Previous privacy notice (1.0) - replaced 4 September 2024

You are entitled to apply for personal information recorded about you and/or your child by making a Subject Access Request Article 15 of GDPR. You can only obtain information which is about yourself (or your child/ren if under the age of 14 when they may have capacity to apply in their own right).

If you wish to make any such application, please write to: Information Governance, Legal and Governance, County Hall, Trowbridge BA14 8JN or email to make your request at InformationGovernance@wiltshire.gov.uk (opens new window). Please be as specific as you can about the information you seek as this helps us find it as quickly as possible.

Before providing you with such sensitive information, the Information Governance team will need to see evidence to confirm your identity (this can be by scan or photocopy of a passport or driving licence or birth certificate) and address (similarly by scan/copy of a utility bill or official letter header). Your identity evidence will not be retained after it has been examined.

If you are seeking information from your child(ren)'s records, in addition we will need to see something to prove parental responsibility such as copies of the child(ren)'s birth certificates.

Do not send original documents to the council offices as we cannot guarantee their safety.

Wiltshire Council does not usually use automated decision-making in respect to your personal information. If we do make decisions entirely based on an automatic process will provide you with an explanation of the decision-making criteria and significance or likely consequences of such data processing.

Sometimes the information you are giving us is a statutory or contractual requirement; or a requirement necessary to enter into a contract - if so we will explain at the time we collect that information from you.

Sometimes you are obliged to provide your information, at other times this will be a matter of choice for you. However, failure to provide us with the information we need may result in the council being unable to deliver a full or any service to which you may be entitled simply because we do not have the information needed to do so.

A cookie is a collection of information that some websites leave on your computer to identify you if you use or return to the site. We use cookies to make our website easier for you to use. You can remove any cookies already stored on your computer but doing so may prevent you from using parts of our website for example our area based service information or contact page. Find out more about the cookies we use on our Cookies page.

Data matching involves comparing computer records held by one data controller with other computer records held by the same or another controller to see how far they match. This will often involve matching personal information.

Wiltshire Council undertakes data matching, where necessary, for a number of purposes, to comply with legal requirements placed on the council.

These include to:

• detect and prevent crime/fraud
• assist in emergency response management

In addition, further data matching may be undertaken wholly within particular service areas or directorates. Please see the respective service's website for any additional directorate specific privacy policies.

Wiltshire Council is required by law to protect the public funds it administers. We process and share the information provided to us for the following purposes:

• Council employee payroll
• Council employee pensions
• Electoral register
• Student loans
• Housing
• Supported care (home residents and care home residents)
• Transport passes, including residents' parking blue badges
• Insurance claimants
• Housing and council tax benefits
• Licences, e.g. market trader/ operator, taxi driver and personal licences to supply alcohol
• Council tax
• Leisure
• Property (planning, business rates)
• Libraries
• Information provided by external bodies, e.g. utility companies, credit reference agencies and service providers, including registered social landlords

The processing and data sharing is to prevent and/or detect potential fraud and crime, by both conducting our own data matching, and sharing this information with other public bodies, such as; the Cabinet Office, the Department for Work and Pensions, other Local Authorities, HM Revenues and Customs, the police, as well as utility companies, credit reference agencies and service providers/ contractors and/or partner bodies, where the disclosure of such information is either:

a) necessary for the purposes of the prevention and/or detection of crime; and/or,

b) is otherwise necessary to comply with any other legal obligation.

Computerised data matching allows potentially fraudulent claims, transactions, applications and payments to be identified. Where a match is found and two or more records have contradictory or conflicting information, the inconsistency will require further investigation. No assumption can be made whether there is fraud, error or other explanation until an investigation is carried out. Regardless, the data matching process is a proven way of helping to ensure that records are up-to-date and accurate.

Fraud prevention

The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance, or employment. Further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, can be found at Cifas: Cifas: Fair Processing Notices for Cifas' Databases (opens new window).

Data matching may also be used to assist the council in responding to emergencies or major accidents, by allowing the council, in conjunction with the emergency services, to identify individuals who may need additional support in the event of for example, an emergency evacuation.

Wiltshire Council may use information about your ethnic background, first language, gender, sexual orientation and age ("equalities data") for the purposes of compiling statistical data about the population of the county at large and the take-up council services by various groups, both to assist in complying with our legal obligations and to assist the council in the effective planning and provision of future services.

Such statistical data or statistical analysis will not allow the identification of any specific individual nor will it have any impact on any individual's entitlement to council services and facilities.

Such equalities data may also be used to allow the council to provide sufficient assistance where required, e.g. to provide translation services or access facilities, e.g. induction hearing loop, where appropriate.

We use Google Analytics (GA) to collect statistical data about our visitors and how they use our site so that we can improve our website. The GA cookies collect information in a way that does not form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited.

We collect this information in a way that does not identify you and the data is not shared with anybody else.

Wiltshire Council will not sell or rent your personally identifiable information to anyone, or use the data for any other purpose incompatible with the purpose for which it was originally collected.

Wiltshire Council will only share personal information about you when we have a legal basis to do so. We may also use your information in response to subpoenas, court orders or other legal process. We will only hold your information for as long as necessary for these purposes.

