Who controls your data
Generally, we are the data controller, as noted in our various privacy notices. Sometimes we act jointly with another data controller such as a district council. Less often, we are a data processor on behalf of another organisation, such as an organisation depositing historic archives held at Derbyshire Record Office.
Why we collect and use this information
We are committed to using your data fairly and lawfully, in accordance with the UK’s General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This means every time we use it we will have a lawful basis for doing so. The lawful bases are set out in our other privacy notices. The same bases apply whether information is stored electronically or on paper. Paper records may be stored on council premises or at our contracted supplier of document storage services.
Keeping personal data for no longer than necessary is a legal obligation under UK GDPR. Using confidential waste to destroy time-expired data is classed as Legal Obligation processing.
Keeping your information safe
To meet our commitment to protecting your personal data we have data protection policies and procedures in place ensuring it is safeguarded.
We carry out checks on all third parties we use, and have contracts in place with them which detail data protection obligations they have to follow.
Your information will only be held by us for the amount of time stated in our records retention schedules and will be permanently deleted or securely destroyed at the end of the period stated unless we have a lawful reason to retain it.
How we process data
Our focus on modern ways of working means we are keeping less of your data on paper these days. For instance, some documents relating to employees are being securely scanned to personnel files held in the electronic document and records management (EDRM) system, allowing confidential destruction of the originals. Whether using digital systems or paper, we apply data protection principles.
Automated transcription and recording
We use Microsoft 365 software. This includes Microsoft Teams, which we use for collaborating with colleagues and partners. Within Teams, we allow audio-visual recording and automated transcription of meetings and events, on condition that participants are made aware they are being recorded. We will carefully consider the practical implications before starting a recording or transcription. These could be personal or organisational. For instance, our disciplinary procedure forbids use of recording equipment in disciplinary meetings.
If you are at the meeting because you work for us, your personal data are processed on a Contract basis, as described in the Employee privacy notice. If you belong to another organisation, the convenor of the meeting or event will direct you to a privacy notice that sets out the lawful basis of processing. Our usual policy is to treat the recording or transcription as transient data. This means we destroy it promptly, after it has served a short-lived purpose such as creation of meeting minutes. We take this approach because although an automatically-generated transcription can be helpful, we cannot rely on its accuracy as evidence. In exceptional cases where a recording or transcription is needed as a substantive record, we will capture it in an approved record-keeping system.
Sharing your data
Unless a privacy notice says otherwise, we do not share your information with other organisations. In some cases, we grant access to data processors under contract. For instance, we use Restore Plc for offsite storage and Shred Station for our confidential waste services.
Your rights
All our privacy notices explain your rights as a data subject such as the right to access your information.
You can find out more about your rights as a data subject.
If you would like more information on data protection and the GDPR, you can contact the Information Commissioner's Office (ICO) who deal with concerns and complaints relating to data protection and freedom of information legislation:
- Tel: 0303 123 1113 (local rate) or tel: 01625 545 745 (national rate number)
- Write to:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF