Introduction

We collect a range of information that falls into the following categories:

• personal details
• family details
• lifestyle and social circumstances
• goods and services
• financial details
• employment and education details
• housing needs
• visual images, personal appearance and behaviour
• licences or permits held
• student and pupil records
• case file information

We also hold information that falls under the following special categories (sensitive information):

• physical or mental health details
• racial or ethnic origin
• trades union membership
• political affiliation
• political opinions
• offences (including alleged offences)
• religious or other beliefs of a similar nature
• criminal proceedings, outcomes and sentences
• biometric information

How we collect your personal information

Your information will be collected in one or more of the following ways:

• paper forms
• online or web form
• in a face-to-face meeting with you
• by phone
• by email
• by letter
• through the use of CCTV
• from one of our partners

We sometimes receive information about you from people you know, if they are concerned about you, or you have given them permission to represent you.

We also work with many partner organisations, sometimes to meet a legal obligation, and sometimes with your consent.

Whenever we need to share your information we will tell you when we collect it.

If we obtain your information from another organisation, we will tell you as soon as is reasonably possible.

The legal basis we are relying on to collect it

When we collect your information we will tell you the reason in law that allows us to collect it or share it. This is the legal basis.

For personal information we will tell you which of the following legal bases applies:

• We have to process your information as it is written into law that we must provide the service
• You have entered into a contract, or are considering entering into a contract with us
• We need to protect your, or someone else’s vital interests
• We have a duty to work with our partners, such as the NHS and the police to provide a service – performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• We have a legitimate interest that requires us to use your information. We still have a duty to make sure that we uphold your privacy rights
• You have given us your explicit consent

For special category information – sensitive personal information – we must also tell you which of the following legal bases applies:

• You have given us your explicit consent
• We have a duty to do so under employment, social security, and social protection law
• We need to protect a person’s vital interests where that person is physically or legally capable of giving consent
• Your information is necessary for the establishment, exercise or defence of legal claims
• Your information is necessary for reasons of substantial public interest as written in law
• Your information is necessary for the assessment of the working capacity as an employee
• Your information is necessary for the provision of health or social care or treatment
• Your information is necessary for the management of health or social care systems and services
• Your information is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border health threats or ensuring high standards of quality and safety of healthcare
• Your information is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

The Act or Acts we are relying on to collect your personal information

Where we are processing your information because we are required to do so by law, we will tell you what law we are relying on, at the time we collect your information.

For example, in respect of public health, births and deaths, marriage, civil partnership, and adoption register, statistics can be shared between the NHS and us for the purpose of assisting us in the performance of our public health functions.

• Section 42(4) of the Statistics and Registration Service Act (2007)
• as amended by section 287 of the Health and Social Care Act (2012)
• and Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.

Consequences of not supplying the information (by law or contract)

Where you refuse to supply us with information that we need, either by law or to enter into a contract with you, we will tell you what will happen if we do not have the personal information needed.

In most cases it is likely that we will not be able to provide you with the service you have asked for.