnerable adults and children; school place planning and admissions; special educational needs; community protection; but may include any of our statutory responsibilities where need arises.
Our processing of personal data in this context is for the purposes of substantial public interest and is necessary for the carrying out of our role. This includes, but is not limited to, Education, Health and Care Assessments and Plans (EHCP) and associated tribunal hearings; school place applications and appeals; supporting the process for Safeguarding reviews. Many of these functions require us to share data with other organisations with a related statutory responsibility this is part of our processing where necessary.
- Article 9(2)(h) – provision of health or social care
The necessity for processing to support our adult and children’s social care function is explicit and includes the management of social care systems and services. We share information with health services when we are both providing care and it is in the data subjects best interests.
- Article 9(2)(c) –to protect the vital interests of the data subject or of another natural person.
This would include for the immediate protection of vulnerable adults and children, their carers and our staff or other professionals in contact with them.
- Article 9(2)(i) – public health
The Council has responsibility for public health in Hertfordshire. Our processing includes protecting against serious cross-border threats to health as well as commissioning services which support the health of particular groups such as school nursing and school weight and height measurement programmes. Public Health analysts conduct analysis of data to allow us to ensure we understand the broader health needs of the population.
- Article 9(2)(j) – archiving purposes in the public interest.
Hertfordshire Archives are a Place of Deposit for Public Records under the terms of the 1958 Public Records Act.
Hertfordshire Archives and Local Studies (HALS) provide public access to these records where possible and hold them on deposit where this isn’t possible.
The County Council transfers some documents to the HALS for deposit, including older adoption records.
- Article 9(2)(f) – the establishment, exercise or defence of legal claims.
This includes processing relating to court proceedings in respect of any of our statutory functions or law enforcement functions, such as child custody proceedings and care proceedings.
- Article 9(2)(a) – explicit consent
When none of the provisions set out above apply, and it is necessary to process your personal data, we will seek your consent. When we do this we make sure that the consent is clear and for one or more specified purposes; we require you to confirm the consent with affirmative action, such as ticking a box or providing a signature and we keep a record of this as the condition for processing.
We process criminal offence data under Article 10 of the GDPR
Examples of our processing of criminal offence data include pre-employment checks and Disclosure and Barring Service checks.
Appropriate Policy Document
Most of the substantial public interest conditions in Schedule 1 Part 2 of the DPA 2018, plus the condition for processing employment, social security and social protection data, require HCC to have an appropriate policy document (APD).
This section of the policy is the APD for HCC. It demonstrates that the processing ofspecial category and criminal offence data based on these specific Schedule 1 conditions is compliant with the requirements of the GDPR Article 5 principles.
Description of data processed
Our processing for reasons of substantial public interest relates to the data we receive or obtain in order to fulfil our statutory functions as a County Council, examples are given above.
We also process special category data about our employees which is necessary to fulfil our obligations as an employer. This includes information about their health and wellbeing, ethnicity, photographs and their membership of any trade union. We maintain a record of our processing activities in accordance with Article 30 of the GDPR.
Schedule 1 conditions for processing
Special category data
We process special category data for the following purposes in Part 1 of Schedule 1:
- Paragraph 1(1) employment, social security and social protection.
We process special category data for the following purposes in Part 2 of Schedule 1.
All processing is for the first listed purpose and might also be for others dependent on the context:
- Paragraph 6(1) and (2)(a) statutory, etc. purposes
- Paragraph 8(1) and (2) Equality of opportunity
- Paragraph 10(1) preventing or detecting unlawful acts
- Paragraph 11(1) and (2) protecting the public against dishonesty
- Paragraph 12(1) and (2) regulatory requirements relating to unlawful acts and dishonesty
- Paragraph 17 Confidential counselling
- Paragraph 18 Safeguarding of children and individuals at risk
- Paragraph 19 Safeguarding of economic well-being of certain individuals
- Paragraph 20(1) Insurance
- Paragraph 23 (1) and 92) Elected representatives responding to requests
- Paragraph 24(1) and (2) disclosure to elected representatives.
Criminal offence data
We process criminal offence data for the following purposes in parts 1 and 2 of Schedule 1:
- Paragraph 1 – employment, social security and social protection
- Paragraph 6(2)(a) – statutory, etc. purposes
Procedures for ensuring compliance with the principles
Accountability principle
We have put in place appropriate technical and organisational measures to meet the requirements of accountability. These include:
- The appointment of a data protection officer who reports directly to our highest management level.
