Privacy Policy

Kendal Town Council recognises its responsibility to comply with the 2018 General Data Protection Regulation. The General Data Protection Regulation retains the existing legal principles of the 1998 Data Protection Act and adds some additional protections as to how personal data and sensitive personal data can be used.

The Data Protection Act

The Data Protection Act 1998 set out high standards for the handling of personal information and protecting individuals’ rights for privacy. It also regulated how information can be collected, handled and used. The Data Protection Act applies to anyone holding information about people electronically or on paper.

The General Data Protection Regulation (GDPR)

The General Data Protection Regulation 2018 says that the information provided to people about how we process their personal data must be concise, transparent, intelligible and easily accessible, written in clear and plain language, particularly if addressed to a child and free of charge. As a local authority, Kendal Town Council has a number of procedures in place to ensure that it complies with the General Data Protection Regulation 2018 when holding personal information. Kendal Town Council has appointed The Deputy Town Clerk as the designated Data Protection Officer.

When dealing with personal data, Kendal Town Council staff and Councillors are trained to ensure that:

• IT IS PROCESSED FAIRLY AND LAWFULLY

This means that information should only be collected from individuals if staff and Councillors have been open and honest about why they want the information.

• IT IS PROCESSED FOR SPECIFIED PURPOSES ONLY

This means that data will not be used for anything other than the defined purpose it was originally collected for.

• IT IS RELEVANT TO WHAT IT IS NEEDED FOR
  Data will be monitored so that only data that is needed will be held.
• IT IS ACCURATE AND KEPT UP TO DATE
• IT IS NOT KEPT LONGER THAN IT IS NEEDED
• IT IS PROCESSED IN ACCORDANCE WITH THE RIGHTS OF INDIVIDUALS
  This means that individuals must be informed, upon request, of all the information held about them.
• IT IS KEPT SECURELY
  This means that only staff and Councillors can access held data, it cannot be accessed by members of the public.

Collecting Data

Kendal Town Council recognises its responsibility to be transparent and consistent with people when taking personal details from them. This means that Kendal Town Council staff are clear about the procedures for collecting personal information.

If, for example, a member of the public gives their phone number to staff or a member of Kendal Town Council, this will only be used for the purpose it has been given and will not be disclosed to anyone else.

Data may be collected via forms in relation to specific projects and community resilience. The data will only be used in relation to the specific purpose as outlined on the form. Data will also be collected via Allotment Tenancy Agreements. This data will be saved securely on Kendal Town Councils secure network, will only remain on file for the duration of the agreement and will only be used for allotment related communication.

Storing Data

Kendal Town Council may hold information about individuals such as their addresses and telephone numbers for the purposes of allotment agreements, civic invitations and general email correspondence.

These details are kept securely on a protected network device and are not available for the public to access. All data stored on a computer is password protected. Once data is not needed anymore, if it is out of date or has served its purpose, it will be deleted.

Kendal Town Council will adopt a clear desk policy to ensure data sensitive papers are not accessible in Kendal Town Council offices. For ease of implementation, the clear desk policy includes all paper documents regardless of content. All paper documents will be stored in locked cabinets when staff members have completed tasks. All staff acknowledge the importance of clear desks to demonstrate best GDPR practice.

Staff will regularly shred paper documents containing sensitive data when content is no longer relevant. Staff will scan documents before considering recycling. If documents contain personal data shredding will be chosen instead of recycling.

Accessing Data

Kendal Town Council is aware that people have the right to access any information that is held about them. If a person requests to see any data that is being held about them:

• They must be sent all of the information that is being held about them
• There must be explanation for why it has been stored
• There must be a list of who has seen it
• It must be sent within one month
• Requests that are manifestly unfounded or excessive may be refused or a charge made
• If a request is refused, a reason must be

If an individual requests that their data is rectified or erased, this will be carried out. Kendal Town Council, via the shared network system, will be able to easily retrieve and access personal data.

Disclosure of Information

If an elected member of the council, for example a Councillor needs to access information to help carry out their duties, this is acceptable. They are only able to access as much information as necessary and it should only be used for that specific purpose. If for instance someone has made a complaint, a Councillor may access an address and telephone number of the person who has made the complaint so they can help with the enquiry. However, before they access any sensitive information about a person, they would need consent from the Data Protection Officer. Data will never be used for political reasons unless the data subjects have consented.

Confidentiality

Kendal Town Council staff are aware that when complaints or queries are made, they must be remain confidential unless the subject gives permission otherwise. When handling personal data, this must also remain confidential. This will be reflected in all minutes, agendas and associated papers which are available via Kendal Town Council’s website and will therefore be assessed according to the following check list:

• Have all contractor details been removed?
• Have all details of salaries, day rates and fees been removed?
• Have all addresses, emails and phone numbers been removed?

This policy will be reviewed annually and be included in staff inductions. The Data Protection Officer will conduct an annual review of the compliance with and effectiveness of the policy.

If a data breach is identified the ICO will be informed within 72 hours and an investigation will be conducted.