Guildford Borough Council and your data

Data Protection law sets out legally binding principles for the good handling of personal data about living individuals.

Our policy sets out the standards all Council services must keep to. Each service head makes sure they use personal information lawfully.

We need to collect and use information about people who use our services, including members of the public, clients and customers, current, past and prospective employees and suppliers.

We are also legally required to collect and use information for laws regulating services such as:

• council tax
• benefits
• electoral registration

This can include information about people other than the person applying for a benefit or service. For example to assess Housing Benefit we need information about everyone living in the property. This is to work out how much should be paid.

This personal information must be collected, used and disposed of properly and securely whether it's:

• on paper
• in a computer
• or recorded on other material

Data protection requirements

Data Protection law requires personal information to be:

1. processed fairly and lawfully and not processed unless specific conditions are met
2. obtained only for one or more specified and lawful purposes, and not further processed in any manner incompatible with that purpose
3. adequate, relevant and not excessive in relation to the purpose for which it's processed
4. accurate and, where necessary, kept up to date
5. not kept for longer than is necessary
6. processed in accordance with the rights of data subjects under the law
7. protected against unauthorised or unlawful processing, accidental loss, destruction or damage by the use of technical and organisational measures

Our data protection commitment

We are committed to:

• observing conditions regarding the collection and use of information
• specifying the purposes for which the information is used
• collecting and processing information only to the extent needed to fulfil operational/service needs or to keep to legal requirements
• ensuring the quality of information used
• determining the length of time information is held
• ensuring people's rights can be fully exercised under the law. These include the right to:
  • be informed that processing is being undertaken
  • have access to one's personal information
  • prevent processing in certain circumstances
  • correct, block or erase information which is regarded as wrong information
  • taking appropriate technical and organisational security measures to safeguard personal information
  • ensuring that personal information is not transferred abroad without safeguards

We ensure that:

• The Data Protection Team takes responsibility for data protection in the organisation
• staff managing and handling personal information are appropriately trained and supervised
• queries about handling personal information are promptly dealt with
• methods of handling personal information are regularly assessed and evaluated
• performance in handling personal information is regularly assessed and evaluated

For more information, please contact The Data Protection Team or visit the Information Commissioner's website. (opens new window)

On this website Data Protection Law refers to the General Data Protection Regulation and the Data Protection Act 2018

Guildford Borough Council has a telephone system capable of recording conversations.  This is standard practice, allowing the recording of calls for quality monitoring and security purposes.

What do we use call recording for?

Calls may be recorded by Guildford Borough Council. These recordings will only be used for the following purposes:

• maintaining high customer service standards
• investigating complaints or issues
• training purposes
• preventing or detecting crime
• protecting our staff.

We do not tolerate abusive language or behaviour either by, or to, members of staff.  All staff have the right to work without fear of verbal or physical abuse.

We're committed to protecting sensitive information shared between ourselves, partner agencies, organisations and residents.

To send secure emails we use Microsoft and Egress Software Technologies. We use these to send encrypted emails and "protected messages".

Microsoft 365

To read a Microsoft "protected message" from us, you'll need to:

• sign in with a Google or Microsoft account
• or press the "sign in with a one-time passcode" option to have a passcode sent to your email address.

For more information, read How do I open a protected message? (opens new window)

Egress Protect

We may send you a "secure email" using services provided by Egress Software Technologies.

To read an Egress encrypted file or file transfer from us you'll need to sign up for a free Egress account. (opens new window) Sign up is simple and only needs doing once

For more information, read How to open a secure email using Egress Web Access? (opens new window)

Contact Egress support (opens new window) if you have difficulty creating your free account.

The Cabinet Office conducts a data matching exercise to assist in the prevention and detection of fraud and this is called the National Fraud Initiative (NFI). This is one of the ways in which the Minister for the Cabinet Office takes responsibility within government for public sector efficiency and reform.

What is data matching?

Data matching involves comparing sets of data, such as the payroll or benefits records of a body, against other records held by the same or another body to see how far they match. The data is usually personal information. The data matching allows potentially fraudulent claims and payments to be identified. Where a match is found, it may indicate that there is an inconsistency that requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

The processing of data by the Cabinet Office in a data matching exercise is carried out with statutory authority. It does not require the consent of the individuals concerned under the Data Protection law.

The National Fraud Initiative is conducted using the data matching powers bestowed on the Minister for the Cabinet Office by Part 6 of the Local Audit and Accountability Act 2014 (LAAA).

All bodies participating in the Cabinet Office's data matching exercises receive a report of matches that they should investigate, to detect instances of fraud, over- or under-payments and other errors, to take remedial action and update their records accordingly.

For information describing which datasets are matched by the Cabinet Office, please refer to the Cabinet Office's guidance on the Code of data matching practice for the National Fraud Initiative. (opens new window) The document 'NFI match types per participating body' summarises the various match types for each particular type of participating organisation.

Code of practice

Data matching by the Cabinet Office is subject to a code of practice. (opens new window) The purpose of this code is to help ensure that the National Fraud Initiative (NFI) and everyone involved in NFI data matching exercises comply with the law, especially the provisions of Data Protection law. It also promotes good practice in data matching.

The code is subject to review following completion of each NFI exercise. Any changes proposed to the code will be consulted upon before a new code is finalised and laid before Parliament.

Data Protection Officer

The Data Protection Officer (DPO):

• monitors the Council's compliance with the General Data Protection Regulation (GDPR)
• is independent
• reports to Senior Management

Contact the DPO if you wish to report a personal data breach. 

What is a personal data breach and how does it happen?

• a personal data breach is the destruction, loss, alteration or access to personal data
• this can happen by accident or in deliberate unlawful circumstances

We will handle all requests for information in line with our Corporate Customer Charter.

For further information, contact the Data Protection Officer.

Information Governance Officer (IGO)

The Information Governance Officer can advise you on your rights to our information.

Laws that affect your information rights and privacy include:

• the General Data Protection Regulation (GDPR)
• Data Protection law
• the Freedom of Information Act 2000 (FOIA)
• the Human Rights Act 1998

The IGO is also responsible for:

• promoting transparency within the Council
• overseeing our publication scheme (required under the FOIA)
• making sure that we have a suitable records retention policy
• telling staff and councillors how to use personal information and manage records in a legal manner (the FOIA)

Contact the IGO if you wish to:

• find out if you have a right to information under the Freedom of Information Act 2000
• if the information relates to the environment, the Environmental Information Regulations 2004
• access your information rights as set out under GDPR
• enquire about the way the Council uses personal information
• report unauthorised disclosures of information or breaches in the Council's information security

All requests for information will be handled in line with our Corporate Customer Charter.

For further information contact the IGO.

Information Assurance Manager (IAM)

The IAM supports the Service Assurance function by implementing the Information and Communications Technology (ICT) and covers:

• security vision
• model and principles
• compliance with Payment Card Industry Data Security Standard
• General Data Protection Regulation (and other appropriate industry standards)

The IAM will support the organisational strategy across the Guildford Borough Council. The IAM will work with the ICT department to guide the selection and deployment of technical controls.

This is to meet specific security requirements, defines the processes and standards to ensure that security configurations are maintained.

The IAM is also responsible for managing Guildford Borough Council through the implementation of ISO27001.