Privacy notice

​Personal information can be anything that identifies and relates to a living person. This can include information that when put together with other information can then identify a person. For example, this could be your name and contact details. 

As part of our statutory and corporate functions, we process special category data and criminal offence data in accordance with the requirements of Article 9 and 10 of the General Data Protection Regulation (‘GDPR’) and Schedule 1 of the Data Protection Act 2018 (‘DPA 2018’).

Special category data is defined at Article 9 GDPR as personal data revealing:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical belief
• Trade union membership
• Genetic data
• Biometric data for the purpose of uniquely identifying a natural person
• Data concerning health
• Data concerning a natural person’s sex life or sexual orientation

Article 10 GDPR covers processing in relation to criminal convictions and offences or related security measures. In addition, section 11(2) of the DPA 2018 specifically confirms that this includes personal data relating to the alleged commission of offences or proceedings for an offence committed or alleged to have been committed, including sentencing. This is collectively referred to as ‘criminal offence data’.

Schedule 1 of the DPA 2018 provides conditions for processing special category and criminal offence data and some of these conditions require us to have an Appropriate Policy Document (‘APD’) in place, setting out and explaining our procedures for securing compliance with the principles relating to the processing of personal data in Article 5 of the GDPR and policies regarding the retention and erasure of such personal data.

Conditions for processing special category and criminal offence data

Our processing of special category and criminal offence data for law enforcement purposes is not covered in this document. Processing for law enforcement purposes is carried out by us in our capacity as a competent authority and falls under Part 3 of the DPA 2018 and is the subject of a separate document.

We process special categories of personal data under the following GDPR Articles:

• Article 9(2)(b) – where processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on us or the data subject in connection with employment, social security or social protection
• Article 9(2)(g) - reasons of substantial public interest. We are responsible for education, highways, transport planning, passenger transport, social care (children and adults), libraries, waste disposal and strategic planning. Our processing of personal data in this context is for the purposes of substantial public interest and is necessary for the carrying out of our role
• Article 9(2)(j) – for archiving purposes in the public interest. The relevant purpose we rely on is Schedule 1 Part 1 paragraph 4 – archiving
• Article 9(2)(f) – for the establishment, exercise or defence of legal claims
• Article 9(2)(a) – explicit consent. In circumstances where we seek consent, we make sure that the consent is unambiguous and for one or more specified purposes, is given by an affirmative action and is recorded as the condition for processing
• Article 9(2)(c) – where processing is necessary to protect the vital interests of the data subject or of another natural person

We also process criminal offence data under Article 10 of the GDPR.

We may need to use some information about you to:

• deliver services and support to you
• manage those services we provide to you
• train and manage the employment of our workers who deliver those services
• help investigate any worries or complaints you have about your services
• keep track of spending on services
• check the quality of services
• help with research and planning of new services

There are a number of legal reasons why we need to collect and use your personal information.

Each privacy notice (at the top of the page) explains for each service which legal reason is being used. Generally we collect and use personal information where:

• you, or your legal representative, have given consent
• you have entered into a contract with us
• it is necessary to perform our statutory duties
• it is necessary to protect someone in an emergency
• it is required by law
• it is necessary for employment purposes
• it is necessary to deliver health or social care services 
• you have made your information publicly available
• it is necessary for legal cases
• it is to the benefit of society as a whole
• it is necessary to protect public health
• it is necessary for archiving, research, or statistical purposes

If we have consent to use your personal information, you have the right to remove it at any time. If you want to remove your consent, please contact DPO@northamptonshire.gov.uk and tell us which service you're using so we can deal with your request.

Where we can, we'll only collect and use personal information if we need it to deliver a service or meet a requirement. 

If we don't need personal information we'll either keep you anonymous if we already have it for something else or we won't ask you for it. For example, in a survey we may not need your contact details so we'll only collect your survey responses.

If we use your personal information for research and analysis, we'll always keep you anonymous or use a different name unless you've agreed that your personal information can be used for that research.

We don't sell your personal information to anyone else.  

​The law gives you a number of rights to control what personal information is used by us and how it is used by us.

We would normally expect to share what we record about you with you whenever we assess your needs or provide you with services.

However, you also have the right to ask for all the information we have about you and the services you receive from us. When we receive a request from you in writing, we must give you access to everything we've recorded about you.

However, we can't let you see any parts of your record which contain:

• confidential information about other people
• data a professional thinks will cause serious harm to your or someone else's physical or mental wellbeing
• if we think that giving you the information may stop us from preventing or detecting a crime

This applies to personal information that is in both paper and electronic records. If you ask us, we'll also let others see your record (except if one of the points above applies).

If you can't ask for your records in writing, we'll make sure there are other ways that you can. If you have any queries about access to your information please contact dataprotection@northamptonshire.gcsx.gov.uk or 01604 368360.

​You can ask to change information you think is inaccurate, ask to delete information (right to be forgotten), ask to limit what we use your personal data for and you can ask to have your information moved to another provider (data portability).

Please see our 'General Data Protection Regulation' page, under the heading 'The right to rectification', for further details.

We use a range of organisations to either store personal information or help deliver our services to you. Where we have these arrangements there is always an agreement in place to make sure that the organisation complies with data protection law. 

We'll often complete a privacy impact assessment (PIA) before we share personal information to make sure we protect your privacy and comply with the law.

Sometimes we have a legal duty to provide personal information to other organisations. This is often because we need to give that data to courts, including:

• if we take a child into care
• if the court orders that we provide the information
• if someone is taken into care under mental health law

We may also share your personal information when we feel there's a good reason that's more important than protecting your privacy. This doesn't happen often, but we may share your information:

• in order to find and stop crime and fraud; or if there are serious risks to the public, our staff or to other professionals
• to protect a child
• to protect adults who are thought to be at risk; for example, if they are frail, confused or cannot understand what is happening to them

For all of these reasons the risk must be serious before we can override your right to privacy. 

If we're worried about your physical safety or feel we need to take action to protect you from being harmed in other ways, we'll discuss this with you and, if possible, get your permission to tell others about your situation before doing so. 

We may still share your information if we believe the risk to others is serious enough to do so.  

There may also be rare occasions when the risk to others is so great that we need to share information straight away.

If this is the case, we'll make sure that we record what information we share and our reasons for doing so. We'll let you know what we've done and why if we think it is safe to do so.

We'll do what we can to make sure we hold records about you (on paper and electronically) in a secure way, and we'll only make them available to those who have a right to see them. Examples of our security include:

• Encryption, meaning that information is hidden so that it cannot be read without special knowledge (such as a password). This is done with a secret code or what's called a 'cypher'. The hidden information is said to then be 'encrypted'.
• Pseudonymisation, meaning that we'll use a different name so we can hide parts of your personal information from view. This means that someone outside of the council could work on your information for us without ever knowing it was yours.
• Controlling access to systems and networks allows us to stop people who are not allowed to view your personal information from getting access to it.
• Training for our staff allows us to make them aware of how to handle information and how and when to report when something goes wrong.
• Regular testing of our technology and ways of working, including keeping up to date on the latest security updates (commonly called patches).

The majority of personal information is stored on systems in the UK. But there are some occasions where your information may leave the UK either in order to get to another organisation or if it's stored in a system outside of the EU. 

We have additional protections on your information if it leaves the UK ranging from secure ways of transferring data to ensuring we have a robust contract in place with that third party. 

We'll take all practical steps to make sure your personal information is not sent to a country that is not seen as 'safe', either by the UK or EU Governments.

If we need to send your information to an 'unsafe' location we'll always seek advice from the Information Commissioner first.

There's often a legal reason for keeping your personal information for a set period of time, we try to include all of these in our retention schedule.

For each service the schedule lists how long your information may be kept for. This ranges from months for some records to decades for more sensitive records.

​The Council Advertising Network is responsible for delivering advertising on the Northamptonshire County Council website. Please take a moment to read their privacy policy which includes cookie information and details on how to opt out.

​Northamptonshire County Council will have access to the following data:

• Primary Care Mortality Database (PCMD) – The PCMD holds mortality data as provided at the time of registration of the death along with additional GP details, geographical indexing and coroner details where applicable.
• Births and Vital Statistics datasets – Births files include date of birth, sex, birthweight, address, postcode, place of birth, stillbirth indicators and age of mother. Deaths data includes: deaths broken down by age, sex, area and cause of death sourced from the deaths register.
• Hospital Episode Data (HES) – Is a data warehouse containing details of all admissions, outpatient appointments and A&E attendances at NHS hospitals in England. This data is collected during a patient's time at hospital and is submitted to allow hospitals to be paid for the care they deliver. HES data is designed to enable secondary use, that is use for non-clinical purposes, of this administrative data.

This data is supplied to Public Health by NHS Digital under section 42 (4) of the Statistics and Registration Service Act 2007, as amended by section 287 of the Health and Social Care Act 2012, and Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.

Lawful basis for processing this data

1. Statutory public health duties that the data will be used to support:
1. Duty to improve public health: Analyses of the data will be used to support the duty of the local authority under Section 12 of the Health and Social Care Act 2012 to take appropriate steps to improve the health of the population, for example by providing information and advice, services and facilities, and incentives and assistance to encourage and enable people to lead healthier lives.
2. Duty to support Health and Wellbeing Boards: Analyses of the data will be used to support the duty of the local authority and the Clinical Commissioning Group (CCG)-led Health and Wellbeing Board under Section 194 of the 2012 Act to improve health and wellbeing, reduce health inequalities, and promote the integration of health and care services; the data will also be used to support the statutory duty of Health and Wellbeing Boards under Section 206 of the 2012 Act to undertake Pharmaceutical Needs Assessments.
3. Duty to produce Joint Strategic Needs Assessments (JSNAs) and Joint Health and Wellbeing Strategies (JHWBs): Analyses of the data will be used to support the duty of the local authority under Sections 192 and 193 of the 2012 Act to consult on and publish JSNAs and JHWSs that assess the current and future health and wellbeing needs of the local population.
4. Duty to commission specific public health services: Analyses of the data will be used to support the local authority to discharge its duty under the Local Authorities Regulations 2013 to plan and provide NHS Health Check assessments, the National Child Measurement Programme, and open access sexual health services.
5. Duty to provide public health advice to NHS commissioners: Analyses of the data will be used by Local Authorities to discharge its duty under the 2013 Regulations to provide a public health advice service to NHS commissioners.
6. Duty to publish an annual public health report: Analyses of the data will be used by Directors of Public Health to support their duty to prepare and publish an annual report on the health of the local population under Section 31 the 2012 Act.
7. Public Health responses on behalf of the local authority to licensing applications and other statutory local authority functions requiring public health input: Analyses of the data will be used by the Director of Public Health to support their duty under Part 3 of the National Health Services Act 2006 (as amended by Section 30 of the Health and Social Care Act 2012) to provide the local authority public health response (as the responsible authority under the Licensing Act 2003, as amended by the Health and Social Care Act 2012 Schedule 5 - Part 1) to licensing applications.

Legal basis for access to civil registration data (mortality, births and vital statistics) DARs

This data assists local authorities in tailoring local solutions to local problems, and using all the levers at their disposal to improve health and reduce inequalities and it helps to create a 21st century local public health system, based on localism, democratic accountability and evidence as directed in the Health and Social Care Act 2012.

Section 42(4) of the Statistics and Registration Service Act (2007) as amended by section 287 of the Health and Social Care Act 2012 and Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.

Vital statistics:

• Processing: General Data Protection Regulation Article 9 (2) (h)
• General Data Protection Regulation Article 6 (1) (e)
• Dissemination: Health and Social Care Act 2012 - s261(5)(d)

Primary Care mortality data:

• Processing: General Data Protection Regulation Article 9 (2) (h)
• General Data Protection Regulation Article 6 (1) (e)
• Dissemination: Health and Social Care Act 2012 - s261(5)(d)

Births:

• Processing: General Data Protection Regulation Article 9 (2) (h)
• General Data Protection Regulation Article 6 (1) (e)
• Dissemination: Health and Social Care Act 2012 - s261(5)(d)

Categories of personal data processed

Mortality data:

• cause of death
• date of birth
• NHS number
• address and postcode
• postcode of place of death

Births:

• place of birth
• address and postcode of mother
• NHS number
• date of birth

HES:

• (Pseudo anonymised)
• age
• sex
• ethnicity
• GP
• details of health including diagnosis, treatment and admission details

Alongside your Right to Object, the NHS National Data Opt-out Programme gives you the right to opt out of your confidential patient information being used for reasons other than their individual care and treatment (such as for research and planning purposes). Patients and the public will be able to use the national system from 25 May 2018. All health and care organisations will be required to uphold patient and public choices by March 2020.

There are occasions where service providers will have a legal duty to share information, for example for safeguarding or criminal issues. The process for opting out will depend on the specific data and what programme it relates to. For further information, please contact the Public Health team by emailing phintelligence@northamptonshire.gov.uk.

Or write to us at:

Public Health Team, Northamptonshire County Council
One Angel Square
Northampton
NN1 1ED

Profiling and automated decision making

What is profiling?

Profiling is a form of automated processing, which is intended to evaluate you, and in particular to analyse or predict your:

• economic situation
• health
• personal preferences
• reliability
• behaviour
• location
• movements

If we analyse your information in this way we will inform you that this is being done and offer you the option of objecting to that process being carried out.

In some cases we may refuse your request if the profiling is required by law.

Some decisions are made by machine calculation of data held and this right allows you to object to having decisions made by an automated process. The machine calculation of the data is known as profiling and could mean analysing and predicting your economic situation, your health, your location or movements, and your preferences or behaviour.

However, this right does not apply where the processing is necessary for a contract between you and the council, the processing is authorised by law with necessary safeguards to your rights and freedoms or you have given your explicit consent to the profiling.

The council does not currently undertake profiling that has a significant and / or legal impact on you but may at times use data held to identify populations impacted by policy and legislative changes.