RYDE TOWN COUNCIL
STANDING ORDERS
APPENDIX 4
INFORMATION AND DATA PROTECTION POLICY
Ryde Town Council - Standing Orders - Appendix 4 - Information and Data Protection Policy - May 2019
Page 1
INFORMATION AND DATA PROTECTION POLICY
Index
Introduction
Page 3
Protecting Confidential or Sensitive Information
Page 3
Diversity Monitoring
Page 5
Information Provided to the Town Council
Page 5
The Councils Right to Process Information
Page 6
Information Security
Page 6
Children
Page 6
Rights of a Data Subject
Page 6
Making Information Available
Page 7
Disclosure Information
Page 8
Data Transparency
Page 8
Who is responsible for protecting a person’s personal data?
Page 9
Appendices
Appendix A - Data Protection Terminology
Page 10
Appendix B - Statement of Intent
Page 11
Appendix C - Privacy Policy (Separate Document)
Ryde Town Council - Standing Orders - Appendix 4 - Information and Data Protection Policy - May 2019
Page 2
INFORMATION AND DATA PROTECTION POLICY
Introduction
In order to conduct its business, services and duties, Ryde Town Council processes a
wide range of data, relating to its own operations and some which it handles on behalf
of partners. In broad terms, this data can be classified as:
• Data shared in the public arena about the services it offers, its mode of
operations and other information it is required to make available to the public.
• Confidential information and data not yet in the public arena such as ideas or
policies that are being worked up.
• Confidential information about other organisations because of commercial
sensitivity.
• Personal data concerning its current, past and potential employees,
Councillors, and volunteers.
• Personal data concerning individuals who contact it for information, to access
its services or facilities or to make a complaint.
Ryde Town Council will adopt procedures and manage responsibly, all data which it
handles and will respect the confidentiality of both its own data and that belonging to
partner organisations it works with and members of the public. In some cases, it will
have contractual obligations towards confidential data, but in addition will have specific
legal responsibilities for personal and sensitive information under data protection
legislation.
The Town Council will periodically review and revise this policy in the light of
experience, comments from data subjects and guidance from the Information
Commissioners Office.
The Town Council will be as transparent as possible about its operations and will work
closely with public, community and voluntary organisations.
Protecting Confidential or Sensitive Information
Ryde Town Council recognises it must at times, keep and process sensitive and
personal information about both employees and the public, it has therefore adopted
this policy not only to meet its legal obligations, but also to ensure high standards.
The General Data Protection Regulation (GDPR) which becomes law on 25th May
2018 will, like the previous Data Protection Act 1998, seek to strike a balance between
the rights of individuals and the sometimes, competing interests of those such as the
Town Council with legitimate reasons for using personal information.
The policy is based on the premise that Personal Data must be:
• Processed fairly, lawfully and in a transparent manner in relation to the data
subject.
Ryde Town Council - Standing Orders - Appendix 4 - Information and Data Protection Policy - May 2019
Page 3
• Collected for specified, explicit and legitimate purposes and not further
processed in a manner that is incompatible with those purposes.
• Adequate, relevant and limited to what is necessary in relation to the purposes
for which they are processed.
• Accurate and, where necessary, kept up to date.
• Kept in a form that permits identification of data subjects for no longer than is
necessary for the purposes for which the personal data are processed.
• Processed in a manner that ensures appropriate security of the personal data
including protection against unauthorised or unlawful processing and against
accidental loss, destruction or damage, using appropriate technical or
organisational measures.
Ryde Town Council processes personal data in order to:
• Fulfil its duties as an employer by complying with the terms of contracts of
employment, safeguarding the employee and maintaining information required
by law.
• Pursue the legitimate interests of its business and its duties as a public body,
by fulfilling contractual terms with other organisations, and maintaining
information required by law.
• Monitor its activities including the equality and diversity of its activities
• Fulfil its duties in operating the business premises including security
• Assist regulatory and law enforcement agencies
• Process information including the recording and updating details about its
Councillors, employees, partners and volunteers.
• Process information including the recording and updating details about
individuals who contact it for information, or to access a service, or make a
complaint.
