Complaints and appeals
To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.
Contact details of this Lancashire County Council service
Note that for queries intended for this specific service, do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to the the compliments, comments, complaints or appeals webpage.
Reasons for processing your personal data
We process your personal data to manage and respond to complaint or appeals, comments, compliments, and incident reports submitted to Lancashire County Council. This includes:
- Acknowledging and investigating your complaint or appeal or feedback to ensure services are delivered effectively and issues are resolved.
- Communicating with you throughout the process, including providing updates and outcomes.
- Recording and monitoring complaint or appeals to identify trends, improve services, and meet statutory and regulatory obligations.
- Complying with legal requirements, including UK GDPR, the Data Protection Act 2018, and other relevant legislation.
- Maintaining accurate records for audit, accountability, and quality assurance purposes.
Personal data is processed lawfully, fairly, and transparently, and only for purposes directly related to handling your complaint or appeal or feedback.
Use of artificial intelligence (AI) technologies
We are increasingly utilising AI technologies to process your personal data. This is primarily utilised within Lancashire County Council using Microsoft Copilot Web and Microsoft Copilot 365. Please consult our Artificial Intelligence privacy notice for more details of how we use these specific platforms.
We do not use AI to make automated decisions. There is always a human intervention to review and approve any outputs from the AI tools. Decisions are not made solely by automated means.
Legal basis for processing personal data
We rely on Article 6(1)(e) UK GDPR:
“Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”
Lancashire County Council is a public authority, and managing and responding to complaint or appeals is part of its statutory and public functions. This means the processing of personal data is necessary to fulfil our duties in investigating, resolving, and monitoring complaint or appeals about council services.
Legal basis for processing special categories of personal data
We rely on Article 9(2)(g) UK GDPR:
“Processing is necessary for reasons of substantial public interest, on the basis of UK law, which is proportionate to the aim pursued and provides suitable and specific measures to safeguard the fundamental rights and interests of the data subject.”
This is supported by Schedule 1, Part 2 of the Data Protection Act 2018, which includes conditions such as:
- Statutory and government purposes
- Equality of opportunity or treatment
- Regulatory requirements relating to unlawful acts and dishonesty
These provisions allow local authorities to process special category data when investigating and responding to complaint or appeals, ensuring compliance with legal obligations and promoting accountability in public services.
Legal basis for processing criminal offence data
Processing of personal data relating to criminal convictions and offences can only be carried out under the control of official authority or when authorised by UK law.
Lancashire County Council processes such data under official authority as part of its statutory functions to investigate and respond to complaint or appeals, including those involving allegations of unlawful acts. This is supported by the Data Protection Act 2018, which requires appropriate safeguards when handling this category of data.
Information we process about you
Categories of Personal Data
- Basic identification details: Name, address, contact information (telephone number, email address).
- Complaint or appeal details: Information you provide about your complaint or appeal, including correspondence and supporting documents.
- Service-related information: Details of the council service or interaction your complaint or appeal relates to.
- Reference numbers and case identifiers: For tracking and managing your complaint or appeal.
- Special category data (where relevant): This may include health information, racial or ethnic origin, or other sensitive details if provided as part of the complaint or appeal.
- Criminal offence data (where relevant): Information relating to alleged unlawful acts or misconduct, if included in the complaint or appeal.
These categories are processed only as necessary to investigate, respond to, and monitor complaint or appeals in line with legal and regulatory obligations.
Recipients of the personal data that we process about you
We may share your personal data with:
- Relevant Lancashire County Council departments and officers involved in investigating and responding to your complaint or appeal.
- Other public authorities or regulators, where necessary to resolve your complaint or appeal or comply with legal obligations (e.g., the Local Government and Social Care Ombudsman, or schools or the NHS).
- Contracted service providers or partners who deliver services on behalf of the Council, where they need the information to address the issues raised.
- Legal advisors and insurers, where required for the handling of claims or legal proceedings.
- Law enforcement agencies, if your complaint or appeal involves allegations of criminal activity or fraud.
- Statutory bodies or oversight organisations, for audit, compliance, or accountability purposes.
We will only share your data where it is lawful and necessary, and appropriate safeguards are in place.
Any transfers to another country
- No
Retention periods
Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.
