Digital Services

To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

Our Data Protection Officer is Joanne Winston. You can contact him at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Reasons for processing your personal data

Digital Services provides the systems and software for all functions of the County Council to collect, store, use, share and dispose of personal information.

We have a legal obligation to ensure that data is secure and complies with the UK General Data Protection Regulation and the Data Protection Act 2018.

Digital Services are committed to protecting your privacy. Digital Services takes all commercially reasonable steps to protect your confidential information. Digital Services does not rent, sell, or share personal information about you with non-affiliated companies without your permission

On occasions, we may keep your personal information within the Council's archives for evidential and historical reasons or use it for research and statistical purposes.

It will sometimes be necessary to process personal information to protect individuals from harm or injury, to prevent and detect crime, to comply with legal orders, and to provide information in accordance with a person's rights. The Council will only process your personal information when it is lawful to do so.

We also have Information and Records Management Service (IRMS) and Mail, Print and Scan (MPS) that supports wider Lancashire County Council services with records management, document handling and scanning services. Some of these scanning services are also provided to external organisations.

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

Consent: you have given clear consent for us to process your personal data for a specific purpose.

Where Lancashire County Council employees and third parties with access to Lancashire County Council devices or systems are asked if they wish to provide biometric data to do so – Lancashire County Council relies on the individual's consent to do so.

(f) Legitimate Interests: pursued by us or by a third party.

Digital Services will process personal data to manage and maintain Lancashire County Council systems and platforms and will be required to process personal data to fulfil these functions.

Lancashire County Council Digital Services operate and support systems and platforms that support wider Lancashire County Council services in operating effectively.

Individual services rely on specific UK GDPR Article 6 lawful basis at different times in fulfilling their duties for the processing of personal data.

Please see separate privacy notices for specific Lancashire County Council services for which a lawful basis is relied on.

Legal basis for processing special categories of personal data

The legal basis for processing special categories of personal data relating to you, in accordance with the UK GDPR is:

(a) You have given explicit consent to the processing of your personal data.

Individual services rely on specific UK GDPR Article 6 lawful basis at different times in fulfilling their duties for the processing of personal data.

Please see separate privacy notices for specific Lancashire County Council services for which lawful basis is relied on.

Legal basis for processing criminal offence data

Our service will process criminal offence data where we have a legitimate requirement to do so. Please see separate privacy notices for specific Lancashire County Council services for which lawful basis is relied on.

Information we process about you

Digital Services Systems and Software process personal data and special category data.

Personal data (information relating to a living, identifiable individual)
M365 usage information
Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)
Criminal offence data

Recipients of the personal data that we process about you

We will sometimes share your personal information between teams within the Council, and with external partners and agencies involved in delivering services on our behalf.
We may also provide personal information to third parties, but only where it is necessary, either to comply with the law or were permitted under data protection legislation.

Organisations who we may share your information with include:

Police and other crime enforcement agencies
Government Departments
Other Local Authorities
Contractors providing Digital Services for example, externally hosted systems or for the purposes of build, test or problem resolution
Digital Services contracted suppliers

We will only share your information with partners or suppliers who have sufficient measures and procedures in place to protect your information and can meet their legal obligations under data protection legislation. These requirements will be set out in contracts or information sharing agreements.

Any transfers to another country

Currently LCC do not operate a UK only policy for the storing or processing of data. However, all data is held within an EEA Datacentre which complies with the Information Commissioner's Office (ICO) guide to international transfers.
As part of the procurement process for IT services all suppliers must indicate where their data is stored. The longer-term plan will be reviewing this information on a regular basis to ensure the most up to date information is kept for each system.

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

Document Handling Service specific retention periods:

File type	Description	Security	Retention period
Inbound mail scanning	Inbound mail received and scanned to LCC services	Physical mail is kept within the MPS secure scanning area at County Hall. Physical mail is scanned and delivered using a combination of envelope address information, or LCC-defined keywords and barcodes located in specified areas of the documents	4 weeks after scanning.
Record scanning	Records held within LCC secure storage which are scanned.	Physical records are retrieved from LCC storage by LCC employees Records to be scanned are stored within the MPS secure scanning area at LCC Marsh Lane building. Scanned files are stored and transferred on internal LCC secure servers. No data is transferred outside of LCC Scanned physical files are destroyed in accordance with a secure destruction process.	Copies of scanned documents that are scanned by MPS – 4 weeks after scanning Images stored in the scanner – 4 weeks after scanning Copies of scanned documents that are scanned externally – 90 days from date of transfer Primary version of scanned record uploaded to EDRMS – retained in line with retention period assigned to that record type Physical records – destroyed 4 weeks after scanning unless otherwise requested by data owners or Lancashire Archives Error logs – maximum 4 weeks after scanning

File type

Description

Security

Retention period

Inbound mail scanning

Inbound mail received and scanned to LCC services

Physical mail is kept within the MPS secure scanning area at County Hall.

Physical mail is scanned and delivered using a combination of envelope address information, or LCC-defined keywords and barcodes located in specified areas of the documents

4 weeks after scanning.

Record scanning

Records held within LCC secure storage which are scanned.

Physical records are retrieved from LCC storage by LCC employees

Records to be scanned are stored within the MPS secure scanning area at LCC Marsh Lane building.

Scanned files are stored and transferred on internal LCC secure servers. No data is transferred outside of LCC

Scanned physical files are destroyed in accordance with a secure destruction process.

Copies of scanned documents that are scanned by MPS – 4 weeks after scanning

Images stored in the scanner – 4 weeks after scanning

Copies of scanned documents that are scanned externally – 90 days from date of transfer

Primary version of scanned record uploaded to EDRMS – retained in line with retention period assigned to that record type

Physical records – destroyed 4 weeks after scanning unless otherwise requested by data owners or Lancashire Archives

Error logs – maximum 4 weeks after scanning

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:

to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights, then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific service, then please contact DigitalServices@lancashire.gov.uk

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).