Health and social care

Children's Social Care Privacy Notice

We keep the Children's Social Care Privacy Notice under review. It was last reviewed and updated in January 2022.

If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.

View the privacy and transparency information for all of the City of York Council (CYC).


Personal data

In the course of providing specialist support for a child, young person and their family we collect the following personal information when you provide it to us:

  • personal information (such as name, address, contact details, date of birth, gender, sexual orientation, financial details)
  • special category characteristics (such as ethnicity, disability, mental health status, and drug and alcohol use)
  • personal identifiers (including NHS numbers and Port-Reference and Home Office numbers)
  • details of family relationships, including those of extended family and friends
  • reasons for support (such as what is working well and what you are worried about)
  • assessment and plan information for children in need (such as further details of your strengths and what you are having difficulties with , and how we are going to work together to bring about the changes required)
  • information gathered during child protection processes (during Section 47 enquiries/investigations and Child Protection Conferences)
  • episodes of being looked after (such as important dates and information on placements) and information gathered during these episodes (such as reviews)
  • outcomes for looked after children, such as, your achievements and attainment, whether health and dental assessments are up to date, strengths and difficulties questionnaire scores and personal education plans
  • adoption information, including dates of court orders and decisions and information relating to post-adoption support provided
  • information on care experienced young people, including their; education, attainment, employment status, achievements and the type of accommodation they are living in.

See further details about how we define personal data and non-personal data.

Top of page


Collecting personal data

We also obtain personal information from the following other sources:

  • details of any young person reported missing from home, from the Police
  • referral and involvement information from partner organisations
  • attendance and exclusion information (such as sessions attended, number of absences, reasons, details to support statutory processes) pupil characteristics, and unique pupil number, from your child’s school
  • involvement with other CYC children’s services teams from our existing records
  • information from commissioned providers of social care services
  • court decisions relating to our statutory legal duties
  • details of any child or young person in care placed in York by other local authorities.

We will

  • only ask you for the information that is necessary
  • protect it and make sure nobody has access to it who shouldn’t
  • ensure you know if you have a choice about giving us information
  • make sure we don’t keep it for longer than is necessary

We ask that you:

  • give us accurate information
  • tell us as soon as possible of any changes
  • tell us as soon as possible if you notice mistakes in the information we hold about you

Top of page


Using personal data

We use your personal information to:

  • safeguard and support children, and to monitor their progress
  • enable integrated working with other teams and organisations to ensure you receive the right support at the right time
  • plan and provide the most appropriate level of support to you and your family
  • support you to access relevant support and advice, services and groups, including supporting parents with parenting and/or with difficulties they are facing such as; domestic abuse, substance misuse including alcohol, poor emotion wellbeing and/or mental health etc.
  • prepare information for the courts as required
  • evaluate and quality assure the services we provide, and improve our policies on children’s social care. This will include seeking your feedback on the services you and your family have received
  • inform future service provision and the commissioning of services
  • analyse service provision and effectiveness, and model patterns of service involvement to support future service delivery planning
  • undertake our statutory duties to refer young people and families as required to local housing authorities to reduce homelessness
  • support the provision of free bus passes to children in care and care leavers
  • refer you, your child or family to other services so that additional support can be accessed easily, if you have consented for us to do so
  • inform you about forthcoming events/activities that may be of interest to you, if you have consented for us to do so

We may use information to create reports and statistics that are anonymous and cannot be linked back to you, your family or individuals such as:  

  • statistical analysis
  • statutory returns
  • audit framework

We may use your information when you attend a virtual appointment, event, meeting, briefing or training session, etc. 

If this is by using Attend Anywhere, you can find out more at Attend Anywhere Video Appointments Privacy Notice – City of York Council

If this is by using Microsoft365 (MS365) you can find out more at City of York Council Microsoft Office 365 (MS365) Teams Meeting recording and transcription privacy notice – City of York Council

Top of page


We collect and use your personal information to comply with our legal obligations, and to carry out tasks in the public interest. If we need to collect special category (sensitive) personal information, we rely upon reasons of substantial public interest (safeguarding of children and of individuals at risk, and equality of opportunity or treatment), for the provision of social care or the management of social care systems or services, for social security or social protection law, for scientific or historical research purposes or statistical purposes, and for the establishment, exercise or defense of legal claims whenever courts are acting in their judicial capacity.

These legal bases are underpinned by acts of legislation that dictate what actions can and should be taken by local authorities, including:

  • The Children and Families Act, 2014
  • Children and Social Work Act, 2017
  • Children Act, 1989
  • Homelessness Reduction Act, 2017.
  • Mental Capacity Act, 2005
  • Mental Health Act 1983 (as amended 2007)
  • The Equalities Act 2010
  • The Care Act 2014

We will always ask for your consent to take part in surveys or to get your feedback, about the service and support you and your family has received.