Our processing shall be lawful because at least one of the following will apply:

• the data subject has given consent to the Council for processing of their personal data for one or more specific purposes;
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the Council is subject;
• processing is necessary in order to protect the vital interests of the data subject or of another natural person;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Council;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

If your special category data is processed, in addition to one of the above, processing will be necessary because at least one of the following shall also apply:

• the data subject has given explicit consent to the processing of those personal data for one or more specified purposes,
• to carry out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law
• to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
• processing relates to personal data which are manifestly made public by the data subject;
• for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;
• processing is necessary for reasons of substantial public interest,
• processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services;
• for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices,
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

The council may process your personal information for any of the following purposes:

• maintaining our own accounts and records
• supporting and managing our employees
• promoting the services we provide
• marketing our local tourism
• carrying out health and public awareness campaigns
• managing our property
• providing leisure and cultural services
• provision of education
• carrying out surveys
• administering the assessment and collection of taxes and other revenue including benefits and grants
• licensing and regulatory activities
• local fraud initiatives
• the provision of social services
• crime prevention and prosecution offenders including the use of CCTV
• corporate administration and all activities we are required to carry out as a data controller and public authority
• undertaking research
• the provision of all commercial services including the administration and enforcement of parking regulations and restrictions
• the provision of all non-commercial activities including refuse collections from residential properties,
• internal financial support and corporate functions
• managing archived records for historical and research reasons
• data matching under local and national fraud initiatives

Where necessary and lawful, or when required by legal obligation, we may share information with:

• customers
• family, associates or representatives of the person whose personal data we are processing
• current past and prospective employers
• healthcare, social and welfare organisations
• educators and examining bodies
• providers of goods and services
• financial organisations
• debt collection and tracing agencies
• private investigators
• service providers
• local and central government
• ombudsman and regulatory authorities
• press and the media
• professional advisers and consultants
• courts and tribunals
• trade unions
• political organisations
• professional advisers
• credit reference agencies
• professional bodies
• survey and research organisations
• police forces
• housing associations and landlords
• voluntary and charitable organisations
• religious organisations
• students and pupils including their relatives, guardians, carers or representatives
• data processors
• other police forces, non-home office police forces
• regulatory bodies
• courts, prisons
• customs and excise
• international law enforcement agencies and bodies
• security companies
• partner agencies, approved organisations and individuals working with the police,
• licensing authorities
• healthcare professionals
• current past and prospective employers and examining bodies
• law enforcement and prosecuting authorities
• legal representatives, defence solicitors
• police complaints authority
• the disclosure and barring service

Wiltshire Council will process your personal data for the above purposes for no longer than necessary. Full details of our retention schedule may be found on Freedom of Information frequently asked questions.

Wiltshire Council is working on improving how it provides services to the citizens of Wiltshire.

Single View (SV) is a programme of work collating and sharing specific relevant information between a number of public authority services within the county the (Police, Fire, Ambulance, NHS Trusts, and GP surgeries). Find out more about .

Each SV data sharing arrangement is agreed by submission of a detailed and specific proposal to meet a distinct and individual need and will enable a significant additional service delivery that otherwise may not be possible. Each SV sharing will only be authorised once compliance with data protection principles has been demonstrated.

In deciding what personal data to collect, hold and use, the council is committed to ensuring that it will:

• recognise that any personal data handled by Wiltshire Council is held on behalf of that person and that we ensure we respect that responsibility
• adopt and maintain high standards in respect of the handling and use of that personal data
• only collect, hold and use personal data where it is necessary and proportionate to do so
• securely delete any personal data when no longer needed
• keep your personal data secure and safe
• not unnecessarily and without good reason, infringe the privacy of individuals.
• consider and address the privacy risks first when planning to use or hold personal information in new ways, such as when introducing new systems
• be open with individuals about how we use their information and who we give it to
• make it easy for individuals to access and correct their personal information
• ensure that there are effective safeguards and systems in place to make sure personal information is kept securely and does not fall into the wrong hands
• provide training to staff who handle personal information and treat it as a disciplinary matter if they misuse or don't look after personal information properly
• put appropriate financial and human resources into looking after personal information to make sure we can live up to our promises
• regularly check that we are living up to our promises and report on how we are doing

The council may disclose personal data to third parties, but only where it is necessary, either to comply with a legal obligation, or where permitted under the Data Protection Act, e.g. where the disclosure is necessary for the purposes of the prevention and/or detection of crime, or where it is necessary to allow a third party working for or on behalf of the council.

The council will strive to ensure that any personal data in its care will be kept safe and that where your information is disclosed to a third party, Wiltshire Council will seek to ensure that the third party has sufficient systems and procedures in place to prevent the loss of personal data.

Where the council seeks to disclose sensitive personal data, such as medical details, to third parties, we will do so only with your prior express consent or where we are legally required to do.

Your rights are set out in the current Data Protection legislation and includes:

• the right to access your personal information, to request rectification or erasure of certain personal information and to object to processing in certain circumstances.
• the right to withdraw any consent you may have given to process your personal information
• the right to complain to the Information Commissioner: Make a complaint (opens new window) if you feel we are processing your personal information unlawfully
• the right to restrict processing activity in certain circumstances
• the right to object to certain types of processing activity