Revenues and benefits service privacy notice

When processing your personal, special category personal or criminal/law enforcement data, Westmorland and Furness Council (‘the council’) is required under Articles 13 and 14 of the UK General Data Protection Regulation (UKGDPR) to provide you with the information contained in this Privacy Notice.

This notice explains what the council will collect, who it will be shared with, why we need it and how we will use it. The council will continually review and update this Privacy Notice to reflect service changes, feedback from customers and changes in the law.

The council is also required to comply with the data protection principles as laid out in the UKGDPR, to ensure that personal data is:

processed lawfully, fairly and in a transparent manner
collected for specific, explicit, and legitimate purposes
adequate, relevant, and limited to the purposes for which it was collected
accurate and up to date
kept for no longer than is necessary for the purpose(s) for which it was collected
secured using appropriate technical or organisational measures

Local government reorganisation (LGR)

From 1 April 2023, Westmorland and Furness Council replaced Barrow-in-Furness Borough Council, Eden District Council and South Lakeland District Council, as well as services previously delivered by Cumbria County Council.

Local Government Reorganisation is a complex process and there will be a period of transition to allow for services and support systems to be securely transferred.

During this time existing arrangements for data processing will be maintained until they can be reviewed, and new Privacy Notices issued. Individuals wishing to understand more about how their data is processed should refer to the following Privacy Notices:

Registration

As an organisation that processes large amounts of personal, special category personal or criminal/law enforcement data, referred to in legislation as a data controller, the council is required to register with the Information Commissioner’s Office (ICO)

Name: Westmorland and Furness Council
Address: South Lakeland House, Lowther Street, Kendal, Cumbria, LA9 4DQ
Registration Number: ZB512761

The council’s Registration Certificate on the Information Commissioner's Office (ICO) website.

About the service

The billing, collection and enforcement of local taxation and other miscellaneous debts as well as the assessment and payment of Housing Benefit and Local Council Tax Support is the now the statutory responsibility of Westmorland and Furness Council.

The council is legally required to collect personal data to support any application for Housing Benefit or Council Tax Support, and for the administration of Council Tax including billing, collection and recovery, in accordance with:

The Local Government Finance Act 1992
The Council Tax (Administration and Enforcement) Regulations 1992

As the Billing Authority responsible for the administration, billing, collection and recovery of national non-domestic rates (business rates) and Business Improvement District (BID) Levies, we collect, process and store personal details about you in order to carry out our duties to administer public funds and to enforce collection of monies owed.

Sometimes, the information held on our databases is used for other purposes including the prevention and detection of fraud and protection of public funds.

Data Controller arrangements

In most cases Westmorland and Furness Council is the data controller, however there may be instances where data is shared with another party as joint Data Controllers, or where the Council is operating as a data processor for another party.

What is personal data?

UKGDPR Article 4 defines personal data as: any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

What is special category personal data?

UKGDPR Article 9 defines special category personal data as: racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

What is criminal/law enforcement data?

The council is a competent authority as described in Schedule 7 of the Data Protection Act 2018 and is permitted to process data for law enforcement purposes that include: the
prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

What information does the council collect about me?

Revenues and Benefits is required to process either your personal, special category/sensitive or criminal/law enforcement data to meet legal obligations and make robust recommendations and decisions.

The Personal Data requirements are:

name
property address
property tenure
correspondence address
the way you trade as a business and any company registration number
evidence of Council Tax liability outside of our area if applicable
National Insurance Number
date of birth
contact details (e.g. phone number, email address, etc)
income details for yourself and household members, including details of benefits you may claim
savings details
bank details
employer details for yourself and household members
details of people living with you
landlord details
contact details of your doctor – in limited circumstances
student and relevant course details
we may also collect the names and contact details of anyone you have appointed to act on your behalf and this may include their bank details

The Special Category Data requirements are:

ethnicity
physical or mental health

The Criminal/Law Enforcement Data requirements are:

criminal history

How does the council collect data about me?

As part of this service the council will collect personal, special category personal or criminal/law enforcement data from you in the following ways:

online
phone
by email or in writing
in person

Why does the council collect my personal data?

The Revenues and Benefits Service collects personal, special category personal or criminal/law enforcement data to enable it to:

maintain the property database for Council Tax and Business Rates
administering the award of discounts, exemptions and reliefs
calculating liability and changes for Council Tax and Business Rates
calculating overpaid Housing Benefit
billing and collecting and recovering monies for Council Tax, Business Rates, Housing Benefit

Overpayments and Sundry Debts

processing claims for Housing Benefit, Council Tax Support and/or Discretionary Housing Payments
refunding overpaid Council Tax, Business Rates and Housing Benefit invoices
paying Housing Benefit
providing personal budgeting support and assisted digital support
defending our decisions at a Valuation Tribunal
defending our decisions and applying for a liability order at a magistrates’ court

Who does the council collect personal data from?

To provide the Revenues and Benefits Service personal, special category personal or criminal/law enforcement data may be collected from or about the following:

landlords and housing associations
letting agents
other councils
solicitors and conveyancers
outgoing occupiers
Department for Work & Pensions
Pension Service
Probation Service
HM Revenues & Customs
Land Registry
credit reference agencies
Valuation Office Agency – in limited circumstances where legislation permits us to
council departments (such as Electoral Registration, Planning, Building Control, Housing, Customer Services, Adult Social Care/Safeguarding, etc.)
Cabinet Office – National Fraud Initiative
Government ‘Tell Us Once’ Service
enforcement agents
employers
Citizens’ Advice
Debt Collection and Welfare Services
Official Receiver
Local Government Ombudsman
Printing and mailing companies – we may share your data for the purposes of issuing benefit notifications, bills and recovery documentation
External Auditors
Insolvency Practitioners
Electoral Register

The Revenues and Benefits Service may receive personal, special category personal or criminal/law enforcement data about you from the third parties mentioned above and other public bodies and organisations. In this case, we will tell you the source of the information unless we are unable to do so by law.

Who does the Revenues and Benefits Service share personal data with?

As Westmorland and Furness Council has a duty to protect the public funds it administers we may use the information you have provided for the prevention and detection of fraud.

This may involve using Credit Reference Agencies to check that our records are accurate.
We use a range of organisations to either store personal information or to help deliver our services to you. Sometimes we have a legal duty to provide your personal information to other organisations, for example the Court Service, DWP or HMRC.

Where there is a lawful reason to do so the Revenues and Benefits Service may share personal, special category personal or criminal/law enforcement data with:

other council departments (such as planning, building control, housing, customer services, electoral registration, adult services, children's services, street naming and numbering etc). This list is not exhaustive
other councils or partnerships (such as Cumberland Council)
government departments (such as Department for Work and Pensions, Her Majesty's Revenue and Customs, Valuation Office Agency, Valuation Tribunal Service, HM Court Service, Ministry of Housing, Communities & Local Government, The Cabinet Office, The Office of National Statistics)
contractors providing revenues and benefits services (such as IT software support and data backup services, analytical software, credit reference agencies, resilience/processing services, mailing companies)
Local Government Ombudsman
councillors
enforcement agents
judicial agencies (such as courts and tribunals)
auditors
third sector organisations (such as Citizens Advice)

We will also comply with requests for specific personal, special category personal or criminal/law enforcement data from other Local Authorities or regulatory and law enforcement bodies where this is necessary and proportionate. Before sharing we will always ensure that our partners have sufficient measures in place to protect your information in the same way we do.

We will never share your personal, special category personal or criminal/law enforcement data for marketing purposes, without your express consent.

Legal basis

Where the Revenues and Benefits Service identifies the requirement to process personal, special category/sensitive or criminal/law enforcement data, depending on the specific data being shared, it must have at least one of the following:

for personal data, a legal basis under UKGDPR Article 6
for special category/sensitive data, a condition under UKGDPR Article 9
for criminal/law enforcement data, a purpose under Data Protection Act 2018 - Schedule 8

If we are relying on consent to process your personal, special category personal or criminal/law enforcement data, you have the right to object at any time by contacting the service or officer the data was provided to.

If personal data is being processed the Revenues and Benefits Service must select at least one legal basis from the list below:

UKGDPR Article 6(1) (c) Legal Obligation
UKGDPR Article 6(1) (d) Vital Interests
UKGDPR Article 6(1) (e) Public Task/Public Interest/Official Authority

Where the Revenues and Benefits Service is relying on UKGDPR Article 6(1)(c) all Relevant Legislation should be listed below.

If special category personal data is being processed the Revenues and Benefits Service must select at least one condition from the list below:

UKGDPR Article 9(2) (g) Substantial public interest

If criminal/law enforcement data is being processed the Revenues and Benefits Service must select at least one condition from the list below:

Not Applicable

Relevant legislation

Local Government Finance Act 1992 (and subsequent amendments)
Housing Benefit Regulations 2006The Council Tax (Administration and Enforcement) Regulations 1992
Housing Benefit (State Pension Credit) Regulations 2006
Housing Benefit and Council Tax Benefit (Decisions and Appeals) Regulations 2001
Housing Benefit and Council Tax Benefit (Consequential Provisions) Regulations 2006 Discretionary Financial Assistance Regulations 2001
Rent Officers (Housing Benefit Functions) Order 1997
Social Security (Information-sharing in relation to Welfare Services etc.) Regulations 2012 Welfare Reform Act 2007 & 2012
Localism Act 2011)
Taking Control of Goods Act 2013, Tribunal
Courts and Enforcement Act 2007
The Health Protection (Coronavirus, Restrictions) (Self-Isolation) (England) Regulations 2020

Automated decision-making/profiling

Automated individual decision-making is a decision made by automated means without any human involvement. Automated individual decision-making does not have to involve profiling, although in some cases it might.

A definition of Profiling can be found in: UK GDPR - Article 4(4)

Further information can be found at: ICO - Automated Decision Making and Profiling

We do use your information for automated decision-making purposes. We may increase, decrease or suspend a benefit award automatically, based upon information provided to us by DWP ATLAS and UCDS systems in respect of changes to your circumstances. Notifications are automatically sent notifying you of any changes to your benefit entitlement.

The Council also provides online options for Council Tax Payers to set up a direct debit or payment plan. Where an automated decision cannot be made, human intervention is applied.

CCTV and surveillance

We operate surveillance equipment within some of our services for the purpose of either, public and staff safety, or the prevention and detection of crime. CCTV is also installed on the outside of some of our buildings for the purposes of monitoring building security and crime prevention and detection.

Civil Enforcement Officers (CEOs) who undertake the enforcement of Council Tax, Business Rates and Housing Benefit overpayments on behalf of the council, are each equipped with a Body Worn Video Device (BWVD), which has both video and audio recording capability.

Images captured by CCTV will be kept in accordance with the council’s Retention and Disposal Schedule (XLSX , 340KB).

However, on occasions there may be a need to keep images for longer, for example where a crime is being investigated. Images can be requested by writing to: dataprotection@westmorlandandfurness.gov.uk

We will only disclose images and audio to other authorised bodies who intend to use it for the purposes stated above. Images and audio will not be released to the media for entertainment purposes or placed on the internet for public viewing.

We operate CCTV and disclose in accordance with the codes of practice issued by the Information Commissioner and Biometrics and Surveillance Camera Commissioner.

Please note: From 1 April 2023, for a transitional period, individuals wishing to make enquiries about the deployment of CCTV and Surveillance, should in the first instance search the relevant council website, as listed below:

Cumbria County Council
Barrow-in-Furness Borough Council, CCTV an surveillance
Eden District Council, CCTV and surveillance
South Lakeland District Council, CCTV and surveillance

Once new systems and processes have been agreed and implemented, they will be made available via this website.

National Fraud Initiative/data matching

The Council participates in the Cabinet Office's National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise. For further information please see: National Fraud Initiative: Public Sector Data Requirements.

For further information on how your data is processed by the council please see:

Elected Members

In order for Elected Members to act on your behalf and resolve the issues you have raised they may need to collect some personal, special category personal or criminal/law enforcement data. This could include your name and address, and/or sensitive personal data, which could be concerning your health or ethnic origin.

In some circumstances your explicit consent may be needed to allow for the processing of your data. If this is needed the relevant Elected Member will contact you directly.

Elected Members will:

only share data with the organisations necessary to deal with your enquiry that is, different council departments, and to resolve any issues you have raised
not share your data with third parties, unless it is required for law enforcement purposes to prevent or detect crime, to protect public funds or where required or permitted to share data under other legislation
keep your data secure using the council's secure IT and email systems
retain/destroy your data in accordance with the council's Retention and Disposal Schedule

You have the right to access your personal, special category personal or criminal/law enforcement data and to rectify mistakes, erase, restrict, object or move your data in certain circumstances.

You can withdraw your consent for your personal, special category personal or criminal/law enforcement data to be processed as described above at any time. If you would like this to happen or you have a complaint about how your data is handled, please contact your Elected Member.

If you are not satisfied with the response or believe the Elected Member is not processing your personal, special category personal or criminal/law enforcement data in accordance with the law you can complain to the Information Commissioner's Office (ICO).

Data transfers

It may sometimes be necessary to transfer personal, special category personal or criminal/law enforcement data beyond the UK to comply with legal or other obligations.

Where data is required to be transferred to the European Union or other adequate countries the council will ensure that all relevant safeguards are in place before this takes place and that all aspects of the UKGDPR/Data Protection Act 2018 are complied with.

Data requested for transfer to non-adequate countries will be subject to a Transfer Impact Assessment, that includes the identification of appropriate safeguards prior to data being authorised for transfer.

Data Security and Retention

The council is required by UKGDPR Article 32 to ensure that appropriate organisational and security measures are in place to protect your personal, special category personal or criminal/law enforcement data.

Security measures include: anonymisation, pseudonymisation, encryption, access controls on systems, regular testing of our systems, security training for all employees. You can find further information in the following documents:

If you access information online, the council website does not store or capture personal information, but merely logs a number called your IP address which is automatically recognised by the system. The system will record personal information if you:

subscribe to or apply for services that require personal information
report a fault and give your contact details for us to respond
contact us and leave your details for us to respond

For further information visit our Cookies Policy.

Westmorland and Furness Council will only store your information for as long as is legally required in accordance with the council's Retention and Disposal Schedule (XLSX , 340KB)

or in situations where there is no legal retention period established best practice will be followed.

To help you understand the Schedule the council has published a Retention Schedule - Quick User Guide (PDF , 544KB).

If you have any questions about the Schedule or the Quick User Guide, please contact record.centre@cumberland.gov.uk.

If you experience any problems in relation to your personal data or you see something that doesn't look right, contact the council by email at: databreaches@westmorlandandfurness.gov.uk.

Contacting the council

Emails

If you email us, we may keep a record of your contact and your email address and the email for our record keeping of the transaction. We suggest that you keep the amount of confidential information you send to us via email to a minimum and use our secure online forms and services. Where available, you can sign up for email alerts for selected services using an external service from GovDelivery, with control over your preferences.

Telephone calls

The council will inform you if your telephone calls are being recorded or monitored and will not record any financial card details if you make payments by telephone.

Your rights - data subject access

The UKGDPR provides you with the right to access the personal, special category personal or criminal/law enforcement data the council, as a public authority holds about you. Upon receipt of a valid request the council will:

provide you with a response within one month
let you know if your request is subject to an extension
make reasonable efforts to comply with the format of your request
inform you if your request is going to be refused or a charge is payable

We will not disclose:

any information that relates to a third party as this will breach their rights under UKGDPR/Data Protection Act 2018
where a professional thinks disclosure would cause serious harm to you or someone else
information that may hinder the prevention or detection of crime.

Please note: From 1 April 2023, for a transitional period, individuals wishing to submit a Data Subject Access Request should do so via legacy websites, as listed below:

Once new systems and processes have been agreed and implemented, they will be made available via the Westmorland and Furness Council website.

Your Rights - Other

In addition to your right of access the UKGDPR gives you the following rights:

the right to be informed via the council's Privacy Notice
the right to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point
the right of rectification, we must correct inaccurate or incomplete data within one month
the right to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information. Where your personal data has been shared with others, we will ensure those using your personal data comply with your request for erasure
the right to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future
the right to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked
the right to object. You can object to your personal data being used for profiling, direct marketing or research purposes
you have rights in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

Where our processing of your personal, special category personal or criminal/law enforcement data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent, we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on - in which case, we will let you know. Your withdrawal of your consent won't impact any of our processing up to that point.

Where our processing of your personal, special category personal or criminal/law enforcement data is necessary for our legitimate interests, you can object to this processing at any time. If you do this, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim.

Unless otherwise stated above you can exercise any of these rights by contacting:

Email: dataprotection@westmorlandandfurness.gov.uk
Post: South Lakeland House, Lowther Street, Kendal, Cumbria, LA9 4DQ

Verifying Your Identity

When exercising the rights mentioned above, please be aware that under UKGDPR Article 12(6) additional information can be requested to verify that you are the data subject if your identity is unconfirmed. Please note that:

additional documentation is only required when the council cannot verify your identity using internal council systems that relate to the service you are requesting information about
the council will contact you for this documentation prior to processing your request
the statutory deadline for responding to your request will start when you have provided the additional documentation
failure to provide additional documentation may lead to the council rejecting your request.

Complaints

If you have concerns about the way the council has processed your data, please contact: