We keep the Housing Services Privacy Notice under review. It was last reviewed and updated in February 2023.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the privacy and transparency information for all of the City of York Council (CYC).
- personal data
- collecting personal data
- using personal data
- our legal basis for using personal data
- sharing personal data
- retaining personal data
- further processing of personal data
- your rights relating to personal data
Personal data
The type of data we collect about you will depend on our relationship with you and the services you use.
We may collect the following personal data:
- name
- address
- contact information including email address and phone number
- gender
- date of birth
- photographic ID
- National Insurance number
- bank details
- employment details
- marital status
- details of other members of the household
- CCTV images
- benefits/council tax details
- disabilities or vulnerabilities
- medical details
- information about criminal convictions and offences
- your correspondence and communications with us
- call recordings from our contact centre
We also collect, hold and use special categories of personal data which includes:
- physical or mental health details
- sexual life
- racial or ethnic origin
- religious or philosophical beliefs
We are committed to keeping your personal details up to date, and we encourage you to inform us about any changes needed to make sure your details are accurate.
When you provide information about household members we assume that you do so with their full knowledge and consent.
See further details about how we define personal data and non-personal data.
Collecting personal data
We collect most of this data directly from you in person by phone or email and/or through our website. However, we may also collect data from third parties such as:
- housing benefits
- your previous landlords
- the police
- health and social welfare agencies
- enquiries that are received from councillors, MPs or someone acting on your behalf
Using personal data
In the course of our activities as a registered provider of social housing, we need to collect, store and use personal data about you to enable us to deliver efficient and effective services to you such as in the following areas:
- letting, renting and leasing properties
- collection of money owed to the council including rent, service charges, and more
- administering waiting lists
- carrying out research
- providing associated welfare services, advice and support
- maintaining our accounts and records
- supporting and managing our employees, agents and contractors
- promoting equal opportunities
- debt and benefit advice
- employment and training support services
- dealing with complaints and any feedback from you
When you apply for housing with us, on our housing application form or through a homelessness assessment we ask for information about you to:
- assess your need for housing
- enable us to enter into a contract with you
We also collect information from you during the course of your tenancy in order to:
- provide social housing and accommodation services to you
- perform our contract with you
We may hold other information about you for specific purposes for the services we provide. If you do not provide the information we need then we may not be able to provide all our services to you.
We use special categories of personal data to better understand your needs and provide a better service, such as when we obtain information on disabilities to assess the suitability of accommodation or the need for any adaptations.
We also use special category data to monitor equality, diversity and inclusion to ensure services are delivered appropriately, in order to comply with our legal and statutory duties under equality legislation and to meet our regulatory requirements.
Our legal basis for using personal data
We collect and use your personal data because it is necessary for:
- the performance of our contract with you in order to manage your tenancy or lease or other services you have engaged with
- to take steps at your request before entering in to a contract
- to comply with our legal and regulatory obligations
- for our legitimate interests as a registered provider or those of a third party
Sharing personal data
We will share data across the council to ensure that you receive all the services that you have requested, such as with:
- social services
- benefits agencies
- council tax
We will share personal data where required with:
- third parties we use to help deliver our products and or services to you, for example our contractors who carry out the garden maintenance contract, external painting, home modernisation, provide the council with removal services, and more
- credit reference agencies
We only allow our service providers to handle your personal data if we are satisfied they take appropriate measures to protect it. We also impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us and to you.
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other council services or bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.
Retaining personal data
We are committed to making sure that your privacy is protected. Any information you provide will be held securely and in line with data protection and privacy legislation.
We have appropriate security measures in place to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We will keep your personal data for no longer than necessary for the purposes that we have obtained it. We have a Records Retention Schedule which sets out how long we will keep different types of information. Once it is no longer necessary to continue processing your personal data we will delete it securely and confidentially.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.
See further details of your rights relating to personal data.