Corporate Finance privacy notice

In order to comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

  • Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

  • Our Data Protection Officer is Paul Bond. You can contact him at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

Lancashire County Council’s Exchequer Services is responsible for providing financial services, for example, financially assessing and charging and making payments to individuals and providers. On occasions we may need to collect and use personal data in order to fulfil these duties.

The processing of personal data is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), collectively referred to as data protection law

This privacy notice explains how Exchequer Services uses information about you when you contact us or use our services, and how we protect your privacy.

The Exchequer Services use your data to:

  • enable us to carry out specific functions for which we are responsible, including: financial assessments
  • making payments to individuals and service providers
  • collecting direct debits to settle invoices issued to individuals for services provided by, or on behalf of, Lancashire County Council
  • assess performance and to set targets for paying individuals and collecting income on time
  • delivery of services and support to you
  • managing our services
  • investigating complaints about our services
  • monitoring and protecting public spending
  • monitoring the quality of our services to ensure they are delivered in the most efficient and effective way
  • helping us to improve and plan new services
  • complying with laws that require us to provide personal information to other organisations, such as health organisations and courts.

Category of personal data being processed

  1. Personal data (information relating to a living, identifiable individual)
  2. Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

(c) Legal Obligation: the processing is necessary for you to comply with the law. You must reference the applicable legislation if you wish to rely on this basis for processing.

(e) Public Task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. You must reference the applicable task/function and its' basis in law if you wish to rely on this basis for processing.

Lancashire County Council's Corporate Finance Service relies on UK GDPR Article 6 (1) (c) and UK GDPR Article 6 (1) (e) by virtue of the following legislation:

  • The Care Act 2014,
  • Care And Support (Charging and Assessment of resources) Regulations 2014
  • Care and Support Statutory Guidance

Legal basis for processing special categories of personal data

The legal basis for processing your special categories of personal data, in accordance with the UK GDPR is:

(b) Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law

(f) Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

(g) Processing is necessary for reasons of substantial public interest.

Lancashire County Council's Exchequer Services relies on UK GDPR Article 9 (2) (g) by virtue of the following legislation:

  • for statutory and government purposes (Schedule 1, Part 2, section 6, DPA 2018)
  • for preventing fraud (Schedule 1, Part 2, section 14, DPA 2018).

Recipients of the data

In order to provide our services, it is necessary for the Exchequer Services to share information. We routinely share data with the following recipients for the reasons provided:

  • Department of Works and Pensions, Office of the Public Guardian, Court of Protection, Police and other internal services.
  • Banks in order to make payment to your bank account or collect money by way of a direct debit
  • Companies and organisations under contract that supply us with IT services for the purposes of completing the functions of the Finance service. In doing so we may transfer your information to other countries, but only to countries which can demonstrate adequate levels of data protection in accordance with the UK Information Commissioner’s advice on ‘International Transfers’ of personal data.

Information we share

The types of information that are processed by the Exchequer Services include:

  • Name
  • Date of Birth, Ni Number,
  • Benefit information, HMRCS income information.
  • Contact details including address, email address and telephone number
  • Property Details
  • Your bank account details
  • Details of charges for services provided to you by, or on behalf of, Lancashire County Council
  • Details of payments made to you by Lancashire County Council

Any transfers to another country

We do not transfer any personal data to any countries or international organisations outside of the EU, the EEA (European Economic Area), or any other country that does not have an equivalent level of data protection to the UK.

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File type Description Security Retention period
Financial Assessment A financial assessment carried out by LCC for one of it's social care service users Retained on a secure password protected system Retained for 6 years after the end of care provision
Deferred Payment Agreements A contract between the local authority and service user for a charge to be registered against their property. Retained on a secure password protected system Retained for 6 years after the end of care provision or until the debt is settled

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are the right:

  • to be informed via Privacy Notices such as this.
  • to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
  • of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
  • of rectification, we must correct inaccurate or incomplete data within one month.
  • to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
  • to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
  • to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
  • to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
  • in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ 

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific service then please contact fin.assessment@lancashire.gov.uk and income.mgt@lancashire.gov.uk.

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 100 County Hall, Fishergate, Preston, Lancashire, PR1 0LD or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).