Record of Processing Activities

Record of Processing Activities – under Article 30 (1) of the GDPR and Clause 61 of the Data Protection Act 2018

Full address: - Arun District Council, Civic Centre, Maltravers Road, Littlehampton, West Sussex, BN17 5LF

Telephone: - 01903 737500

Data Protection Officer:- Daniel Bainbridge, Group Head of Law and Governance, Arun District Council, Civic Centre, Maltravers Road, Littlehampton, West Sussex, BN17 5LF data.protection@arun.gov.uk

As a local authority we process a wide range of personal information to enable us to provide a range of local government and statutory services to local people and businesses within the Arun District. A requirement of the above data protection legislation is that we can account for all our processing of personal data and that members of the public that use our services are clear about what happens to their personal data that we process. The Record of Processing Activities below provides information about the areas in which we process personal data and provides links to where Privacy Notices are published to show exactly what happens with personal data in these areas.

Purpose of processing

We process personal information to enable us to provide a range of local government and statutory services to local people and businesses which include:

maintaining our own accounts and records
supporting and managing our employees
promoting the services we provide
marketing our local tourism
carrying out health and public awareness campaigns
managing our property
provision of leisure and cultural services
carrying out surveys
administering the assessment and collection of taxes and other revenue including benefits and grants
licensing and regulatory activities
local fraud initiatives
crime prevention and prosecutions including use of CCTV
corporate administration and all activities required to carry out as data controller and public authority
research
provision of commercial services including the administration and enforcement of parking regulations and restrictions
provision of non-commercial activities including refuse collections from residential properties
internal financial support and corporate functions
managing archived records for historical and research purposes
data matching under local and national fraud initiatives
debt administration and factoring
use of CCTV systems for public safety and property management as well as crime deterrent
protection of life and property
management of Information Technology systems
public health
prevention and control of disease within the community
occupational health and welfare
produce and distribute e-communications and printed material
management of public relations, journalism, advertising, and media
any duty or responsibility of the Local Authority arising from common or statute law

We process personal information about

customers and service users
suppliers
staff (including volunteers, agents, temporary and casual staff)
elected members or supporters
claimants
complainants, enquirers, or their representatives
professional advisors and consultants
carers or representatives
landlords
benefit recipients
witnesses
offenders and suspected offenders
licence and permit holders
traders and others subject to inspection
individuals captured by CCTV images
representatives of other organisations

We process information relevant to the above reasons/purposes which may include

personal details
family details
lifestyle and social circumstances
goods and services
financial details
employment and education details
housing needs
visual images, personal appearance, and behaviour
licences and permits held
business activities
case file information
death records

We also process sensitive classes of information (“special category data”) that may include

physical or mental health details
racial or ethnic origin
trade Union membership
political affiliation
political opinions
offences (including allegations)
religious beliefs (or other beliefs of a similar nature)
criminal proceedings, outcomes, and sentences
biometric data
genetic data
where allowed by law, necessary or required by law we may share information with
customers and service users

Where allowed by law, necessary, or required by law we may share information with

customers and service users
family, associates, or representatives of the person whose personal data we are processing
current past and prospective employers
healthcare, social and welfare organisations
providers of goods and services
financial organisations
debt collection and tracing agencies
private investigators
service providers
local and central government
ombudsmen and regulatory authorities
press and the media
professional advisors and consultant
courts and tribunals
trade unions
political organisations
professional advisors
credit reference agencies
professional bodies
survey and research organisations
police
housing associations and landlords
voluntary and charitable organisations
religious organisations
data processors
regulatory bodies
court and Prison services
customs and excise
local and central government
international law enforcement agencies and bodies
security companies
partner agencies, approved organisations and individuals working with the police
licensing authorities
service providers
healthcare professionals
current, past, and prospective employers and examining bodies
law enforcement and prosecuting authorities
legal representatives, defence solicitors
Police Complaints Authority
the Disclosure and Barring Service

The transfer of personal data will take place when technical and organisational security measures have been put in place via a contract; data sharing agreement; with the consent of the data subject; or where required by law.

Sharing of personal data

In undertaking its services, Arun District Council shares personal data with an receives personal data from several third parties including Members of Parliament, local Councillors, partner organisations and other outside bodies. This is undertaken in accordance with the Data Protection Act 2018 and GDPR, the necessary data protection impact assessments (DPIA) for high-risk data sharing, privacy notices setting out the lawful basis for such sharing and appropriately worded contracts and agreements in place to regulate the process.

Arun District Council regularly undertakes a review of all initiatives that involve working in partnership where data sharing is taking place.

Lawful basis for the processing

Please refer to the relevant privacy notice for information on the purpose, lawful basis and retention periods.

The council takes organisational security seriously and includes measures such as the following, but not limited to:

staff training
organisational policies
technical controls
user access controls
security at rest and transit
pseudonymisation
anonymisation
business continuity and resilience planning including backups
robust security updates including timely patching and anti-virus software
physical security eg restricted room access, etc
independent vulnerability testing
data Protection Impact Assessments
contractual controls
data minimisation
retention management
supplier accreditation checks

In accordance with Article 30(2) of the GDPR, Arun District Council will require data processors to keep a record of the above when it is processing data on behalf of Arun District Council unless it is exempt from doing so, such as:

it is an enterprise or an organisation employing fewer than 250 people; and;
it is not processing data that is likely to result in a risk to the rights and freedoms of data subjects
the processing is occasional; or
the processing does not include special categories of data or personal data relating to criminal convictions and offences

Internal processing activities

Arun District Council has undertaken a full review of all systems that process personal data to ensure that all processing has been accounted for. These will include both manual and electronic systems which will comply with the council’s requirements in terms of security, risks assessed via the undertaking of a DPIA and will be referred to as required in the relevant privacy notices.