Elected Representative (Councillor) - privacy notice

Personal information being processed and what for

As a Cheshire East Council (CEC) Elected Representative, I am responsible for the personal information I hold about my constituents. I am the data controller and am required to comply with the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA).

This privacy notice provides information about how I process personal information for the purpose of responding to enquiries from constituents.

While arranging surgery appointments and handling enquiries and correspondence from members of the public, I collect the following personal information:

• Name and contact details including email address, telephone number and address
• Sometimes date of birth
• Any other relevant personal information supplied as part of your enquiry (this may include special category data about you or your family, including racial or ethnic origin, political opinions, religion, trade union membership, genetic and biometric data, physical or mental health, sex life, or sexual orientation, criminal convictions)

I will use this information to:

• respond to the enquiry or correspondence
• investigate relevant issues raised within the enquiry
• maintain a record of enquiries
• monitor outcomes arising from issues raised via enquiries and correspondence

Why am I allowed to use your information

I am required to have a lawful basis for processing personal data, and I rely on the following:

• UK GDPR Article 6(1)(a) – where you have provided consent for me to process your information for a specific purpose
• UK GDPR Article 6(1)(e) – where processing is necessary for me to perform a task which is in the public interest, or for my official functions as an elected representative

When processing special category data, including criminal offence data, I rely on the following additional lawful basis:

• UK GDPR Article 9(2)(a) – where you have provided me with explicit consent to process your information for a specific purpose
• UK GDPR Article 9(2)(g) – where processing is necessary for reasons of substantial public interest, specifically:

1. for statutory and government purposes (Schedule 1, Part 2, section 6, DPA 2018)
2. for the safeguarding of children and of individuals at risk (Schedule 1, Part 2, section 18, DPA 2018)
3. where processing is necessary for purposes relating to political activities, including casework (Schedule 1, Part 2, section 22, DPA 2018)
4. where processing is necessary for an elected representative to respond to a request (Schedule 1, Part 2, section 23, DPA 2018)

Who I will share your information with

Personal information about you will only be disclosed on a ‘need to know’ basis with the relevant service(s) within CEC to address your issue. I may also refer the matter to another elected member or third parties who are able to provide information to help address or resolve your concern.

These third parties may include:

• officers of Cheshire East Council
• other local authorities and government agencies
• elected representatives and other holders of public office
• landlords
• statutory law enforcement agencies and investigating bodies
• healthcare, social care, welfare advisers or practitioners
• regulators

I will not share your information for any other purpose unless it is required by law, for example crime prevention or detection or the safeguarding of a child or vulnerable individuals at risk.

Where I get your information from

The personal information I hold comes directly from my constituents or people acting on their behalf, such as family members. Personal information may also come from agencies, as outlined above, in response to the enquiries you have raised.

How long will I keep your personal information

I will not keep your personal information longer than necessary to effectively address the issues raised in your enquiry or correspondence. All information will be deleted or destroyed six years after the point of case closure, resolution or last point of contact. If I am no longer a Councillor before that, your personal information will be deleted/destroyed when I cease being an elected representative.

When information is shared with CEC departments or other agencies, it will be held by them in line with their own retention schedules.

How your information will be stored

I have reasonable security measures in place to prevent personal information from accidental loss or alteration, inappropriate access, misuse or theft.

Information in emails is stored on my behalf by CEC on their secure network and is protected by the Council’s security controls.

If there is any suspected data security breach, I will notify you and any applicable regulator where I am legally required to do so.

What happens if you don’t provide me with your information

If you do not provide the necessary personal data, I may not be able to respond to your concerns.

Will your information be used to make automated decisions

None of the personal information I am responsible for involves automated decision making.

Your rights

Under UK GDPR you have rights which allow you to:

• know what I am doing with your information and why I am doing it
• ask for a copy of the information I hold about you
• ask me to correct any mistakes in the information I hold about you
• object to processing in some circumstances, for example direct marketing
• ask me to delete the information I hold about you, which I can do in some circumstances
• have electronic data about you provided to you in a format for you to transfer to another organisation
• object to decisions being made that significantly affect you using automated means
• make a complaint to the Information Commissioner’s Office if you are not happy with the way your personal information is being handled

To exercise any of your rights, please contact your local Councillor in the first instance.

For further information about your rights, including the circumstances in which they apply, see the ICO's website.

If you are dissatisfied with how I have used your personal information whilst conducting business for the Council, please contact the Data Protection Officer at dp@cheshireeast.gov.uk.