Search site

What these changes will mean for the council?

Find out what the data protection changes will mean for the council.

Data Protection Officer

For a public body, such as ourselves, we are required to appoint a Data Protection Officer. This is a senior officer with responsibility for understanding and overseeing how we collect and process personal data in line with the new Data Protection Act.

Clear reporting processes

The new Data Protection Act will introduce additional responsibilities regarding how we must formally document all our processes about handling personal data and make more information available to customers about what we do with their data.

Managing our systems

We are required to properly design and govern our systems on how we collect, store and share personal data to be compliant with the new Data Protection Act. This will involve additional training for some staff, using good record keeping processes and changing how we work in some key areas.

Processing without consent

Many of our customers require to deal with us in order to access services and we can't provide the service without processing their data. Sometimes it is artificial to seek consent if the individual really has no choice in the matter. In these circumstances we will need to stop asking for consent - and this is a fundamental shift in the way we approach customers' data. If we can't rely on consent we may still be able to process the personal data if we can establish another lawful basis for processing the information.

For example, one lawful basis that we can rely on is if we need to process someone's personal data in order to deliver our statutory functions as a council.

Consent

When consent is required - one of the key changes is around the use of how an individual gives their consent for us to collect and process their personal data. We need to make sure that individuals are treated fairly and that they freely gave their consent for us to collect their personal data and were fully informed at the time they were asked. It will not be acceptable for us to rely on silence or inactivity as consent, when it is required. This is discussed in more detail in the next section.

Restricting processing

The new Data Protection Act introduces the right to stop or restrict us from processing any personal information. The impact of this is however likely to be less on us as a public authority than it will be for private sector undertakings such as search engines and social media.