Top of page


Sharing personal data

We will share your personal information to ensure that we can safeguard children and young people and to promote the wellbeing of vulnerable adults. This means we will share information with other organisations and or partner agencies, such as: The Police, Health, Education, and any other agency that is considered relevant for the purpose of safeguarding.

We may also share your personal information with other council services and partner agencies, such as: the Police, Health, Education, Charities, and/or the voluntary sector, as appropriate, to improve outcomes for families’ children and young people such as

  • in house providers of social care services, such as in house foster carers, short breaks
  • commissioned providers of local authority services (such as Independent Foster Care Agencies, Children’s Homes, Semi-Independent accommodation Providers, Supported Lodgings Providers, Residential Special Schools and Secure accommodation). Where services are commissioned, the provider would be a processor of information and also be a controller in their own right, where they collect information for their own purpose.
  • commissioned services to provide support to you or your family, such as independent providers and charities
  • schools
  • government departments including the Department of Education, Department of Work and Pensions, and the Home Office
  • Her Majesty's Courts and Tribunal Service
  • Ofsted (in the event of a local authority inspection of children’s services)
  • The Share-Foundation

Sharing data under Data Protection legislation

We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:

  • law enforcement
  • fraud or tax investigations
  • regulation and licensing
  • criminal prosecutions
  • court proceedings

The Children and Young People (CYP) Integrated Children System

The CYP Integrated Children System is owned and managed by CYC and contains personal data and special category information about children attending CYC schools, and matches additional personal data from multiple data sources within CYC to the pupils.

The aim of the dataset is to allow statistical analysis and research to:

  • support and inform council transformation by ensuring the holistic characteristics and needs of the child population are fully understood
  • provide appropriate levels of insight, evidence and evaluation in order to embed knowledge and understanding of children and young people’s needs and issues into service programs and projects, including the commissioning of new services
  • inform future service delivery planning and integrated working in order to improve outcomes for children and young people.

CYC has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. The child-level dataset is not shared outside of CYC. All personal data is stored in secured electronic files with restricted access. Only pseudonymised* data is used for analysis. Outputs and analysis take the form of aggregated data, and are for the purpose of CYC teams and partners working to improve outcomes for children and young people.

*Pseudonymised data means where we use your information in such a way that it can no longer identify a specific person without the use of additional information. That additional information is always kept securely and separate from pseudonymised data.

Top of page


Retaining personal data

We keep your information securely in line with the retention periods shown below, after which time it is made inaccessible to system users or securely destroyed, unless we are required by legal reasons to retain records for longer than the stated retention period.

Category Retention Period
Children and young people with a Child Protection Plan Date of birth +40 years
Children and young people who have been in the care of the local authority (Looked After Children and Care Leavers) Date of birth +75 years - If the child/young person dies before the age of 18 records will be retained for 15 years from their date of death
Adoptive applicants and parents 25 yrs from the date approval is terminated
Fostering applicants and foster carers For at least 3 years from the refusal or withdrawal, of the application to become a foster parent.
Adoption – Children’s case file, Adoptive parent’s case file, Adoptive Assessment carers case files Date of birth +100 years
Private fostering arrangements Date of birth +75 years
Private foster parents where parents made own arrangements for child to be fostered Last contact with the Private Foster Parent +10 years, or date of death of Private Foster Parent + 2 years
All other records relating to Children and Young People Records of children and young people who don’t fall into any of the above categories, including Children in Need, and general papers where a file has not been opened Date of Birth +25 years
Register of persons posing a risk to children and those cautioned or convicted of offences against children 75 years from the date of the caution/conviction

At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.

Top of page


Transferring personal data abroad

As a rule, we do not transfer your personal data to third party processors outside the UK or European Economic Area (EEA). However, where we use Zoom Video Communications Inc Pro or Business version (“Zoom”) to host meetings (version 5) if they are recorded, recordings will be kept locally on our server and will not be retained by Zoom. Some personal data, such as user’s names, email addresses; telephone numbers where applicable, IP address, MAC address, other device ID (UDID), device type, operating system type and version, client version, type of camera, microphone or speakers, connection type, etc. will be stored securely on Zoom’s system in the US (that is, outside the EEA) in compliance with the EU – US Privacy Shield Framework. Zoom’s certification may be viewed here: https://www.privacyshield.gov/list .

Zoom does not sell personal data to third parties; collects only the personal data required to provide Zoom services; and retains that data only for so long as is necessary for the provision of those services. Zoom’s privacy policy can be viewed here https://zoom.us/gdpr.

Top of page


Further processing of personal data

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.

The new notice will:

  • explain this new use before we start the processing
  • set out the relevant purposes and processing conditions

Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.

Top of page


Caldicott Guardians

See details of our Caldicott Guardians, responsible for protecting the confidentiality of people’s health and care information, and making sure such data is used properly.

Top of page


Your rights relating to personal data

When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.

See further details of your rights relating to personal data.

Top of page


Also see

Data Protection Officer

West Offices, Station Rise, York, YO1 6GA

Telephone: 01904 554145