Library Services
To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.
Contact details of this Lancashire County Council service:
Note that for queries intended for this specific service, do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to the following point of contact:
Reasons for processing your personal data
We process your personal data to:
Register you as a library member and manage your library account.
Issue, renew and recover library materials, including books, digital resources and other items available through the library service.
Provide access to library facilities, online services, reservations, enquiries and customer support.
Contact you about your library account, including overdue items, reservations, renewals, membership updates and service-related information.
Deliver library programmes, events, activities and services that you have requested or chosen to participate in.
Verify your identity, eligibility for services and entitlement to concessions where applicable.
Manage payments, charges, refunds and the recovery of outstanding debts where necessary.
Safeguard children, vulnerable individuals, staff, volunteers and visitors using library services.
Monitor, plan, improve and evaluate library services to better meet the needs of residents and communities.
Produce statistics, reports and management information to support service delivery, planning and funding requirements.
Meet our legal, regulatory and public sector obligations, including maintaining accurate records and responding to requests made under relevant legislation.
Prevent and detect fraud, misuse of services, criminal activity or other unlawful behaviour where permitted by law.
Protect the security of library systems, buildings, assets and information.
We will only collect and use personal data that is necessary for these purposes and will process it in accordance with data protection legislation and Lancashire County Council policies.
Use of artificial intelligence (AI) technologies
We are increasingly utilising AI technologies to process your personal data. This is primarily utilised within Lancashire County Council using Microsoft Copilot Web and Microsoft Copilot 365. Please consult our Artificial Intelligence privacy notice for more details of how we use these specific platforms.
We do not use AI to make automated decisions. There is always a human intervention to review and approve any outputs from the AI tools. Decisions are not made solely by automated means.
Library Services may use AI-powered tools, including Microsoft Copilot technologies approved by Lancashire County Council, to support the delivery and administration of services. These tools may assist staff to:
Draft, review and improve routine correspondence, reports, procedures and service information.
Summarise information from documents, notes, emails and records to support administrative tasks.
Assist with research, information gathering and the preparation of service-related content.
Improve efficiency when responding to enquiries and requests from library users.
Support data analysis, service planning, performance monitoring and reporting activities.
Help staff locate and retrieve information held within authorised Council systems.
Where personal data is processed using AI tools:
AI is used as a support tool to assist staff in carrying out their duties.
Outputs generated by AI are reviewed by a member of staff before being relied upon or shared.
Decisions about library services, library memberships, charges, access to services or any other matters affecting individuals are not made solely by AI.
Appropriate security, governance and data protection controls are applied when using approved AI technologies.
We only use personal data within AI tools where there is a lawful basis to do so and where this supports a legitimate service need.
The use of AI within Library Services is subject to Lancashire County Council's information governance, data protection and security requirements, and may develop over time as new technologies and approved use cases are introduced.
Legal basis for processing personal data
The legal basis for processing personal data within Library Services will normally be one or more of the following:
Article 6(1)(e) UK GDPR – Public Task
Processing is necessary for Lancashire County Council to carry out tasks in the public interest and exercise its official authority in providing and promoting library services to residents. This includes managing library memberships, lending services, digital library resources, events, community learning opportunities and other library-related activities.
The Council's functions are derived primarily from:
Public Libraries and Museums Act 1964, which places a duty on local authorities to provide a comprehensive and efficient library service.
Local Government Act 1972, which provides powers relating to the delivery and administration of local authority services.
Other legislation and statutory guidance relevant to the provision of library services and related community services.
Article 6(1)(b) UK GDPR
Contract Processing may be necessary to provide services that you request through your library membership, including borrowing materials, accessing digital resources, reserving items, managing accounts, collecting payments and administering services requested by you.
Article 6(1)(c) UK GDPR
Legal Obligation Processing may be necessary for us to comply with legal and regulatory obligations, including requirements relating to financial management, taxation, safeguarding, health and safety, fraud prevention, records management and information rights legislation.
Article 6(1)(a) UK GDPR
Consent In some circumstances, we may ask for your consent to process personal data for specific purposes. Where consent is used, you can withdraw it at any time unless another lawful basis applies.
Article 6(1)(d) UK GDPR
Vital Interests In exceptional circumstances, personal data may be processed where this is necessary to protect someone's life or prevent serious harm.
Legal basis for processing special categories of personal data
Library Services will only process special category personal data where it is necessary, proportionate and there is a lawful basis under Article 9 UK GDPR together with an appropriate condition under the Data Protection Act 2018.
Where special category personal data is processed, this will usually be under one or more of the following conditions:
Article 9(2)(a) UK GDPR – Explicit Consent
Where you have provided your explicit consent for us to process special category personal data for a specific purpose. You may withdraw your consent at any time, although this may affect our ability to provide certain services.
Article 9(2)(c) UK GDPR – Vital Interests
Processing is necessary to protect your vital interests, or those of another person, where consent cannot be obtained, for example in an emergency involving a risk of serious harm.
Article 9(2)(g) UK GDPR – Substantial Public Interest
Processing is necessary for reasons of substantial public interest and is supported by a condition set out in Schedule 1 of the Data Protection Act 2018. This may include:
Safeguarding children and adults at risk.
Preventing or detecting unlawful acts.
Protecting the public from dishonesty, malpractice or other improper conduct.
Equality of opportunity or treatment monitoring where permitted by law.
Article 9(2)(h) UK GDPR – Health or Social Care
Processing is necessary for the provision, management or safeguarding of health or social care services. This is most likely to apply where Library Services work with other Council services or partner organisations to support vulnerable individuals, people with disabilities or those requiring additional support to access library services.
Article 9(2)(j) UK GDPR – Archiving, Research and Statistics
Processing is necessary for archiving purposes in the public interest, historical research, statistical analysis or service planning activities, subject to appropriate safeguards.
Where we rely on a condition under Article 9(2)(g), (h) or (j) UK GDPR, the processing will also be undertaken in accordance with the applicable provisions of Schedule 1 of the Data Protection Act 2018.
We will only collect and use special category personal data where it is relevant to the services being provided, where there is a clear legal basis for doing so, and where appropriate safeguards are in place to protect your information.
Legal basis for processing criminal offence data
Library Services may occasionally process information relating to criminal offences, allegations, investigations or related safeguarding matters where this is necessary to protect individuals, Council services, property or resources, or where required by law.
Where criminal offence data is processed, we will do so in accordance with Article 10 UK GDPR and the conditions set out in Schedule 1 of the Data Protection Act 2018.
We will only process criminal offence data where there is a clear lawful basis for doing so, where it is necessary and proportionate for the purpose concerned, and where appropriate safeguards are in place to protect your information. If criminal offence data is not processed as part of the Library Services covered by this privacy notice, this section should be removed.
Information we process about you
Depending on the library services you use, we may collect and process the following types of personal information:
Your name, title and preferred form of address.
Contact details, such as your home address, email address and telephone number.
Date of birth or age category, where required to administer library membership and access to age-appropriate services.
Library membership number and account information.
Records of items you have borrowed, reserved, renewed or requested, where retained in accordance with library policies.
Information relating to the use of library services, facilities, digital resources, computers, Wi-Fi services, events and activities.
Payment and transaction information, including fees, charges, refunds and concessionary entitlements where applicable.
Correspondence, enquiries, complaints, feedback and requests made to the library service.
Information required to verify your identity, eligibility for services or entitlement to concessions.
Information relating to participation in library programmes, learning activities, reading initiatives, community events or outreach services.
Accessibility and support requirements that help us make reasonable adjustments and ensure library services are accessible to all users.
Emergency contact details where these are required for activities or events.
CCTV images and related information where CCTV is in operation within library premises for safety, security and crime prevention purposes.
Technical information generated using online library services, such as login details, internet protocol (IP) addresses and system audit information.
Where necessary and appropriate, limited information relating to health, disability, safeguarding or support needs to enable access to services, fulfil legal obligations or protect the wellbeing of individuals.
We only collect information that is necessary for providing library services, meeting our legal obligations, protecting users and staff, and improving the services we provide.
Recipients of the personal data that we process about you
We may share your personal data with individuals, organisations and service providers where this is necessary to deliver library services, meet legal obligations or protect the interests of library users and the Council.
Recipients may include:
Other Lancashire County Council services where information sharing is necessary to provide services, administer accounts, manage safeguarding concerns or meet statutory duties.
Library management system providers and associated support organisations who provide and maintain library service technology on our behalf.
Providers of digital library services, including e-book, e-audio, online learning, reference and information platforms that you choose to access through your library membership.
Other library authorities and library networks where this is necessary to facilitate inter-library loans, shared services or reciprocal borrowing arrangements.
Payment service providers and financial institutions where payments, refunds or debt recovery activities are required.
Educational establishments, community organisations and partner agencies involved in the delivery of library programmes, learning activities, events or outreach services.
Law enforcement agencies, courts, regulators and other public authorities where disclosure is required or permitted by law.
Safeguarding partners, including social care, health services and emergency services, where information sharing is necessary to protect children, vulnerable adults or other individuals at risk.
External auditors, inspectors and regulatory bodies where access to information is required to fulfil their statutory responsibilities.
Third-party contractors, suppliers and service providers acting on behalf of Lancashire County Council under appropriate contractual and data protection controls.
We will only share personal data where there is a lawful basis to do so, where the information is relevant and necessary for the purpose concerned, and where appropriate safeguards are in place to protect your information.
Any transfers to another country
Library Services primarily store and process personal data within the United Kingdom.
In most circumstances, your personal data will not be transferred outside the UK.
Some of the technology providers used to support library services, including digital library platforms, online resources, cloud-based systems and communication tools, may process or store information in countries outside the UK.
Where personal data is transferred internationally, Lancashire County Council will ensure that appropriate safeguards are in place to protect your information and ensure that data protection standards are maintained.
These safeguards may include:
The use of countries that have been recognised as providing an adequate level of data protection.
International data transfer agreements and approved contractual clauses.
Other measures permitted under UK data protection legislation.
Any international transfers of personal data will only take place where they are lawful, necessary and subject to appropriate security and data protection controls.
Retention periods
Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.
File type | Description | Security | Retention period |
|---|---|---|---|
Library membership records | Personal details collected at registration (name, address, DOB, contact details, membership number). | Stored within the Library Management System with strict access controls; data encrypted in transit and at rest. | Retained for the duration of membership and deleted 2 years after the account becomes inactive. Accounts are set to expire every 3 years to check data is accurate. |
Borrowing and usage history | Details of items borrowed, renewed, reserved, digital service use, event attendance. | Accessible only to authorised library staff; protected through system permissions and audit logging. | Routine borrowing history retained for 12 months unless needed for dispute resolution; digital access logs retained according to system requirements (typically 6–12 months). |
Home Library Service information | Details required to support individuals receiving home deliveries (e.g., health or accessibility needs, contact arrangements). | Held with enhanced access restrictions; shared only with staff/volunteers delivering the service under confidentiality agreements. | Reviewed annually and deleted when the person stops using the service or when information is no longer required. |
Incident and safeguarding reports | Records relating to safety, complaints, unacceptable behaviour, or safeguarding concerns. | Restricted access; stored securely with encryption where appropriate; access limited to senior staff and safeguarding leads. | Retained for 6 years from the date of the incident, or longer if required for safeguarding or legal purposes. |
Banning Letters | Records of customer banning orders relating to unacceptable behaviour. | Restricted access; stored securely with encryption where appropriate; access limited to senior staff and safeguarding leads. | Retained for 6 years from the date of the incident, or longer if required for safeguarding or legal purposes. |
CCTV and security footage (where applicable) | Video recordings captured in library premises for safety and crime prevention. | Stored securely with restricted access; automatic overwrite functions applied. | Typically retained for 30 days unless required for an active investigation by Facilities Management. |
Volunteer records | Contact details, role information, DBS results (where relevant). | Stored securely with restricted access; DBS information handled under statutory conditions. | Volunteer records retained for the duration of volunteering plus 3 years; DBS results kept no longer than legally permitted (usually 6 months). |
IT and public computer usage logs | Login times, device identifiers, internet session data where required for security and misuse prevention. | Protected through IT security controls, audit mechanisms, and restricted access. | Retained for 3–6 months depending on system configurations and legal requirements. |
Communication preferences and mailing lists | Contact details and stated preferences for newsletters and optional updates. | Stored within the Library Management System with strict access controls; data encrypted in transit and at rest. All direct communication (such as marketing) is sent via the LMS. | Retained until the individual withdraws consent, their account expires or unsubscribes. |
Your rights
You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:
to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.
If you want to exercise any of these rights, then you can do so by contacting:
Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ
Email: dpo@lancashire.gov.uk
To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.
Identity and contact details of the data controller
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Contact details of the data protection officer
Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Further information
For more information about how we use personal information see Lancashire County Council's full privacy notice.
If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).