As required by the General Data Protection Regulations (GDPR), this Privacy Notice provides details of how the Council uses personal information.
Principal activity: Local Government
Organisation Name: Solihull Metropolitan Borough Council
Address: Council House, Manor Square, Solihull, B91 3QB
County: West Midlands
Data Protection Officer: Assigned to the Corporate Information Governance Manager
Nature of work
The Council works with residents and other parts of the public and private sector to determine and deliver local priorities. It provides a wide range of services, either directly through employees or by commissioning services from outside organisations. It has responsibility for the economic, social and environmental ’wellbeing’ of the borough.
Most Council services are mandatory. This means that the council must do them because they are under a duty to do so by law (e.g. to operate an alcohol licensing regime under the Licensing Act 2003). Some mandatory functions are tightly controlled by central government, resulting in a similar level of service across the country (e.g. the administration of housing benefit). Other mandatory requirements (e.g. the library function) leave the council with some discretion over the level and type of service they provide.
Legal Basis for Processing
- The legal basis for processing personal information for most of the Council’s work can be found in Article 6(1)(e) General Data Protection Regulations (GDPR) where: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- The Council’s legal basis for processing most ‘special category’ personal information can be found in Article 9(2) (GDPR): (g) processing is necessary for reasons of substantial public interest and is authorised by domestic law (see section 10 of the 2018 Act;
- Section 111 Local Government Act and Section 1 Localism Act provide the legal powers which allow the Council to undertake the above.
Why we collect and use your information:
Solihull Metropolitan Borough Council (SMBC) is the data controller for the personal information we collect from you. The Department of Health and Social Care has served notice under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) to require SMBC to process confidential patient information for purposes set out in Regulation 3(1) COPI. The council will collect and use your personal information in order to manage and mitigate the spread and impact of the current outbreak of Covid-19:
- for the purposes of research,
- to protect public health,
- to provide public health and social care services to the public, and
- to monitor and manage the Covid-19 outbreak and incidents of exposure.
Article 6 (GDPR) lawful basis for processing personal data:
- Processing is necessary for compliance with a legal obligation
- Processing is necessary for the performance of task carried out in the public interest
- Processing is necessary in order to protect the vital interests of data subjects
Article 9 (GDPR) condition for processing special category personal data:
- Processing is necessary for reasons of public interest in the area of public health
We process personal information to enable us to provide a range of services to local people and businesses which broadly include:
|Adult services||Adult social care|
|Equipment and supporting services|
|Help and advice for adults|
|Advice and benefits||Advice and welfare rights|
|Alcohol and entertainment||Permissions and consents|
|Benefits/taxation||Carer and disability benefits|
|Heating and housing benefits|
|Low income benefits|
|Business and employment||Business advice and support|
|Careers and employment|
|Health and safety|
|Businesses and markets||Businesses|
|Children and family care||Children and young people social care|
|Fostering and adoption|
|Looked after children|
|Support for children and young people|
|Commercial activities||Goods and services|
|Council and community housing||Housing allocation|
|Education and learning||Adult education and lifelong learning|
|Early years and childcare|
|Special education needs|
|Educational support||Alternative education provision|
|Health and welfare at school|
|Pupil development and support|
|Environmental protection||Animal welfare|
|Conservation and sustainability|
|Countryside and farming|
|Funerals and cremations|
|Parks and open spaces|
|Street care and cleaning|
|Government, citizens and rights||Asylum and immigration|
|Communications and publicity|
|Complaints and compliments|
|Crime prevention and prosecution including use of CCTV|
|Data protection and freedom of information|
|Fraud initiatives including data matching|
|Policy and performance|
|Grants and aid||Community grants|
|Disabled facilities grants|
|Grants for children and young people|
|Health and social care||Carers|
|Community centres and facilities|
|Road signs and markings|
|Housing||Homelessness and prevention|
|Improvements and repairs|
|Multiple occupancy homes|
|Internal operation||Audit & Investigations|
|Facilities and property management|
|Information and database administration|
|Maintaining accounts and records|
|Leisure and culture||Arts and entertainment|
|Events and exhibitions|
|Local history and heritage|
|Museums and galleries|
|Sports and sporting venues|
|Reference and research|
|School and special libraries|
|Licences, permits and permissions||Alcohol and entertainment|
|Building and construction|
|Gambling and lottery|
|Waste and pollution|
|Planning and building control||Building control|
|Schools||Curriculum and policy|
|Transport and highways||Community transport|
|Footpaths, byways and bridleways|
|Parking, regulations and restrictions|
|Roads and Streets|
|Taxi and private hire|
|Waste management||Commercial waste|
Why we need your information
We will use your personal information for a limited number of purposes and always in line with our responsibilities, where there is a legal basis and your rights under Data Protection Legislation.
We will process personal information:
- for the purpose for which you provided the information, e.g. the processing of a benefit claim
- to enable us to communicate with you and provide the services you need or are entitled to
- to monitor our performance in providing services to you; to gather statistical information to allow us to plan future provision of services and to obtain your opinion about our services
- to meet various legal requirements
- to enable us to perform statutory law enforcement functions for example licensing, planning enforcement, trading standards food safety, etc.
- for the prevention and/or detection of crime including fraud
- to process financial transactions including grants, payments and benefits directly involving us or where we are acting on behalf of other government bodies such as Department for Works and Pensions
- for general processing where you have given your consent for us to do so
- where it is necessary to protect individuals from harm or injury
- where it is permitted under Data Protection legislation, for example, to comply with legal obligations or for us to seek legal advice or undertake legal proceedings
We aim to always keep your information accurate and up to date. You can help us to do this at any time by letting us know if any of the information you have given us, such as your address, changes.
Type/Classes of information processed
We process a variety of information relating to the above which may include:
- personal details
- family details
- lifestyle and social circumstances
- goods and services
- financial details
- employment and education details
- housing needs
- visual images, personal appearance and behaviour
- licenses or permits held
- student and pupil records
- business activities
- case file information
- Births and Deaths details
We may also process what is referred to as 'special categories' of information that may include data revealing:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data
- health or data concerning a natural person's sex life or sexual orientation
Who information is processed about
The classes of personal information we process include:
- staff, persons contracted to provide a service
- complainants, enquirers or their representatives
- professional advisers and consultants
- students and pupils
- carers or representatives
- recipients of benefits
- offenders and suspected offenders
- license and permit holders
- traders and others subject to inspection
- people captured by CCTV images
- representatives of other organisations
- Healthcare users/patients
- survey respondents
National Data Opt-out
The Council complies with the National Data Opt-out standard. This applies to organisations that handle data that originates within the health and adult social care systems in England. It provides a choice to patients about how their confidential patient information is used for purposes other than their individual care and treatment. Further details can be found here.
Who information may be shared with
What follows is a description of the types of organisations we may need to share some of the personal information we process with for one or more reasons.
Where necessary or required we share information with:
- family, associates or representatives of the person whose personal data we are processing
- current past and prospective employers
- healthcare, social and welfare organisations
- educators and examining bodies
- providers of goods and services
- financial organisations
- debt collection and tracing agencies
- private investigators
- service providers
- local and central government
- ombudsman and regulatory authorities
- press and the media
- professional advisers and consultants
- courts and tribunals
- trade unions
- political organisations
- professional advisers
- credit reference agencies
- professional bodies
- survey and research organisations
- police forces
- housing associations and landlords
- voluntary and charitable organisations
- religious organisations
- students and pupils including their relatives, guardians, carers or representatives
- data processors
- other police forces, non-home office police forces
- regulatory bodies
- courts, prisons
- customs and excise
- local and central government
- international law enforcement agencies and bodies
- security companies
- partner agencies, approved organisations and individuals working with the police,
- licensing authorities
- service providers
- press and the media
- healthcare professionals social and welfare advisers or practitioners
- current past and prospective employers and examining bodies
- law enforcement and prosecuting authorities
- legal representatives, defence solicitors
- police complaints authority
- the disclosure and barring service
- healthcare professionals
- register of births and deaths
How long we will keep your information
We will not keep your information any longer than needed. The length of time will vary from service to service and will be guided by either legislation which states how long records should be retained (e.g. adoption records 100 years, financial records 6 years) or by the business need to keep the information which will vary.
It may sometimes be necessary to transfer personal information overseas. When this is needed information may be transferred to countries or territories around the world. Any transfers made will be in full compliance with all aspects of the data protection act.
At the time personal information is collected, an individual has a right to be informed about how that information will be used, including, the purpose of the processing, legal basis for the processing, the recipients and categories of recipients of the information.
Access to information
Data Protection legislation provides individuals with a right to receive a copy of information an organisation holds about them. Any requests will ordinarily be dealt with within 1 calendar month, however, this may be extended by two further months where necessary, taking into account the complexity and number of the requests received. Details on how to apply can be found here
Individual’s have a right to correct inaccurate personal information an organisation may hold about them.
Subject to certain conditions, a person has a right to have their personal information erased without undue delay when:
- The information is no longer necessary in relation to the purposes for which it was collected.
- The use of the information is based upon consent which has since been withdrawn and where there is no other legal grounds for the processing of the information.
- The individual objects to the processing and there are no overriding legitimate grounds for the processing.
- The information has been unlawfully processed.
- The information has to be erased for compliance with a legal obligation to which the Council is subject.
- The personal information belongs to a child and has been collected by electronic means for a service normally provided for remuneration.
A person has a right to restrict the use of their personal information where one of the following applies:
- The accuracy of the personal information is contested, for a period enabling the Council to verify the accuracy of the information.
- The processing is unlawful and the person opposes the erasure of the personal data and requests the restriction of its use instead.
- The Council no longer needs the personal information but it is required by individual in question for the establishment, exercise or defence of legal claims.
- The individual has objected to the use of the information and this objection is legitimate.
The Council shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal information has been disclosed, unless this proves impossible or involves disproportionate effort.
Obligations regarding rectification, erasure or restriction of processing
The Council will notify each recipient to whom the personal information has been disclosed, unless this proves impossible or involves disproportionate effort. Should an individual require it, the council will inform them about those recipients.
Right to Data Portability
When the processing of personal information is carried out by automated means an individual is allowed to receive personal information concerning him or her which he or she has provided to the Council in a structured, commonly used, machine-readable and interoperable format. This right applies where an individual provided the personal information on the basis of his or her consent or the processing is necessary for the performance of a contract. It will not apply where processing is based on a legal ground other than consent or contract.
It will also not apply to the processing of personal information carried out in the exercise of public duties or in the exercise of an official authority vested in the Council. Where technically feasible, the data subject should have the right to have the personal data transmitted directly from one controller to another.
Right to Object
A person has the right to object, on grounds relating to his or her particular situation, at any time to certain types of use of their personal. For example, the right to object to personal information being used for Direct Marketing.
Automated Decision Making
A person has a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her unless the decision :
- Is necessary for entering into, or performance of, a contract between the individual and the Council, or
Is authorised by law which also lays down suitable measures to safeguard the individuals rights and freedoms and legitimate interests, or
- Is based on the individual’s explicit consent.
In these cases a person has a right to ask for human intervention in the decision making or to all his or her point of view to be presented and to contest the decision.
Automated decisions will not be made that involve a person's racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying person, data concerning health or data a person's sex life or sexual orientation unless:
- The individual has provided their explicit consent, or
- Processing is necessary for reasons of substantial public interest and based upon a law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of individuals.
Report Concerns to the Regulator
If you have a concern about the way your information is being used you have a right to contact the Information Commissioner's Office (ICO). The ICO is the UK’s independent body set up to uphold information rights.
Information Commissioner's Office
Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate).