Please see an addendum to this privacy notice [PDF] which explains our collection and use of personal data in respect of the Covid-19 (Coronavirus) pandemic.
The General Data Protection Regulation (GDPR) gives individuals the right to be informed about how organisations use their personal data. Nottinghamshire County Council will provide this information in layered approaches through Privacy Notices. You can find the Council's general privacy notice on this page. Links to our child friendly privacy notice, easy read version and privacy notices for specific services can be found using the related pages menu on the right, or at the end of the Council's general privacy notice on this page (section 14).
If you have enquiries about this privacy statement or about use of your personal data, you can contact the County Council’s Data Protection Officer (DPO) at:
Data Protection Officer
Nottinghamshire County Council
- email: DPO@nottscc.gov.uk
- telephone: 0115 8043800
Nottinghamshire County Council is registered as a data controller with the Information Commissioner's Office (registration number: Z5557238).
1. What is the purpose of this privacy statement?
This privacy statement tells you what to expect when Nottinghamshire County Council collects personal data. It applies to information we collect about:
- visitors to our website
- people who register for an on-line account
- people who register for and use our services
- people who are referred to us by other persons, agencies, organisations
- people who contact us with an enquiry or complaint
- job applicants and our current and former employees
- people who participate in publicity for the County Council
- people who are recorded on CCTV operated by the County Council.
2. What is personal data?
Personal data is any information that relates to a living individual from which they can be identified (for instance, details of the services provided to a particular individual). The following types of personal data may be used:
- personal contact details such as name, address, phone number, etc.
- personal identifiers such as an NHS number
- visual images, personal appearance and behaviour
- personal or professional opinions about an individual
- family details
- employment and education details
- student and pupil records
- housing needs
- lifestyle and social circumstances
- pension or financial activity records
- offences (including alleged offences)
- criminal proceedings, outcomes and sentences
- health details
- racial or ethnic origin
- data concerning a natural person’s sex life or sexual orientation
- trade union membership
- political affiliation
- political opinions
- religious or other beliefs of a similar nature
Personal data can be in any format and include:
- written letters
- video recordings
- audio recordings
3. What do we use personal data for?
We may need to use personal data for the following purposes:
- the activities and functions we are required to carry out as a local authority, for instance, social services, adoption services, education, planning and highways functions, civil parking enforcement, etc.
- public health functions
- registration services
- delivering services and support to customers and service users
- managing and monitoring those services
- service planning
- dealing with and investigation of enquiries and complaints
- responding to requests for information
- complying with legal requirements or Court Orders
- legal proceedings and legal advice
- supporting and managing workers, for instance, recruitment, provision of HR, payroll and occupational health services
- health and safety
- managing our property
- administering the Local Government Pension Scheme internal financial support including maintaining our own accounts and records
- emergency planning
- flood risk planning
- supporting the functions of other agencies
- processing on behalf of other persons
- carrying out surveys and audits
- reporting to Government, professional and supervisory authorities
- carrying out Disclosure and Barring Service checks
- data matching under local and national fraud prevention initiatives
- crime prevention and prosecution of offenders
- law enforcement functions that may result in criminal investigations or prosecutions
- archiving records
- historical and statistical research
- equal opportunity and diversity monitoring
- decision making
- responding to Councillors’ enquiries
4. When can we use your personal data?
Data protection law allows us to use or share personal data in any of the following circumstances:
- when we have your (or your appointed representative’s) consent. For example, you may have indicated your consent on a paper form or on-line form on our web site;
- where we have a contract with you or you have asked us to process your data prior to entering onto a contract;
- where we are under a legal obligation that requires us to process your personal data;
- we are protecting your vital interests, or those of other persons. For example, sharing details from your care record with a medical professional in an emergency;
- where the County Council is carrying out a task/function in the public interest, for instance, when providing a service that it has lawful authority to provide, for instance, social care, planning or highways.
- where we have a legitimate need to use information for a specific purpose that does not unjustifiably infringe on your rights or freedoms
- where it is necessary for the performance of a law enforcement task
If the personal data consists of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, the use of genetic data or biometric data for the purpose of identifying someone, data concerning health or data concerning someone’s sexual preferences or sexual orientation (together known as special categories of personal data) or relates to criminal activity or convictions, data protection law permits us to only use or share personal data in one or more of the following circumstances:
- where we have explicit consent
- where it is necessary for social care or health care purposes
- where it is necessary for the assessment of the working capacity of an employee
- where it is necessary for medical diagnosis
- where it is necessary for the vital interests of an individual and the individual is unable to consent because they are physically or legally incapable
- where it is necessary for employment and social security and social protection law
- where it is necessary for reasons of substantial public interest and for:
- performing a statutory function
- for the administration of justice
- the provision of counselling or other confidential services
- the prevention or detection of crime
- fraud prevention or protecting the public against dishonesty or other improper conduct
- for insurance purposes or occupational pensions
- for obtaining legal advice or for the purposes of legal proceedings
- for responding to Councillors’ enquiries
- for equal opportunity and diversity monitoring purposes
- for research and archiving purposes
- where the information has already been made public by the individual concerned.
5. Who may we share personal data with?
To ensure that the County Council provides you with an efficient and effective service we will sometimes need to share your information with other parties that support the delivery of the service you may receive or to support the Council carry out any of its statutory functions or, where appropriate, in any of the other circumstances referred to in section 4 above.
We may provide personal data to (or receive personal data from):
- customers and service users
- family, associates or representatives of the person whose personal data we are processing
- healthcare, social and welfare organisations
- healthcare professionals
- mental health assessors
- care homes and care providers
- local and central government bodies
- adoption agencies
- housing associations and landlords
- voluntary and charitable organisations
- current past and prospective employers
- agency workers and contractors
- trade unions
- professional bodies
- the disclosure and barring service
- service providers and other suppliers of goods and services
- buyers of goods and services
- professional advisers and consultants
- financial organisations
- pensions regulators and pensions authorities
- employers participating in the local government pensions scheme
- credit reference agencies
- customs and excise
- ombudsman and regulatory authorities
- press and the media
- courts and tribunals
- legal representatives, defence solicitors
- law enforcement and prosecuting authorities
- police forces
- prisons and the probation service
- police complaints authority
- partner agencies, approved organisations and individuals working with the police
- Home Office
- international law enforcement agencies and bodies
- debt collection and tracing agencies
- private investigators
- security companies
- political organisations
- licensing authorities
- waste collection authorities
- religious organisations
- schools and academies
- educators and examining bodies
- students and pupils including their relatives, guardians, carers or representatives
- survey and research organisations
- press and the media
- MPs, councillors and other elected representatives.
6. Will personal data ever be transferred overseas?
In some circumstances we may need to transfer personal data (including sensitive personal data) to other organisations who are based overseas, including countries which are outside the European Economic Area. When doing so, we will ensure that procedures and technologies are put in place to maintain the security of all personal data which is processed overseas.
Where transferring to a country that has not be approved by the European Commission (EC) as providing adequate protection of individuals' data protection rights, one or more of the following safeguards may be relied upon:
- Standard data protection clauses - use of EC approved contractual terms to protect individuals' data protection rights
- EU-US Privacy Shield - transfers to US companies that are members of the EU-US Privacy Shield and have agreed to protect individuals' data protection rights
- Binding Corporate Rules - transfers to companies that have internal rules to protect individuals' data protection rights which have been approved by a national data protection authority
- Approved code of conduct or a certification scheme - transfers to entities that have adopted and committed to adhere to an approved code of conduct or a certification scheme that safeguards data protection rights.
7. How long do we keep personal data?
We maintain information in accordance with our retention schedules which specify timescales for how long we hold your information. The law may specify the minimum amount of time we have to retain certain information.
8. What if you have any concerns about the use of personal data or its accuracy?
If you have concerns about the use of your personal data by Nottinghamshire County Council, or its accuracy, you may contact us at the address above.
9. How do we keep your information secure?
We will take appropriate steps to make sure we hold records about you in a secure way, including:
- all employees who have access to your personal data or are associated with the handling of that data are obliged to respect the confidentiality of your personal data
- putting in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction.
10. What rights do you have in relation to your personal data?
You have a number of rights in relation to your personal data. Please note that not all rights are automatic and some may not be available in certain circumstances where a lawful exception applies. For instance, this could be because a copy of your personal data may need to be kept or used for the purposes of complying with a legal obligation or for use in legal proceedings, for prevention or detection of crime, for a monitoring officer investigation, etc.
Right to find out about the personal data we hold about you and access a copy of it (subject access request)
You can ask us whether we hold your personal data and you can request a copy of the information we hold
Some of the information requested may be exempt from disclosure. This could be because it relates to another individual, it is subject to legal professional privilege, its disclosure would result in serious harm to someone, it consists of adoption records or another lawful exception applies.
Right to withdraw your consent
If you have provided us with consent for use of your data, for instance, marketing purposes, you have the right to withdraw your consent to stop the further use of your data for that purpose
The right to withdraw your consent will only affect future use of your data. It will not affect the validity of any pre-existing use
This right is not available where your data can be used without consent (see section 4 above), for instance, where we are under a legal obligation to use your information or another lawful exception applies
Right to object to use of your personal data (until 25 May 2018, see below for new right to object after this date)
You may object in writing to us explaining why use of your data is likely to cause you unjustifiable damage or distress and what should be done to prevent this
This right is not automatic and the use of your personal data for purposes you disagree with may be justified in certain cases even if it causes you some damage or distress
Right to raise a concern or enquiry about use of your personal data
Please see our complaints page
Contact the Information Commissioner's Office
For independent advice about data protection, privacy and data sharing issues, or if you are dissatisfied with how we have handled a complaint about use of your data, you can write to the Information Commissioner’s Office at the following address:
Or email: firstname.lastname@example.org
Additional rights effective on or after 25 May 2018
Right to rectification of your personal data
You may ask for your personal information to be corrected if information we hold is inaccurate or for incomplete information to be completed.
This right may not be available in limited circumstances where a lawful exception applies.
Right to erasure of your personal data (right to be forgotten)
You can request that some or all of your data be erased where:
This right is not available where a lawful exception applies or where the retention of the data is necessary for:
Right to restriction of use of your personal data
You can request that your data:
This right is not available where a lawful exception applies or in respect of data being used for:
Right to object to the use of your personal data
You can object to use of your data:
This right may not be available in limited circumstances where a lawful exception applies.
Right to ask for an automated decision to be reconsidered by a human
Where we notify you that a significant decision has been taken about you without any human input, you can request that:
This right is not available in respect of data being used on the basis of:
National Data Opt-Out
The National Data Opt-Out was introduced to give you a choice about whether you want your confidential patient information to be used just for your individual care and treatment or also to be used for research or for the planning of health and care services. To find out more or to register your choice to opt out, please visit: http://www.nhs.uk/your-nhs-data-matters. You can change your mind about your choice at any time. If you do choose to opt out your confidential patient information will still be used to support your individual care.
11. Visitors to our website
What information do we collect when you visit our website?
The computers which host our website maintain site logs which include the IP details of all machines accessing our pages. We only use such logs to determine website usage and not as a means of identifying or obtaining information about specific users. Any IP information is treated as strictly confidential and is not published or divulged to any third party.
Registering for online services
How do we use your personal information when you register for an online service?
We collect personal data that you provide to us when you register for an online account.
We collect personal data when you apply to access some of our services online.
By registering with us online (either in relation to your account or a specific service) you consent that Nottinghamshire County Council may process the personal data that we collect from you in accordance with this privacy notice.
In general we will hold your personal data for the purposes of maintaining and operating your account or registration and will use your personal information:
- for the purpose you provided the information for
- to verify your entitlement to access the services you have requested, eg verification of your residence in the county. (We may do this by checking with a third party)
- where you give specific consent to allow us to be able to communicate and provide information about services appropriate to your needs.
We will retain your information for the period necessary to fulfill the relevant purpose for which it is held and we will also retain any external verification so long as it remains accurate based on the information you provide to us. This will allow us to reuse that information when you register for additional services.
How will we use photographs that identify people?
Images of individuals are treated as personal data. Images of crowds in a public area are not. When taking photographs intended for publication on our website or elsewhere, it is our policy to seek the written permission of any individuals who are photographed.
We will respond promptly to any request to remove photographic images and/or personal data from the website where the person making such a request has a right to do so in accordance with their data protection rights.
Links to other websites
How will other websites use your personal data?
This privacy statement does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on other websites you visit.
12. Changes to this privacy statement
We keep our privacy statement under regular review.
Any changes we may make to our privacy statement in the future will be posted on this page. Please check back frequently to see any updates or changes to our privacy statement.
This privacy statement was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of Nottinghamshire County Council’s collection and use of personal data. However, we are happy to provide any additional information or explanation needed. Any request for this should be sent to the Complaints and Information Team.
13. The Information Commissioner’s Office (ICO)
The ICO is an independent body set up to uphold information rights in the UK. You can seek their advice and guidance or make a complaint to them through their website: www.ico.org.uk, or their helpline on 0303 123 1113, or in writing to:
Information Commissioner’s Office
14. How each service uses and protects your information
Where can I find further information about the use of my personal data?
Nottinghamshire County Council may use your personal data for the purposes of providing you with specific services. Some of these services have their own privacy notices which provide you with more detailed information relating to how we use your information. You can access some of these privacy notices below:
- COVID-19 (Coronavirus) Community Support
- Child Friendly Privacy Notice
- Easy Read Privacy Notice
- Adult Services
- Children and Family Services
- Council and Democracy
- Regulatory Services
- Public Health Services
- Transport, Environment and Economy
Please note that this list is not exhaustive and will be updated from time to time. You should contact the County Council to check for privacy notices that are relevant to the area you are interested in.