- Taking a ‘data protection by design and default’ approach to our activities.
- Maintaining documentation of our processing activities.
- Adopting and implementing data protection policies and ensuring we have written contracts in place with our data processors.
- Implementing appropriate security measures in relation to the personal data we process.
- Carrying out data protection impact assessments for our high-risk processing.
We regularly review our accountability measures and update or amend them when required.
Principle (a): lawfulness, fairness and transparency
Processing personal data must be lawful, fair and transparent. It is only lawful if and to the extent it is based on law and either the data subject has given their consent for the processing, or the processing meets at least one of the conditions in Schedule 1.
We provide clear and transparent information about why we process personal data including our lawful basis for processing in our privacy notice, staff privacy notice and this policy document.
Our processing for purposes of substantial public interest is necessary for the exercise of the statutory functions for which HCC is the responsible local authority.
Our processing for the purposes of employment relates to our obligations as an employer. We also process special category personal data to comply with other obligations imposed because we are a public authority, e.g. the Equality Act, the Freedom of Information Act.
Principle (b): purpose limitation
We process personal data for purposes of substantial public interest as explained above when the processing is necessary for us to fulfil our statutory functions, to safeguard and protect vulnerable adults and children, to protect the public from dishonesty, preventing or detecting unlawful acts or for disclosure by and to elected representatives.
We are authorised by law to process personal data for these purposes. We may process personal data collected for any one of these purposes (whether by us or another controller), for any of the other purposes here, providing the processing is necessary and proportionate to that purpose.
If we are sharing data with another controller, we will document that they are authorised by law to process the data for their purpose.
We will not process personal data for purposes incompatible with the original purpose it was collected for.
Principle (c): data minimisation
We collect personal data necessary for the relevant purposes and ensure it is not excessive. The information we process is necessary for and proportionate to our purposes. Where personal data is provided to us or obtained by us, but is not relevant to our stated purposes, we will erase it.
Principle (d): accuracy
Where we become aware that personal data is inaccurate or out of date, having regard to the purpose for which it is being processed, we will take every reasonable step to ensure that data is erased or rectified without delay. If we decide not to either erase or rectify it, for example because the lawful basis we rely on to process the data means these rights don’t apply, we will document our decision.
Principle (e): storage limitation
All special category data processed by us for the purpose of employment or substantial public interest is, unless retained longer for archiving purposes, retained for the periods set out in our retention schedule. We determine the retention period for this data based on our legal obligations and the necessity of its retention for our business needs. Our retention schedule is reviewed regularly and updated when necessary.
Principle (f): integrity and confidentiality (security)
Electronic information is processed within our secure network or on secure cloud facilities in line with GDPR requirements. Hard copy information is processed in line with our security procedures.
Our electronic systems and physical storage have appropriate access controls applied.
The systems we use to process personal data allow us to update personal data at any point in time where appropriate.
Policy review date
This policy will be retained for the duration of our processing and for a minimum of 6 months after processing ceases.
This policy will be reviewed annually or revised more frequently if necessary.
Additional special category processing
We process special category personal data in other instances where it is not a requirement to keep an appropriate policy document. Our processing of such data respects the rights and interests of the data subjects. We provide clear and transparent information about why we process personal data including our lawful basis for processing in our privacy notice
Youth Justice Services
Herts Youth Justice use personal information about young people who have committed criminal offences. This is to assist us in working with these young people to reduce re-offending and to reduce the risks to these young people, victims of youth crime and their communities. This includes:
- assessments undertaken following a Youth Caution or Youth Conditional Caution from the police or following conviction in the criminal court
- Sentencing Reports for the criminal courts
- supervision of young people on bail
- appropriate adult services for the young person at the police station
- support to parents to assist in the protection of children and reduce risk of re-offending
- support to victims.
Information is also used for statistical purposes, for example, to inform decisions on how we work with young people and their families and to assess the performance of the Youth Offender Team.
We share information relating to youth offending with partner agencies who are involved in working with young people, for safeguarding and public protection reasons.