• Undertake surveys, censuses and questionnaires to fulfil the objectives and
purposes of the Council.
• Undertake research, audit and quality improvement work to fulfil its objects and
purposes.
• Carry out Council administration.
Where appropriate and governed by necessary safeguards we will carry out the above
processing jointly with other appropriate bodies from time to time.
The Town Council will ensure that at least one of the following conditions is met
for personal information to be considered fairly processed:
• The individual has consented to the processing
• Processing is necessary for the performance of a contract or agreement with
the individual
• Processing is required under a legal obligation
• Processing is necessary to protect the vital interests of the individual
• Processing is necessary to carry out public functions
Ryde Town Council - Standing Orders - Appendix 4 - Information and Data Protection Policy - May 2019
Page 4
• Processing is necessary in order to pursue the legitimate interests of the data
controller or third parties.
Particular attention is paid to the processing of any sensitive personal information
and the Town Council will ensure that at least one of the following conditions is met:
• Explicit consent of the individual
• Required by law to process the data for employment purposes
• A requirement in order to protect the vital interests of the individual or another
person
Diversity Monitoring
Ryde Town Council monitors the diversity of its employees, and Councillors, in order
to ensure that there is no inappropriate or unlawful discrimination in the way it conducts
its activities. It undertakes similar data handling in respect of prospective employees.
This data will always be treated as confidential. It will only be accessed by authorised
individuals within the Town Council and will not be disclosed to any other bodies or
individuals. Diversity information will never be used as selection criteria and will not be
made available to others involved in the recruitment process. Anonymised data
derived from diversity monitoring will be used for monitoring purposes and may be
published and passed to other bodies.
The Town Council will always give guidance on personnel data to employees,
councillors, partners and volunteers through a Privacy Notice and ensure that
individuals on whom personal information is kept are aware of their rights and have
easy access to that information on request.
Appropriate technical and organisational measures will be taken against unauthorised
or unlawful processing of personal data and against accidental loss or destruction of,
or damage to, personal data.
Personal data shall not be transferred to a country or territory outside the European
Economic Areas unless that country or territory ensures an adequate level of
protection for the rights and freedoms of data subjects in relation to the processing of
personal data.
Information provided to the Town Council
The information provided
(personal information such as name, address, email
address, phone number) will be processed and stored so that it is possible for us to
contact, respond to or conduct the transaction requested by the individual. By
transacting with Ryde Town Council individuals are deemed to be giving consent for
their personal data provided to be used and transferred in accordance with this policy,
however where ever possible specific written consent will be sought. It is the
responsibility of those individuals to ensure that the Town Council is able to keep their
personal data accurate and up-to-date. The personal information will be not shared or
provided to any other third party or be used for any purpose other than that for which
it was provided.
Ryde Town Council - Standing Orders - Appendix 4 - Information and Data Protection Policy - May 2019
Page 5
The Town Councils Right to Process Information
• General Data Protection Regulations (and Data Protection Act) Article 6 (1) (a)
(b) and (e)
• Processing is with consent of the data subject, or
• Processing is necessary for compliance with a legal obligation.
• Processing is necessary for the legitimate interests of the Council.
Information Security
The Town Council will ensure the security of personal data. We make sure that your
information is protected from unauthorised access, loss, manipulation, falsification,
destruction or unauthorised disclosure. This is done through appropriate technical
measures and appropriate policies.
We will only keep your data for the purpose it was collected for and only for as long as
is necessary, after which it will be deleted.
Rights of a Data Subject
• Access to Information: an individual has the right to request access to the
information we have on them. They can do this by contacting our Town Clerk
or Data Protection Officer:
• Information Correction: If they believe that the information we have about
them is incorrect, they may contact us so that we can update it and keep their
data accurate. Please contact: Town Clerk.
• Information Deletion: If the individual wishes the Town Council to delete the
information about them, they can do so by contacting the Town Clerk.
• Right to Object: If an individual believes their data is not being processed for
the purpose it has been collected for, they may object by contacting the Town
Clerk or Data Protection Officer.
