Eversley Parish Council
Data Protection & Privacy Policy
The General Data Protection Regulation 2018
The GDPR builds on the legal framework established by the Data Protection Act 1998 to balance the
needs of organisations to use and collect personal data against the rights of the individual to have
personal data kept secure and private.
The purposes of the GDPR are:
To increase the obligations on organisations when acting as data controllers & processors
To increase the rights of individuals to ensure that their personal data is respected and only used for
legitimate purposes.
Definitions:
Personal Data – is any information about a living individual which allows them to be identified from
that data such as name, address, email address, photograph.
Data Controller – is the person or organisation who determines how and what data is processed ie,
Eversley Parish Council
Data Processor – is the person(s) who handle the data on behalf of the data controller
Data Subject – is the individual about whom the personal data is processed.
Data Protection Officer – is the individual with responsibility for ensuring data protection
compliance.
The Parish Council’s Commitment
As a local authority & a data controller, Eversley Parish Council will comply with data protection law.
When dealing with personal data, the council and its staff will ensure that:
• Data is used fairly, lawfully and in a transparent way
• Data is processed for specified purposes only
EPC Data Protection & Privacy Policy Page 2
• Data is relevant to what it is needed for
Data will be monitored so that too much or too little is not kept; only data that is needed
should be held.
• Data is accurate and kept up to date
Personal data should be accurate, if it is not it should be corrected.
• Data is not kept longer than it is needed
See record retention policy
• Data is kept & destroyed securely
This includes measures to protect personal data from loss, misuse, unauthorised access and
disclosure.
Data protection training will form part of induction training of all staff & councillors.
Existing staff & council members will have their training updated accordingly.
Personal Data Processed
The personal data kept or processed by EPC includes but is not confined to the following:
• Names, titles & aliases, photographs & video images;
• Contact details such as telephone numbers, addresses and email addresses, social media
addresses;
• Financial identifiers such as bank account numbers, payment card details for persons hiring
facilities, for staff, contractors & for suppliers;
• Demographic and background information on staff and members including gender, age,
marital status, employment background & qualifications;
• Some sensitive personal data in relation to staff and members such as racial/ethnic origin,
mental & physical health & trade union affiliation;
• Website data such as IP address & analytical data;
How/Why Personal Data is Used
• To deliver public services;
• To confirm identity to provide some services;
• To enable the council to meet its legal and statutory obligations and powers including
delegated functions;
• To contact individuals & organisations;
• To maintain own accounts and records;
• To process financial transactions;
• To protect public funds and facilities;
• To recruit and employ staff and contractors;
The Legal Basis for Processing Personal Data
There are 3 legal bases for processing personal data:
1. As a public authority, the council has certain powers and duties. Most personal data is
processed for compliance with a legal obligation which includes carrying out the council’s
statutory powers and functions; or
2. In the performance of a contract or during steps to enter into a contract; or
3. With consent. Before using an individual’s personal data, the council will obtain that
individual’s consent.
Individual’s Rights
An individual has the following rights in relation to his/her personal data:
• The right to access the personal data the council holds on that individual – via a subject
access request;
• The right to correct and update the personal data;
• The right to have the personal data erased;
• The right to object to the processing of his personal data or to restrict its use;
• The right to data portability;
• The right to withdraw consent previously given;
• The right to lodge a complaint with the Information Commissioner’s Office;
Data Protection Officer
As a public authority, the council must appoint a DPO to assist the council and its staff to monitor
internal compliance with GDPR.
EPC Data Protection & Privacy Policy Page 4
Duties include:
• Informing the council and its staff of their obligations in the GDPR and other data protection
legislation;
• Monitoring compliance of the council, both in its policies and practices;
• Raising awareness of data protection law; providing training and advice;
• Carrying out data protection-related audits;
• Acting as a contact point for the Information Commissioner’s Office.
From May 2018 the council has appointed its internal auditor to act as DPO.
This appointment will be regularly reviewed at least once every 3 years.
Related Policies & Notices
• Record Management Policy
• Subject Access Policy
• Privacy Notices
How to complain
If you have any concerns about our use of your personal data, you can make a complaint to Eversley
Parish Council at [email protected]
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also
complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint