Information Governance – Information requests

1. The purpose for which we use your personal data

The information we collect about you will be used for the following purposes:

• Recording, processing and responding to information requests received under the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Data Protection legislation.
• Dealing with complaints regarding the handling of requests for information.

The legal basis for the processing of your information is to deliver a statutory function under the above legislation.

If you do not give us the information we need when we ask for it, this may result in us being unable to comply with your request and provide a response.

2. What type of information do we use?

We collect the following types of personal data about you to deal with requests under the Freedom of Information Act and Environmental Information Regulations:

• Name
• Address
• Telephone number
• Email address

To deal with requests under Data Protection legislation, we usually need more information:

• Name
• Address
• Unique reference number
• Date of birth
• Telephone number
• Email address

3. Do we use information received from other sources?

To deliver this service, we collect personal data directly from you.

In order to respond to requests under Data Protection legislation, we also obtain personal data about you from the relevant Council services covered by your request.

This may include the following types of personal data, depending on the scope of your request:

• Contact details
• Date of birth
• Gender
• Unique reference numbers
• Bank/payment details
• Your family composition
• Your social circumstances
• Your financial circumstances
• Employment and education details
• Your housing needs
• Images/photographs
• Information about your health
• Your racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Information about your sex life or sexual orientation
• Criminal convictions and offences

4. Transferring your information abroad

We use Microsoft Office 365 to process our electronic documents under the terms of a strict agreement, which safeguards your information. This personal data is hosted on servers outside the UK, but only in EU countries which are subject to the General Data Protection Regulation.

We don’t transfer any other information about you outside of the UK.

5. Who has access to your information?

We share your contact details with other Council departments and services, specifically, those which your request relates to. To process requests under Data Protection legislation we also share unique reference numbers and your date of birth in order to assist with carrying out searches for your personal data.

If you make a complaint to the Information Commissioner’s Office (ICO) about the way in which we dealt with a request, we may be required to disclose personal data about you in order to comply with an investigation.

There are also other specific situations where we may be required to disclose information about you, such as:

• Where the Council is required to provide the information by law
• Where disclosing the information is required to prevent or detect a crime
• Where disclosure is in the vital interests of the person concerned

This is in accordance with the Council’s Retention Guidelines.

6. How long we will keep your information

We will keep your information for the following periods:

• Freedom of Information Act and Environmental Information Regulations requests – 2 years after the response to the request
• Requests subject to internal review or complaint to the Information Commissioner’s Officer – 3 years after the investigation is completed
• Data Protection requests – 5 years after administrative use is concluded

7. Your Data Protection rights

You have the right to:

• Obtain access to the personal data that Carmarthenshire Council is processing about you
• Have any inaccurate or incomplete information rectified (corrected)
• Withdraw your consent to processing, where this is the only basis for the processing
• Make a complaint to the Information Commissioner’s Office (ICO), the independent body in the UK which protects information rights

In some circumstances, you may have the right to:

• Object to the processing of your personal information
• The erasure of your personal data
• Restrict the processing of your personal information
• Data portability

8. Contact details

For more information regarding this privacy notice and your rights, please contact:

Data Protection Officer
Carmarthenshire County Council
County Hall
Carmarthen
SA31 1JP

Email: dataprotection@carmarthenshire.gov.uk

Contact details for the Information Commissioner’s Office along with further guidance on Data Protection legislation can be found on the ICO website .