We receive information directly from the young person and their family. We may also receive information from partner agencies where this is relevant, including from:
- Children's Services
- housing services
- health services (including GPs, substance misuse teams)
- schools and colleges
- police
- National Probation Service
- Courts and Crown Prosecution Service
- voluntary organisations and charities.
The information we collect and use includes:
- personal information such as name, date of birth, addresses and contact details
- characteristics such as ethnicity, gender, disability, home circumstances, language and health information
- significant people in the family and their details
- details of doctor, school and other professionals involved with a young person where appropriate, relevant medical information for children or parents / carers
- offending history
- school history
- assessments
- all contacts with Herts Youth Justice Service.
We share information without your specific consent where it is reasonable and necessary to do so to fulfil our public tasks, or where it is otherwise in the substantial public interest to do so. The law imposes safeguards to protect your privacy in these circumstances.
Information is stored securely and retained according to the nature of the offence or the contact you have had with us. Only authorised professionals from agencies involved with you will have access to this information.
The Youth Justice Service collect and lawfully process information about young people under the following legislation:
- Crime and Disorder Act 1998
- Criminal Justice Act 2003
- Legal Aid Sentencing and Punishment of Offenders Act 2012
- Police and Criminal Evidence Act 1994
- Children Act 1989
- Children Act 2004.
See our policy on safeguarding use of personal data when meeting the Council’s law enforcement responsibilities (PDF, 142kb)
Requesting documents via our website
When you request documents via our website, your email address is required in order to send you those documents.
Your information will not be shared with anybody outside Hertfordshire County Council's web team.
This information will be stored on our content management system for 6 months and then automatically deleted.
Hertfordshire County Council is the data controller for this information. If you would like to request copies of your data or request that your data is deleted, please email us at web.team@hertfordshire.gov.uk or phone us: 01992 588038.
Your legal rights
Website testing panel
Feedback from our website testing panel helps us improve things on the website for everyone.
We want our website to be as simple, clear and quick as possible for you to use.
It’s important that we test the website whilst we develop it to ensure we’re improving things for our customers.
Joining the panel
-
You can join the panel via the website testing panel sign up form. We'll ask for your name and email address so that we can send you our surveys.
-
We’ll keep the personal information we collect extremely safe.
-
We won’t share the information outside of Hertfordshire County Council. We won’t share your personal information with any other team within the council.
-
We plan to keep your personal information on an ongoing basis, as long as you're happy for us to do so.
-
Email web.team@hertfordshire.gov.uk if you’d like to leave the website testing panel at any time.
Completing surveys
When we email you, we'll send you a link and ask you to complete a survey/task using one of these online products:
When you complete a survey:
-
We won't directly ask you for any personal information. This means we won't be able to link your responses back to you.
-
We’ll only use the information we collect to see where improvements can be made on our website.
-
We may share the information collected within the survey with other teams in the council. However, your response will not be personally linked back to you.
Cycle training
Why we need your information
We gather your data on our request forms for the purpose of cycle training. We will use this information to allow for the provision of requested cycle training courses.
This information is being gathered and will be processed on the basis that you are giving consent for us to do so. If you wish to withdraw consent at any time you can do so by emailing cycle.training@hertfordshire.gov.uk.
What we will do with your information
The information you give us will be held by the Hertfordshire Cycling (Transport, Access & Road Safety) team of Hertfordshire County Council and will only be used to deliver cycle training.
We will not share this information with a third party or use it for any other purpose.
How long we will keep your information
The information that you supply to us will be kept on file for 1 year from the point of the request form's submission.
Your legal rights
Rural Estates Team
Who we are
Hertfordshire County Council Rural Estates Team manage a let agricultural estate as part of the Estates and Asset management function of the Resources Department. Our normal business can be summarised as:
- Providing property and land to rent.
- Property maintenance and repair.
- Managing your tenancy, lease or other contract, and account as your landlord.
The information is collected on behalf of Hertfordshire County Council which is the data controller.
Why we need your information
The information we hold is gathered for Hertfordshire County Council Rural Estates to assess applicants applying for property and land to rent.
What we will do with your information
The information you give us will be held by Hertfordshire County Council and the Rural Estates team of Hertfordshire County Council and will only be used to assess applications.
The information is being gathered and will be processed on the basis that you are giving consent for us to do so. If you wish to withdraw consent at any time you can do so by contacting the Rural Estates Team using any of the following methods:
Telephone: 01992 556238
Email: rural.estates@hertfordshire.gov.uk
Post:
Rural Estates
Hertfordshire County Council
CHO 343
County Hall
Hertford,
SG13 8DQ
We will not share this information with a third party or use it for any other purpose.
How long we will keep your information
We will keep your information until you wish to withdraw consent for us to or after a period of 2 years.
Your legal rights
SEN transport
Why we need your information
The data on this form is being gathered for the purpose of assessing whether your child is eligible for home to school transport. Hertfordshire County Council will use this information to provide appropriate home to school transport if your child is eligible.
Hertfordshire County Council is obliged to collect and process this data under the 1996 Education Act, the Education & Inspections Act 2006, the Education Act 1944 and is outlined in statutory guidance published by the Department for Education: Travel and Transport Guidance 2014, School and College Transport for 16-18 year old’s and Section 57 of the Apprenticeships, Skills, Children and Learning Act 2009, with regard to the responsibilities for the 19-25 year age group.
The information you have provided to us will be used alongside additional information obtained from your child’s Education, Health and Care Plan.
What we will do with your information
The information you give to us will be held by the Admissions and Transport department of Hertfordshire County Council and will only be used to assess whether your child is eligible for home to school transport and whether he/she has additional transport. In order to deliver this service, we will share your information with the Health team, Environment Department with responsibility for contracting transport and transport operators. For families in receipt of a Personal Travel Budget, data will also be shared with the software company, Allpay, that provides the direct payment cards and customer support.
We may also share information with third parties if we are legally obliged to do so, for example if it necessary to safeguard or protect a child.
We may also share information with the police or other agencies if it is necessary for the following purposes:
- the prevention or detection of crime
- the apprehension or prosecution of offenders
- the assessment or collection of any tax or duty or any imposition of a similar nature.
How long we will keep your information
The information that you supply to us will be kept on file for 35 years from the child’s date of birth.
Your legal rights
e-Petitions
Personal data submitted for e-petitions will be used to verify the number of qualifying signatories to the petition you have started and/or signed.
If you are the petition organiser, or are treated as such at any time for the purposes of the Council’s petitions scheme, your data may be shared with third parties in order to resolve the matter where they are the relevant contracted services providers of the Council.
Information provided to the Council will be held securely from the date you start or sign a petition until one year after that petition closes.
Data may also need to be shared in order to prevent or detect crime, to protect public funds or if any other legislation requires it.
If you would like to request a copy of your data held in the e-petition system, please email Democratic Services in the first instance at democratic.services@hertfordshire.gov.uk.
Adoption service
Hertfordshire Adoption Service Privacy Notice
Your personal data is protected by UK and EU legislation, specifically the UK General Data Protection Regulation (the 'UK GDPR'), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) 2003 and the Adoption and Children Act 2002 (ACA). We aim to exceed our legal obligations by following best practice and reviewing our procedures regularly.
Hertfordshire County Council is registered as a data controller with the Information Commissioner for the United Kingdom for those purposes for which personal information is collected when you make an adoption enquiry.
The information we collect from you will be used solely for adoption purposes; to assess if adoption is right for you and your family; if now is the right time for you to adopt and if you are able to adopt the children who currently need adoptive families.
We take our Data Protection Act (2018) obligations very seriously. The information you provide will be subject to rigorous security measures and procedures to make sure it can’t be seen, accessed or disclosed to anyone who shouldn’t see it. This information will form part of Hertfordshire County Council’s case record. Your information will be kept in line with Hertfordshire County Council’s retention schedule. We use non identifying information to inform data, local and government statistics, general and local practice requirements.
We will ask you to sign relevant forms in order for us to proceed with your application to adopt. The information you provide will be used to allow us to fulfil our responsibilities under the Adoption and Children Act 2002 and our legal basis for processing is therefore that we are undertaking a ‘public task’ set out in law. Special category data will be processed on the basis of substantial public interest (statutory and government purposes).
Should you approach another Adoption Agency you should inform them that you have been in contact with us. If you choose not to disclose this information this may also affect your application with other agencies should this information come to light later.
Who do we share your information with?
We may share information with relevant individuals, agencies, or organisations to verify the information you have provided. These may include contact with the Disclosure & Barring Service (DBS), the NHS or the Police and may include address and social care checks.
Data may also be processed and shared with government agencies, statutory bodies, police and health in order to comply with legal obligations. This will include data shared with the Adoption and Special Guardianship Leadership Board (ASGLB). The ASGLB will share this data with Ofsted to monitor the progress of the agency.
In general terms, the information you provide will not be transferred to a third party, unless it is appropriate to do so.
There may be certain circumstances, such as child protection matters, where we are legally obliged to share without your consent, however this will be only where strictly necessary and in accordance with our legal obligations.
How long we keep your data:
We will comply fully with the Data Protection Act and future legislation and any requests exercising individual’s rights will be considered, processed and responded to within the relevant statutory timescales. Information held on your adoption case file will be kept for a maximum of 102 years if you apply and are successful, 35 years if you apply and are unsuccessful or eight years if you withdraw your application during the process.
Your consent:
By providing us with your personal information you consent to the collection and use of that information for the purposes and in the manner described in this Privacy Policy. Hertfordshire County Council reserves the right to modify or amend this privacy statement. Any alterations to our policy on the collection or use of data will be made readily available.
Contact details:
For more information about your rights visit our website privacy policy.
If you have any further queries in regard to how Hertfordshire County Council Adoption Service will process your data in the first instance please speak to the adoption recruitment team. If you are not satisfied you can contact the Data Protection Team as follows:
Data Protection Team Hertfordshire County Council
County Hall
Pegs Lane
Hertford
SG13 8DQ
Tel: 01992 588099
Email: data.protection@hertfordshire.co.uk
You can also contact our Data Protection Officer at dataprotection.officer@hertfordshire.gov.uk or in writing to the address above.
If you are unhappy with the way that Hertfordshire County Council has used your data or with the way we have responded to a request you also have the right to contact the Information Commissioner's Office www.ico.org.uk
Community Spaces registration
Why we need your information
Your Community Space contact email address will only be kept for the purposes of sending you the guide to sign up to Community Spaces. If you have registered your interest, we may contact you using the stated email address to clarify the reasoning and support you to meet the requirements where possible
How long we keep your data
Your Community Space locations and information regarding safeguarding policies, risk assessments and public liability insurance will be kept as a record of its dealings with you under this scheme for auditing purposes for 6 years before destroying it.
Your consent
By clicking you agree to sharing data with us, you are providing permission for us to contact you with a reporting format and process to collect a general overview of the number of attendees to map demand.
Contact details
If at anytime you decide not to continue collecting this data, please contact VPA.Cell@hertfordshire.gov.uk who will remove your contact details from the monitoring list.
Community and People Wellbeing event registration
Why we need your information
The data on this form is being gathered for the purpose of event booking. Hertfordshire County Council will use this information to provide you with related correspondence, including but not limited to the agenda and feedback form for the event.
This information is being gathered and will be processed on the basis that you are giving consent for us to do so. If you wish to withdraw consent at any time you can cancel your booking by emailing Community.Wellbeing@hertfordshire.gov.uk
What we will do with your information
The information you give us will be held by the Community and People Wellbeing team of Hertfordshire County Council and will only be used to provide you with related correspondence, including but not limited to the agenda and feedback form for the event or adding you to our distribution list.
We will not share this information with a third party or use it for any other purpose
How long we will keep your information
The information that you supply to us will be kept on file for 1 year. If you signed up to our distribution list, you shall remain on this until you request to be removed.
What are your rights?
Hertfordshire County Council will be the Data Controller for this information.
You have the following rights in relation to this data:
- You have the right to be informed about what information we hold about you and how we use it.
- You have the right to request copies of any information the Council holds about you by making a subject access request.
- If information we hold about you is factually inaccurate you have the right to have it corrected.
- You have the right to object to the way we are using your data.
- You have the right to request that your data is deleted. However we may be unable to delete your data if there is a need for us to keep it. In this case you will receive an explanation of why we need to keep the data.
- You can also request that we stop using your data while we consider a request to have it corrected or deleted. There may be some circumstances in which we are unable to do this however we will provide an explanation if this is the case.
- In certain circumstances you may also request data we hold about you in a format that allows it to be transferred to another organisation.
- In the event that decisions are taken using automated processes you have the right to request that these decisions are reviewed by a member of staff and to challenge these decisions.
If you would like to request copies of your data, request that your data is deleted or have any other queries in relation to data which the Council holds about you please contact the Data Protection Team.
You can also contact our Data Protection Officer at dataprotection.officer@hertfordshire.gov.uk or in writing to the address above.
If you are unhappy with the way that Hertfordshire County Council has used your data or with the way we have responded to a request you also have the right to contact the Information Commissioner’s Office www.ico.org.uk.
Event registration
Why we need your information
The data on this form is being gathered for the purpose of event registration. Hertfordshire County Council will use this information to provide you with related correspondence, including but not limited to the agenda.
We are collecting this information with your consent for processing. If you choose to withdraw your consent at any time, you can cancel your booking via email. Specific instructions on how to do this will be clearly provided in your booking confirmation email.
What we will do with your information
The information you provide will be securely held by Hertfordshire County Council and will be used exclusively for purposes related to your event participation. This includes, but is not limited to, sharing event agendas and adding your email to our distribution list for event-related updates.
We will not share this information with a third party or use it for any other purpose
How long we will keep your information
The information that you supply to us will be kept on file for 1 year.
What are your rights?
Hertfordshire County Council will be the Data Controller for this information.
You have the following rights in relation to this data:
- You have the right to be informed about what information we hold about you and how we use it.
- You have the right to request copies of any information the Council holds about you by making a subject access request.
- If information we hold about you is factually inaccurate you have the right to have it corrected.
- You have the right to object to the way we are using your data.
- You have the right to request that your data is deleted. However we may be unable to delete your data if there is a need for us to keep it. In this case you will receive an explanation of why we need to keep the data.
- You can also request that we stop using your data while we consider a request to have it corrected or deleted. There may be some circumstances in which we are unable to do this however we will provide an explanation if this is the case.
- In certain circumstances you may also request data we hold about you in a format that allows it to be transferred to another organisation.
- In the event that decisions are taken using automated processes you have the right to request that these decisions are reviewed by a member of staff and to challenge these decisions.
If you would like to request copies of your data, request that your data is deleted or have any other queries in relation to data which the Council holds about you please contact the Data Protection Team.
You can also contact our Data Protection Officer at dataprotection.officer@hertfordshire.gov.uk or in writing to the address above.
If you are unhappy with the way that Hertfordshire County Council has used your data or with the way we have responded to a request you also have the right to contact the Information Commissioner’s Office www.ico.org.uk.
Elective Home Education
We keep this privacy notice under regular review, and it was last updated October 2024.
This notice explains what personal data (information) we hold about you, how we collect, use, and share information about you. We are required to give you this information under data protection law.
Hertfordshire County Council (HCC) collects, uses and is responsible for certain personal information about you. When we do so we are regulated under the United Kingdom General Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). We are responsible as ‘controller’ of that personal information.
Elective Home Education (EHE) sits within the Hertfordshire Virtual School Team and provides advice and guidance to families who are home educating their children. The EHE team ensure an appropriate standard of education is provided, signpost and support families if requested or deemed appropriate.
Personal information we collect and use
Information collected by us:
While supporting and assessing elective home education, we collect the following personal information when provided to us:
- Personal details (such as name, gender, age, date of birth, address, contact details, language, nationality, country of birth)
- Special category characteristics (such as ethnicity and special educational needs) Educational history (such as schools previously attended and attendance, attainment, and exclusion information)
- Other professional involvement (such as Attendance, Early Help, Social Care, SEN)
- EHE history (communication with families, visit reports, professional meetings)
- Evidence of a suitable education
We also obtain personal information including personal details, characteristics, educational history, and professional involvement, from other sources such as previously attended schools, NHS, other local authorities, and other HCC departments.
How we use your personal information
We use your personal information to:
- Maintain a record of children in Hertfordshire who are known to be home educated.
- Enable us to communicate with you and provide information on the services you need or are entitled to e.g. health.
- Provide advice, guidance, and support to you.
- Inform you about how to access services and facilities from other agencies that would generally be delivered via school.
- Advise and support families who request support with returning children to school.
- Make arrangements to establish the identities of children who are not registered at a school and are not receiving a suitable education otherwise.
- Analyse service provision and effectiveness and model patterns of service involvement to support future service delivery planning.
How long your personal data will be kept
We will hold personal information securely and retain it until a young person reaches the age of 25, after which the information is made inaccessible to system users or securely destroyed.
Reasons we can collect and use your personal information
We collect and use personal information to carry out tasks in the public interest. We rely on the following legal bases under UK GDPR:
- Article (6)(1)(e) - Public task: the processing is necessary to perform a task in the public interest or for official functions (task or function has a clear basis in law)
When we collect or share special category personal data, we rely upon the following legal bases under UK GDPR:
- Article 9(2)(e) - Reasons of substantial public interest. We rely on the ‘equality of opportunity or treatment’ purpose condition from Schedule 1 if the Data Protection Act 2018 when relying on Article 9(2)(g) to process your special category data.
- Article 9(2)(j) – Archiving, research, and statistics. We rely on the ‘Research’ purpose condition from Schedule 1 of the Data Protection Act 2018 when relying on Article 9(2)(j) to process your special category data.
Who do we share your personal information with?
We share your personal information with:
- Teams within Hertfordshire working to improve outcomes for children and young people.
- Schools.
- Other Local Authorities.
- Schools and in-year admissions, when a school place is required at the request of the parent or when a suitable education is not being provided and a school needs to be identified for the purpose of a School Attendance Order.
- Post-16 education and training providers.
- Partner organisations signed up to the Hertfordshire Information Sharing Agreement, where necessary, which may include NHS, health visitors, midwives, police, doctors, and mental health workers.
- Hertfordshire NHS Trusts who are responsible for Child Health Information Service that facilitates the screening and immunisation programmes for the health and wellbeing of your child (if you do not wish your child to take part in these programmes, this will not affect your child being entitled to access any additional services offered).
- Department of Education, and other government departments, as required.
We do not share information about our children or young people with anyone without consent unless the law and our policies allow us to do so.
We will share your personal information with law enforcement or other authorities if required by applicable law.
The Children and Young People (CYP) Data Set
The CYP Data Set is owned and managed by Hertfordshire and contains personal data and special category information about children attending Hertfordshire schools and matches additional personal data from multiple data sources within Hertfordshire to the pupils.
The aim of the dataset is to allow statistical analysis and research to:
- Support and inform council transformation by ensuring the holistic characteristics and needs of the child population are fully understood.
- Provide appropriate levels of insights, evidence, and evaluation to embed knowledge and understanding of children and young people’s needs and issues into service programmes and projects, including the commissioning of new services.
- Inform future service delivery planning and integrated working to improve outcomes for children and young people.
We have robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. The child-level data set is not shared outside Hertfordshire County Council. All personal data is stored in secured electronic files with restricted access. Only pseudonymised data is used for analysis. Outputs and analysis take the form of aggregated data and are for the purpose of Hertfordshire teams and partners working to improve the outcomes for children and young people.
Your Rights
Under UK GDPR you have rights which you can exercise free of charge which allow you to:
- Know what we are doing with your information and why we are doing it.
- Ask to see what information we hold about you (subject access request).
- Ask us to correct any mistakes in the information we hold about you.
- Object to direct marketing.
- Make a complaint to the Information Commissioners Office.
- Withdraw consent at any time (if applicable.)
Depending on our reason for using your information you may also be entitled to:
- Ask us to delete information we hold on you.
- Have your information transferred electronically to yourself or to another organisation.
- Object to decisions being made that significantly affect you.
- Object to how we are using your information.
- Stop us using your information in certain ways.
We will always seek to comply with your request however we may be required to hold or use your information to comply with legal duties. Please note, your request may delay or prevent us delivering a service to you.
For further information about your rights, including the circumstances to which they apply, see the guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under UK GDPR.
If you would like to exercise a right, please contact the Data Protection Team, Hertfordshire – dataprotection@hertfordshire.gov.uk
Keeping your personal information secure
We have appropriate measures in place to prevent personal information being accidently lost or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
Contact
Please contact Data Protection Team at dataprotection@hertfordshire.gov.uk to exercise any of your rights, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.
UKGDPR also gives you the right to lodge a complaint with the Information Commissioner who may be contacted via the Information Commissioner’s website or on 03031 231113.
Changes in your circumstances
Please notify us immediately if there are any changes in your circumstances and personal details so we can maintain an accurate and up to date record of your information.