Devon and Torbay Combined County Authority (DTCCA) Privacy Notice

1. Introduction

The DTCCA is collecting and processing your personal data as a Data Controller under Data Protection Legislation and is registered with the Information Commissioner’s Office (ICO) under registration number ZB894252. Details about this registration can be found at www.ico.org.uk.  

This Notice explains what information we collect, why we collect it, who it may be shared with and how long it will be retained. It also explains your rights and our legal obligations. Should you wish to find out more about the DTCCA’s data protection commitments, please see our Data Protection Policy or contact our Data Protection Officer (DPO) at infoman.devontorbaycombinedcountyauthoritydata-mailbox@devon.gov.uk

2. Purpose of collecting or processing your personal data

The DTCCA is committed to ensuring that personal information is processed fairly, lawfully and securely in accordance with data protection laws.

In order to deliver services to you in an effective way, the authority will need to collect and use personal information about you.

Personal information can be anything that identifies and relates to a living person.  This can include information that, when put together with other information, can then identify a person.

3. Service or project specific privacy notices

If you use a specific service, we will usually let you know how that service will   use your personal information via a separate privacy notice.  In particular, services using large amount of personal or special categories of data will have their own dedicated privacy notice to tell people what information is being shared and how it is processed.

4. What information are we processing?

We may collect, store or otherwise process information about you which may include:

• Personal identifiable information and contact details relating to identified natural persons used to deliver services such as Investment, Innovation and Trade, Adult Skills and Education, Housing and Planning, Transport or Highways, and any other services that the authority delivers
• Special categories of information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs and medical health conditions
• Health and wellbeing information. All local authorities have a duty to improve the health of the population they serve. To help with this, we use information from a range of source data to understand more about the health and care needs in the area
• Research and statistical data to provide intelligence including demographic data, population projections, the economic situation, health and wellbeing information. This personal information is often pseudonymised when an identifier such as name is replaced with a unique number

Where we are collecting personal data about you for the provision of one of the purposes outlined in this Privacy Notice, we rely upon one of the following legal basis for the processing:-

• Consent: the individual has given clear consent for the authority to process their personal data for a specific purpose.

• Contract: the processing is necessary for a contract you have with the authority, or because they have asked you to take specific steps before entering into a contract.

• Legal obligation: the processing is necessary for the authority to comply with the law (not including contractual obligations).

• Vital interests: the processing is necessary to protect someone’s life.

• Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

• Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

When special categories of personal data are processed (for example, health or medical data, racial or ethnic origin or biometric data), this shall only be done where a lawful basis has been identified from the list above, and one from the following list: 

• The data subject has given explicit consent. 
• The processing is necessary for the purposes of exercising or performing any right or obligation which is imposed on the DTCCA in relation to employment, social security and social protection law (eg safeguarding individuals at risk; protection against unlawful acts; prevention against fraud). 
• It is necessary to protect the vital interests of any person where the data subject is physically or legally incapable of giving consent. 
• The data has been made public by the data subject. 
• The processing is necessary for the establishment, exercise, or defence of legal claims. 
• The processing is necessary in the substantial public interest. 
• The processing is necessary for health or social care purposes. 
• The processing is necessary for public health. 
• The processing is necessary for archiving, research, or statistical purposes. 

Most of the DTCCA’s processing of personal data will not require consent from data subjects, as the DTCCA needs to process this data in order to carry out its official tasks and public duties as a Combined County Authority.

However, where consent is required, we will adhere to the conditions for consent outlined within Article 4(11) of the UK GDPR and will ensure that the person giving consent will be able to withdraw their consent at any time by contacting the DPO.

Personal data that is collected for any of the purposes outlined in this notice is never used for direct marketing purposes and is not sold on to any other third parties.