• Complaints: If an individual has a complaint regarding the way their personal
data has been processed, they may make a complaint to the Town Clerk, Data
Protection
Officer
or
the
Information
Commissioners Office
The Town Council does not use automated decision making or profiling of individual
personal data.
The Town Council will always give guidance on personnel data to employees through
the Employee handbook.
Ryde Town Council - Standing Orders - Appendix 4 - Information and Data Protection Policy - May 2019
Page 6
The Council will ensure that individuals on whom personal information is kept are
aware of their rights and have easy access to that information on request.
Making Information Available
The Publication Scheme is a means by which the Town Council can make a significant
amount of information available routinely, without waiting for someone to specifically
request it. The scheme is intended to encourage local people to take an interest in
the work of the Council and its role within the community.
In accordance with the provisions of the Freedom of Information Act 2000, this
Scheme specifies the classes of information that the Council publishes or intends to
publish.
All formal meetings of the Town Council and its committees are subject to statutory
notice being given on notice boards, the Website and sent to the local media. The
Town Council publishes an annual programme in May each year. All formal meetings
are open to the public and press and reports to those meetings and relevant
background papers are available for the public to see. The Council welcomes public
participation and has a public participation session on each Town Council and
committee meeting. Details can be seen in the Council’s Standing Orders, which are
available on its Website or at its Offices.
Occasionally, Council or committees may need to consider matters in private.
Examples of this are matters involving personal details of staff, or a particular member
of the public, or where details of commercial/contractual sensitivity are to be
discussed. This will only happen after a formal resolution has been passed to exclude
the press and public and reasons for the decision are stated. Minutes from all formal
meetings, including the confidential parts are public documents.
The Openness of Local Government Bodies Regulations 2014 requires written records
to be made of certain decisions taken by officers under delegated powers.
These are not routine operational and administrative decisions such as giving
instructions to the workforce or paying an invoice approved by Council, but would
include urgent action taken after consultation with the Chairman, such as responding
to a planning application in advance of Council. In other words, decisions which would
have been made by Council or committee had the delegation not been in place.
The 2014 Regulations also amend the Public Bodies (Admission to Meetings) Act
1960 to allow the public or press to film, photograph or make an audio recording of
council and committee meetings normally open to the public. The Council will, where
possible, facilitate such recording unless it is being disruptive. It will also take steps to
ensure that children, the vulnerable and members of the public who object to being
filmed are protected without undermining the broader purpose of the meeting.
Ryde Town Council - Standing Orders - Appendix 4 - Information and Data Protection Policy - May 2019
Page 7
The Town Council will be pleased to make special arrangements on request for
persons who do not have English as their first language or those with hearing or sight
difficulties.
Disclosure Information
The Town Council will, as necessary, undertake checks on both staff and Members
with the Disclosure and Barring Service and will comply with their Code of Conduct
relating to the secure storage, handling, use, retention and disposal of Disclosures
and Disclosure Information. It will include an appropriate operating procedure in its
integrated quality management system.
Data Transparency
The Town Council has resolved to act in accordance with the Code of Recommended
Practice for Local Authorities on Data Transparency (September 2011). This sets out
the key principles for local authorities in creating greater transparency through the
publication of public data and is intended to help them meet obligations of the
legislative framework concerning information.
“Public data” means the objective, factual data on which policy decisions are based
and on which public services are assessed, or which is collected or generated in the
course of public service delivery.
The Code will therefore underpin the Council’s decisions on the release of public data
and ensure it is proactive in pursuing higher standards and responding to best practice
as it develops.
The principles of the Code are:
• Demand led: new technologies and publication of data should support
transparency and accountability
• Open: the provision of public data will be integral to the Council’s engagement
with residents so that it drives accountability to them.
• Timely: data will be published as soon as possible following production.
Government has also issued a further Code of Recommended Practice on
Transparency, compliance of which is compulsory for Town and Parish councils with
turnover (gross income or gross expenditure) not exceeding £25,000 per annum.
These councils will be exempt from the requirement to have an external audit from
April 2017. Ryde Town Council exceeds this turnover but will never the less ensure
the following information is published on its Website for ease of access:
• All transactions above £100.
• End of year accounts
• Annual Governance Statements
• Internal Audit Reports
Ryde Town Council - Standing Orders - Appendix 4 - Information and Data Protection Policy - May 2019
Page 8
• List of Councillor or Member responsibilities
• Details of public land and building assets
• Draft minutes of Council and committees within one month
• Agendas and associated papers no later than three clear days before the
meeting.
Privay Policy
Ryde Town Council regards your privacy as important and complies with the Data
Protection Act 1998 and the General Data Protection Regulation (GDPR). In this
respect the Council has adopted a Privacy Policy, which forms Appendix C to this
policy (Separate Policy Document).
Who is responsible for protecting a person’s personal data?
The Town Council as a corporate body has ultimate responsibility for ensuring
compliance with the Data Protection legislation. The Council has delegated this
responsibility day to day to the Town Clerk.
• Phone: 01983 811105
• Correspondence: The Town Clerk, Town Hall Chambers, 10 Lind Street, Ryde,
Isle of Wight PO33 2NQ
Ryde Town Council - Standing Orders - Appendix 4 - Information and Data Protection Policy - May 2019
Page 9
APPENDIX A - DATA PROTECTION TERMINOLGY
Data subject - means the person whose personal data is being processed.
That may be an employee, prospective employee, associate or prospective associate
of BTC or someone transacting with it in some way, or an employee, Member or
volunteer with one of our clients, or persons transacting or contracting with one of our
clients when we process data for them.
Personal data - means any information relating to a natural person or data subject
that can be used directly or indirectly to identify the person.
It can be anything from a name, a photo, and an address, date of birth, an email
address, bank details, and posts on social networking sites or a computer IP address.
Sensitive personal data - includes information about racial or ethnic origin, political
opinions, and religious or other beliefs, trade union membership, medical information,
sexual orientation, genetic and biometric data or information related to offences or
alleged offences where it is used to uniquely identify an individual.
Data controller - means a person who (either alone or jointly or in common with other
persons) (e.g. Town Council, employer, council) determines the purposes for which
and the manner in which any personal data is to be processed.
Data processor - in relation to personal data, means any person (other than an
employee of the data controller) who processes the data on behalf of the data
controller.
Processing information or data - means obtaining, recording or holding the
information or data or carrying out any operation or set of operations on the information
or data, including:
• Organising, adapting or altering it
• Retrieving, consulting or using the information or data
• Disclosing the information or data by transmission, dissemination or otherwise
making it available
• Aligning, combining, blocking, erasing or destroying the information or data
regardless of the Technology used.
Ryde Town Council - Standing Orders - Appendix 4 - Information and Data Protection Policy - May 2019
Page 10
APPENDIX B - STATEMENT OF INTENT
The Council is required to collect and use certain types of information concerning
individuals who come into contact with the Council.
The purpose of the policy is to ensure the confidentiality, and lawful and correct
treatment of personal data. To this end, the Council fully endorses and adheres to the
principles of data protection as detailed in the General Data Protection Regulations
and any subsequent amendments.
Personal data will be
• Obtained only for lawful and specific purpose(s)
• Relevant to the purpose for collection
• Processed fairly and lawfully under the Act
• Accurate and where necessary kept up to date
• Not kept longer than is necessary for the purposes for which it is obtained or
processed
• Kept secure and only be made available for the specific purpose(s) unless
already in the public domain
• Held and only used within the European Economic Area unless data subjects
are specifically informed otherwise.
Personal data will only be kept for, and restricted to the following;
• Provision of local services
• Campaigns, public relations and fund-raising
• To meet the requirements of employment and contractor administration
• If necessary for leases associated with Council owned properties
• For correspondence purposes
Data may be held within the computer databases or in printed form. Both storage
methods will be protected from unauthorised access.
Policy Adopted by Ryde Town Council in June 2018
Review Date: May 2019
Ryde Town Council - Standing Orders - Appendix 4 - Information and Data Protection Policy - May 2019
Page 11
