Hampshire County Council general privacy notice
The General Data Protection Regulation and Data Protection Act 2018 require organisations, businesses and the government to keep your personal information secure and to only use it in accordance with the data protection principles. This page sets out the County Council's general privacy notice. Service specific privacy notices are also available.
- General Privacy Notice
We ensure that any personal information used by us or given to us is treated in accordance with data protection legislation.
This privacy notice explains how we use your personal information and the ways in which we protect your privacy.
When we collect information about you, we may provide you with a detailed privacy notice which tells you more about why we are collecting it and what we are using it for. We will only use your information in accordance with that privacy notice.
Details of the County Council’s approach to data protection can be found in the County Council’s Data Protection Policy.
- How we use your personal information
We collect and use your personal information so we can provide you with statutory and other services. We use your information for the purpose for which you provided the information to include the delivery of services for you. We also use this information to monitor our performance in responding to your request.
We use your information in the following ways:
- to tell you about services and provide services appropriate to you, for example highlighting additional help or services available to you
- for insight purposes to allow us to analyse patterns and trends of service usage
- for service and financial planning, to help us create policy and inform decision making e.g. identifying where children's centres are most needed
- to process financial transactions including grants and payments involving the County Council or where the Council is acting on behalf of other government bodies e.g. Department for Work and Pensions
- to help us to verify your identity if you ask us for services
- to ensure that the County Council meets its duties, including those imposed by the Equality and Health and Safety Acts
- where necessary for law enforcement functions e.g. licensing, planning enforcement, trading standards and food safety where the County Council is legally obliged to carry out such processing
- to help investigate any concerns or complaints you have may have about the services you receive
- for the establishment, exercise or defence of legal claims
- where otherwise allowed under the General Data Protection Regulation and Data Protection Act 2018. For further information refer to the Information Commissioner's website
- in order to provide tailored communications to Hampshire residents about Council services we use data which has been analysed by third parties. This enables us to target appropriate messages via social media to the relevant sections of the population such as individuals in a certain age range or geographical area of Hampshire
Services such as education and social care, protection of vulnerable children and adults, and the support of public health and wellbeing, may involve collecting, using and sharing special category data as defined by the General Data Protection Regulation and Data Protection Act 2018. We do not disclose or share this sensitive or confidential information without your explicit consent except in a small number of situations where disclosure is allowed by law, or where we have good reason to believe that failing to do so would put you or someone else at risk.
We operate ANPR at our Country Parks and some of our Outdoor Centres to manage the car parks; please see the specific privacy notice.
Where the potential for high risk processing is identified, the County Council will undertake a Data Protection Impact Assessment to assess and mitigate any risks. If you would like to request any of the information the County Council holds, please complete a Freedom of Information request.
The County Council is obliged to protect public funds. We may use personal information and data-matching techniques to help us to detect and prevent fraud and ensure public money is spent in the most appropriate and cost-effective way. In order to achieve this we may share information with other organisations which audit or administer public funds. This includes the Cabinet Office, the Department for Work and Pensions, other local authorities, HM Revenue and Customs, the Police, and the National Fraud Initiative
We may use personal information to identify people who will need extra support during emergencies or major incidents e.g. emergency evacuation.
We are keen to ensure that we are providing the services that are needed and are relevant to you. If you choose to sign up for additional services, or support that may be of interest to you, you can choose to opt out of receiving information about those services or support at any time.
We may also ask for feedback on how we are performing, or ask for your views on services which you have been using.
You may not want us to collect or share your personal information, or you may set conditions on how we can use it. In these cases we may not be able to provide with the service you need, or may only be able to provide it in a limited way. There are occasions when we have a statutory obligation to collect or use personal information. In those cases we will not be able to agree to your request.
We may use ethnic, gender, sexual orientation and age information (i.e. equalities data) to compile statistics in order to comply with equality legislation and assist in planning and service provision. Such data does not identify individuals or affect your entitlement to services.
- Third parties
The information we collect may be shared between County Council services and with other organisations, such as government bodies, the Police educational establishments and health and social care organisations providing you with services.
We will only share your personal information when we are permitted to or are required to by law or we have your consent to do so as required by the General Data Protection Regulation and Data Protection Act 2018.
The County Council does not pass personal data to other organisations for marketing purposes without your consent.
Your personal information may be processed by an external service provider acting on our behalf to provide services.
The County Council may receive personal information from third parties, for example the NHS may share the NHS Numbers of people receiving support from Social Care. This is so that the NHS and Social Care are using the same number to identify clients whilst providing care, to improve care and support.
Emails that we send to you or you send to us may be kept as a record of contact. We may also store your email address for future use. If we need to email sensitive or confidential information to you, we may check that we are using the correct email address and may use additional security measures. If you need to send us sensitive information, we recommend using our secure online forms where provided or the postal service.
We use a third party provider, SnapEngage, to support our WebChat service, which we use to handle customer enquiries in real time. All enquiries will be dealt with by Hampshire County Council staff.
If you use the WebChat service we will collect your name, email address and the contents of your WebChat session. This information will be stored in our customer database. Your information will not be shared with any other organisations, unless there is a statutory or legal requirement to do so. If you have a customer account associated with the email address you provide, a record of your session will be stored against your details. This will not contain the contents of the WebChat session.
- Drone Operations
Hampshire County Council undertakes drone operations under a Permission for Commercial Operations issued by the Civil Aviation Authority (reference 6693).
Drone operations include:
- Production of marketing material (which may include filming of events)
- Inspection of buildings and other Hampshire County Council assets (e.g. bridges)
- Monitoring of waterways to check for erosion and completion of maintenance in harder to access areas
- Recording the extent of flood events to inform flood management decisions
- Recording the extent of coastal erosion to inform and assess the effectiveness of coastal defence systems
- Monitoring the progression of Hampshire County Council construction projects
- Filming of events
If drones are being used at events, we will post signage to notify the general public or bystanders that filming is taking place.
Every effort is made to only capture video and/or photographic footage associated with the planned operation. If individuals are captured on drone footage and can be identified, then processes are in place to manage personal data in accordance with Data Protection Legislation.
- Your rights
You may request information that we hold about you, including any CCTV images. For details about how to make a request for your own information, view the Make a Subject Access Request page on our website.
You also have the following rights regarding our use of your information. If you chose to exercise these rights, this might in some cases delay or prevent us delivering a service to you. These rights are not absolute and in some situations we will not be able to comply with your request.
- Ask us to stop using your information for the purposes of direct marketing
- Object to decisions being made about you in some circumstances where decisions have been made about you based on profiling. You will be told at the point of collection if your personal information will be used for this purpose and how it will be used.
- Ask us to rectify inaccurate information we hold about you
- Ask us to restrict our use of your personal information
- Ask us to erase your personal data
- Ask us to provide your personal data to an alternative data controller
When we use your personal information on the basis of your consent you will also have the right to withdraw your consent to our use of your personal information at any time. In some circumstances, this may mean that you will no longer able to receive the service for which the personal information was collected.
- Data Protection Officer
If you have any queries or concerns about how we are handling your information or if you would like to exercise your rights as described above, please contact the Council’s Data Protection Officer, [email protected]
Hampshire County Council collects and uses personal information and is registered as a data controller with the Information Commissioner's Office. Its registration number is Z7534309.
View Hampshire County Council’s entry in the Data Protection Register
- The Information Commissioner's Office
The Information Commissioner gives advice and guidance to anyone who wishes to find out more about data protection. If you believe that your personal information is not being handled correctly and you have not received a suitable response from the County Council you can complain to the Information Commissioner's Office.
The County Council’s website contains external links to third party sites. Our privacy notice applies only to information collected by or on behalf of the County Council. If you go to another website, you should read their privacy notice before you give them any personal details.
When we provide services, we want to make them easy, useful and reliable. Where services are delivered on the internet, this sometimes involves placing small amounts of information on your device, for example, computer or mobile phone. These include small files known as cookies. They cannot be used to identify you personally.
You can manage these small files yourself and learn more about them through GOV.UK's guide to cookies
We collect your IP address when you access our online services to keep our systems safe and secure. This information is collected for the performance of a task in the public interest, and is held for 12 months.
We use a third party security monitoring service to fulfil our responsibility to ensure the security of our IT systems. The lawful basis for our use of this information is legitimate interest. The lawful basis for any incidental processing of special category data is necessary for reasons of substantial public interest. This is in line with Schedule 1 paragraph 10 of the Data Protection Act 2018, for the prevention or detection of an unlawful act and / or paragraph 11, to protect the public against dishonesty.
We will share your IP address with the security monitoring service, which will require us to transfer this information outside of the EEA.
- National Data Opt-Out
When you use a health or care service, information is collected about you to support your care or treatment.
Your information may also be used for research and planning to help people in general, where the law allows this.
If you do not want your information to be used for research and planning purposes, you can choose to opt out. To do this, go to www.nhs.uk/your-nhs-data-matters.
Compliance with the national data opt-out is mandatory for the health and care organisations from the end of March 2021.
- Covid-19 Pandemic
During this public health emergency we may use your personal data in order to respond to the crisis. However, we will continue to process your data in a fair and lawful manner. Personal data can include: names, dates of birth, NHS number, addresses and post codes, mobile and landline telephone numbers and email addresses.
Where personal data is processed for purposes connected with the emergency it may be collected, used and shared in order to protect relevant individuals and the wider community where it is necessary for their vital interests.
In addition personal data may be processed on the basis that it is:
- necessary for the performance of a task carried out to fulfil a legal obligation
- necessary for the performance of a task carried out in the public interest under
Special category (sensitive) data, including information about your health, care and support needs may be used and shared where it is:
- necessary for the purposes of carrying out obligations in the field of social protection law
- necessary for reasons of substantial public interest, i.e. for statutory and government purposes, or for the safeguarding of children and individuals at risk
- necessary for reasons of public interest in the area of public health
- necessary for the provision of health and social care
- necessary for the protection of vital interests
Sharing of special category data may take place where it is justified on the grounds of substantial public interest where we are safeguarding individuals at risk. In some cases, where the person concerned is physically incapable of giving their consent, the sharing of data will be justified when acting in the vital interests of individuals.
- Test and Trace
To help reduce the risk of a local outbreak of coronavirus (COVID-19), and in line with Government guidance, we are cooperating fully with the NHS Test and Trace Service.
For appointments with members of Hampshire County Council or activities in our services, we will share your data with the NHS Test and Trace Service in the event of someone testing positive for COVID-19.
For other situations where members of the public are likely to dwell for longer than 15 minutes, for example, sit down catering, we will capture the lead member’s contact details. We may use data from existing customer management systems if this helps us to identify who has visited a site in the event of a formal request from the NHS Test and Trace Service.
Any customer data collected only for test and trace purposes will be destroyed securely after 21 days. Our legal basis for processing this data is Performance of a Public Interest task, and Legal Obligation.
Please see our Data Protection page for further details.
You can contact the County Council’s Data Protection Officer at [email protected].
Please help us keep our customers, staff and the wider community safe by cooperating.