Privacy

This privacy statement covers the following topics:

  • Rights for individuals
  • Data controller
  • Legal basis for processing personal data
  • Consent
  • Types of personal data we collect
  • Why we need your information
  • How we collect your personal data
  • Cookies
  • How we use your personal data
  • What we ask from you
  • Disclosure of personal data
  • How long we retain personal data
  • Data matching
  • Data Protection Notification
  • Monitoring of email
  • Information Commissioner’s Office
  • Notification of changes to our privacy statement
  • Further information

 

Smart Belfast is an initiative by Belfast City Council. Belfast City Council (we) deliver a wide range of services to the residents of Belfast and those people who visit the city. To do this in an effective way, we are required to collect and use personal data.

The General Data Protection Regulation (GDPR) regulates the processing of personal data and replaces the Data Protection Act 1998.  It became law on 25 May 2018 and placed legal obligations on us to comply with a number of data protection principles.

These principles are there to protect your personal data and they make sure that we:

  1. processes all personal information lawfully, fairly and in a transparent manner.
  2. collects personal information for a specified, explicit and legitimate purpose.
  3. ensures that the personal information processed is adequate, relevant and limited to the purposes for which it was collected.
  4. ensures the personal information is accurate and up to date.
  5. retains personal data for no longer than necessary for the purpose for which it is processed.
  6. keeps your personal information safe and secure and protect its integrity and confidentiality.

The following information will explain how we collect and manage personal data about you.

Rights for individuals

The GDPR gives you rights relating to the processing of your personal information, which are:

  1. right to be informed – obligation to provide ‘fair processing information’ through privacy notices. There must be transparency at the point of collection on how the information will be used and there is an emphasis on providing you with a clear and concise notice.
  2. right of access – individuals must be able to access their data to ensure that it is being processed lawfully. This is commonly referred to as a subject access request. If you wish access to your personal data you must submit a request in writing and we will respond within 28 days. We may seek clarification as to your identity and there is no fee for this service.
  3. right to be forgotten (is not absolute and only applies in certain circumstances) erasure or rectification of personal data – this right arises in the event of inaccurate or incomplete data and has been expanded to cover more circumstances than those set out in the current Data Protection Act 1998.
  4. right to data portability – this is a new right enabling individuals to reuse and transfer their personal data (held in electronic form) for their personal use to another data controller without affecting its usability.
  5. right to object – where the processing of personal data is subject to consent, individuals can object to certain types of processing such as direct marketing or processing for research or statistical purposes.
  6. right not to be subject to a decision based solely on automated processing, including profiling that significantly affect the individual.

Data controller

We are the ‘data controller’ for the personal data that it gathers from members of the public, internal staff, external contractors and other individuals who interact with us.

You can contact us by telephone on 028 9032 0202 or email smartbelfast@belfastcity.gov.uk

We have a dedicated Data Protection Officer who you can contact by email at records@belfastcity.gov.uk or write to:

Belfast City Council,
City Hall Belfast,
BT1 5GS

Legal basis for processing personal data

We process personal data for specific purposes and these purposes will determine the legal basis for the processing.  This is addressed under Article 6 of GDPR. The legal bases for processing by the council as a public authority will be one or more of the following:

  1. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  2. Processing is necessary for compliance with a legal obligation to which we are subject.
  3. Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
  4. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
  5. Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data, in particular where the data subject is a child.

Consent

There may be occasions when consent is the only legal basis we have to process your personal data. When this occurs, we will endeavour to seek your consent at the time it gathers your personal data. You will normally be asked to provide a signature or indicate consent by ticking a box but this will only be carried out after a full explanation has been provided and you are clear as to what you are consenting to.

Consent is a core principle of data protection law and GDPR sets a high standard for this.  It must be freely given, specific, informed and unambiguous indication of the data subject’s wishes, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to the individual.

Type of personal data we collect

We collect the following type of personal data and this list is not exhaustive but provides a general guide:

Personal information

  • first name
  • family name or surname
  • address
  • telephone numbers
  • date of birth
  • qualifications
  • training records
  • financial information
  • licensing information
  • enforcement action
  • complaint information

Special category personal data

Special category data is personal data, which GDPR considers sensitive and deserving of extra attention:

  • racial or ethnic origin
  • religious or other philosophical beliefs
  • political opinions
  • trade union membership
  • physical or mental health or condition
  • sex life or sexual orientation.
  • offences (including alleged offences)
  • processing of genetic data
  • processing biometric data for the purposes of identifying a natural person.

Therefore, we will apply additional security and access measures to this type of personal data.

Why we need your information

  • to provide you with a public service in compliance with its legal responsibilities
  • contact you by post, email or telephone
  • update your records
  • establish your needs and subsequently provide you with the assistance that you require
  • prevent and detect fraud and corruption in the use of public money
  • obtain your opinion about our services
  • inform you of other relevant council services and benefits
  • ensure we meet our legal obligations including those related to diversity and equality
  • to protect citizens from harm or injury
  • for law enforcement functions, for example, licensing, planning enforcement, trading standards and food safety where we are legally obliged to undertake such processing
  • where the processing is necessary to comply with legal obligations, for example, the prevention and/or detection of crime
  • to assist us in responding to emergencies or major accidents. This allows us, in conjunction with the emergency services, to identify individuals who may need additional help and support.

How we collect your personal data

The following are examples of how we collect your personal data:

  • when you apply for a job with us
  • when you enter a challenge call, competition or a Small Business Research Initiative (SBRI)
  • when you attend our premises for a specific purpose and provide your details
  • through the submission of questionnaires online or via mail
  • submitting planning and building control applications
  • registering births and marriages
  • submitting complaints
  • working in partnership with us
  • emergency planning
  • CCTV covering our property and land
  • via enforcement action
  • licensing
  • face to face contact with BCC officers who you interact with.

The personal data may be held in paper and electronic format, but will always be managed in a safe and secure manner.

Some areas of our website require you to actively submit personal data in order for you to benefit from specific features, such as our range of online services, for example, email, online forms or online payments. You will be informed at each of these personal data collection points what data is required and what data is optional.

Some of this personal data may uniquely identify you, such as your name, address, email address, phone number, but we will only collect the personal data it needs.

Personal data may be gathered without you actively providing it, through the use of various technologies and methods such as Internet Protocol (IP) addresses and cookies. An IP address is a number assigned to your computer by your Internet Service Provider (ISP), so you can access the internet. We collect IP addresses for the purposes of system administration and to audit the use of our site. Each time you log onto our site and each time you request one of our pages, our server logs your IP address.

Although we log your session, it will not normally link your IP address to anything that can enable us to identify you. However, we can and will use IP addresses to identify a user when we feel it is necessary to enforce compliance with our rules or terms of service or to protect our service, site, users or others.

Cookies

We use a number of cookies on our website. Find out more about our use of cookies.

How will we use your personal data

All the personal data processed by us is held within the UK or on computer servers within the European Economic Area. No outside organisation is allowed access to your personal data unless the law permits this to happen.

We will use the personal data we collect to ensure you receive a proper service and to improve your interaction with us on a wide range of matters.

The data is used to manage your specific needs and inform you about changes to services, initiatives and events, dealing with complaints, employing contractors and dealing with enforcement action.

We will endeavour to inform you at the time your data is gathered why it is required, what it will be used for, which will be explained to you.

We will ensure that there is effective safeguards and systems in place to make sure personal information is kept safely and securely and provides awareness training to staff who handle personal information and treat it as a disciplinary matter if they misuse or don’t look after personal information properly.

What we ask from you

  • That you provide us with accurate and up to date personal data.
  • That you do not abuse staff when providing or seeking personal data.
  • That you inform us of any changes to your personal data.
  • That you inform us if you find any error or inaccuracies.

Disclosure of personal data

We will not disclose your personal data to any external organisation or person unless it is satisfied that it has a legal basis to do so and proper measures are in place to protect the data from unlawful and unauthorised access.

However, we may be required to share your personal data with other internal council departments to ensure it can manage your issues or requirements appropriately.

We also works closely with Central and Local Government departments throughout Northern Ireland and Great Britain and may share personal data with these departments, including statutory and non- statutory organisations for various projects and initiatives.  It may also share information with the Police Service of Northern Ireland, Her Majesty’s Revenue and Customs and other law enforcement agencies for lawful purposes including the prevention and detection of crime and animal welfare etc.

We may also use external organisations to carry out services on its behalf and this requires providing them with access to personal data. These organisations will act as Data Processors for us and they are legally obliged to keep your personal data secure and only process it under the specific direct instructions of us and in line with the GDPR.

We will not supply your information to any other organisation for marketing purposes without your prior consent.

How long we retain personal data

We are required to keep personal data for specified time periods to meet its statutory obligations and business needs and to comply with GDPR.  We have developed a retention and disposal schedule that has been approved by the Public Record Office Northern Ireland (PRONI) and the Northern Ireland Assembly. Personal data is held for different time periods due the specific purpose it was gathered for or because the law compels we to do so in this manner.

We may also retain personal data solely on the basis that you have provided your consent for this to happen.  If you wish to withdraw your consent, you can to do so and request we delete and destroy your data, by writing to the relevant department (if known) or directly to our Data Protection Officer asking for this to happen. Your personal data will be reviewed to establish if the law permits its destruction and deletion.

Your personal data will only be held as long as necessary and permitted by law and will be disposed of in a secure manner when no longer needed.

Data matching

We are required by law to protect the public funds it administers. It may share information provided for auditing, or administering public funds, or where undertaking a public function, in order to prevent and detect fraud.

The N.I. Audit Office is responsible for carrying out data matching exercises.

Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see if they match. This is usually personal data.

Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found, it may indicate that there is an inconsistency, which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

We participate in the  National Fraud Initiative to assist in the prevention and detection of fraud. We are required to provide personal data to the Comptroller and Auditor General or his agent for data matching under legislative powers included in the Audit and Accountability (NI) Order 2003, articles 4A to 4H.

The use of data in a data matching exercise does not require the consent of the individuals concerned under Data Protection legislation.

Data Protection Notification

As a Data Controller, we must notify the Information Commissioner’s Office.You may view our Data Protection Notification by searching for our registration number ZA104779 on the Information Commissioner’s website.

Monitoring of email

We may monitor your email and other online communications it receives (including members of staff).  Any such monitoring will take place in accordance with the law.

Information Commissioner’s Office

The Information Commissioner’s Office (ICO) regulates compliance with GDPR within the UK.  If you consider us to have breached any of the requirements of the GDPR, you may contact the ICO who may carry out an assessment, audit or investigation to establish whether we are compliant with the GDPR.

The ICO can be contacted at:

Information Commissioner’s Office
14 Cromac Place
Belfast
BT7 2JB

Telephone: 0303 123 1114

Email: ni@ico.org.uk

Web: www.ico.org.uk

Notification of changes to our privacy statement

We will post details of any changes to our privacy statement on this website to help make sure you are always aware of the information we collect, how we use it, and in what circumstances, if any, we share it with other parties.

This privacy statement was updated in May 2018.

Further information

If you require further information about the use of your data or wish to make a subject access request for copies of your personal data held by us, please contact:

The relevant department directly or via our Information Governance Unit.