For complaints the periods are as follows:
| Type of complaint or appeal | Description | Security | Retention |
|---|---|---|---|
|
Adult social care |
Full record of complaint or appeal including correspondence, evidence, and investigation notes |
Secure IT environment with monitoring and encryption, Encrypted storage and secure email systems. Secure document management system with restricted access. |
Destroy 10 years from closure |
|
Children's social Care |
Parent Partnership and Representation - Childrens Social Care Complaint or appeals - Adopted Children. Full record of complaint or appeal including correspondence, evidence, and investigation notes |
Secure IT environment with monitoring and encryption, Encrypted storage and secure email systems. Secure document management system with restricted access. |
Destroy 100 years from date of adoption |
|
Children's social Care |
Parent Partnership and Representation - Childrens Social Care Complaint or appeals - Looked After Children |
Secure IT environment with monitoring and encryption, Encrypted storage and secure email systems. Secure document management system with restricted access. |
Destroy 75 years from date of birth or 15 years from date of death if child dies before reaching age 18 (whichever is earlier) |
|
Children's social Care |
Parent Partnership and Representation - Childrens Social Care Complaint or appeals - by Parents and Carers |
Secure IT environment with monitoring and encryption, Encrypted storage and secure email systems. Secure document management system with restricted access. |
Review 10 years from closure |
|
Children's social Care |
Parent Partnership and Representation - Childrens Social Care Complaint or appeals - child at Risk |
Secure IT environment with monitoring and encryption, Encrypted storage and secure email systems. Secure document management system with restricted access. |
Review 20 years from closure |
|
Children's social Care |
Youth justice complaint or appeal |
Secure IT environment with monitoring and encryption, Encrypted storage and secure email systems. Secure document management system with restricted access. |
Destroy 6 years from resolution of complaint or appeal |
|
Children's social Care |
Youth and Community District Staffing files/complaint or appeals |
Secure IT environment with monitoring and encryption, Encrypted storage and secure email systems. Secure document management system with restricted access. |
Destroy 10 years from closure |
|
Corporate |
Education - Standards and Inclusion complaint or appeals |
Secure IT environment with monitoring and encryption, Encrypted storage and secure email systems. Secure document management system with restricted access. |
Review 10 years after closure |
|
Corporate |
Complaint or appeals files |
Secure IT environment with monitoring and encryption, Encrypted storage and secure email systems. Secure document management system with restricted access. |
Destroy 10 years from closure |
|
Ombudsman Case File |
Data shared with Local Government and Social Care Ombudsman |
Transferred via secure channels; retained in case file system |
10 years from closure |
|
System Logs |
Audit trails of access and changes in complaint or appeals systems |
Secure IT environment with monitoring and encryption |
10 years from creation |
For school admission, exclusion and transport, appeals the periods are as follows:
| File type | Description | Security | Retention period |
|---|---|---|---|
|
School Admission Appeal Files |
Includes appeal form, supporting documents, panel decision notes. |
Stored in secure LCC systems with role-based access and encrypted transmission. |
6 years after conclusion of appeal (as per School Admission Appeals Code). |
|
School Transport Appeal Files |
Contains transport appeal form, eligibility evidence, panel decision records. |
Encrypted storage on secure servers; access restricted to Appeals Team and panel members. |
2 years after conclusion of appeal (aligned with transport policy requirements). |
|
Exclusion Review Appeal Files |
Includes exclusion review application, governing board decision, panel recommendations. |
Secure storage with strict access controls; audit logs maintained for all access. |
10 years after conclusion of appeal (to cover potential legal challenges). |
|
Email Correspondence |
Communication between LCC and parents regarding appeals, including clarifications and hearing invitations. |
Microsoft 365 secure environment with MFA and encryption. |
2 years after conclusion of appeal (consistent with case file retention). |
|
Panel Member Documentation |
Details of panel membership and scheduling information. |
Restricted access; securely deleted after use. |
Retained only for duration of panel involvement; deleted immediately after appeal completion. |
Your rights
You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:
- to be informed via Privacy Notices such as this.
- to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
- of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
- of rectification, we must correct inaccurate or incomplete data within one month.
- to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
- to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
- to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
- to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
- in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.
If you want to exercise any of these rights, then you can do so by contacting:
Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ
Email: dpo@lancashire.gov.uk
To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.
Identity and contact details of the data controller
- Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Contact details of the data protection officer
- Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Further information
For more information about how we use personal information see Lancashire County Council's full privacy notice.
If you wish to raise a complaint or appeal on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).