We keep the Information Governance, Customer Complaints and Feedback Team Privacy Notice under review. It was last reviewed and updated in May 2018.

If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.

View the Privacy and transparency information for all of the City of York Council (CYC).


Personal data

The amount and type of personal data we collect from you will depend on why and how you're contacting or interacting with us, and the service you are requesting.

This may simply mean providing your name and address, for example when making a Freedom of Information Act (FOIA) request. For some of our services, we'll need more details and sometimes sensitive personal data or special categories of personal data, for example if you're complaining about an assisted medical waste collection.

We monitor and record phone calls for a number of reasons and you can find out more details on how your personal data is used in the Call Recording Privacy Notice.

See further details about how we define personal data and non-personal data.


Collecting personal data

When we collect your personal data we'll:

  • ensure you know why we need it
  • only ask for what is necessary for the service we're providing to you
  • protect it and make sure nobody has access to it who shouldn’t
  • ensure you know if you have a choice about giving us personal data
  • make sure we don’t keep it for longer than is necessary

We ask that you:

  • give us accurate information
  • tells us as soon as possible of any changes
  • tell us as soon as possible if you notice mistakes in the information we hold about you

See further details about the steps we take when we collect your personal data.


Sharing personal data

We will only share your personal data with the relevant regulators and other parties such as independent people or investigators who need it as part of their investigation or to respond to a request.

Sharing data under Data Protection legislation

We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:

  • law enforcement
  • fraud investigations
  • regulation and licensing
  • criminal prosecutions
  • court proceedings

We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.


Our legal basis for collecting and sharing personal data

For information governance, data protection, Environmental Information Regulations (EIR), FOIA, rights of individuals:

When you contact us about one or more of these requests, we'll collect and use your personal data to comply with our obligations under the relevant legislation and laws, and to be able to respond to you and the regulator, for example. the Information Commissioner’s Office, where required.

For Member of Parliament (MP) enquiries, complaints, concerns, comments, compliments for adults social care, and complaints for children’s social care:

When you contact us about one or more of these requests, we'll collect and use your personal data to comply with our obligations under the adult and children’s social care legislation, and to be able to respond to you and the relevant regulator e.g. the Local Government and Social Care Ombudsman, and to provide a service in the public interest.

Where you are raising a complaint, concern, comment, or compliment on behalf of someone else, or have contacted us raising issues under another procedure such as safeguarding, or staff conduct, we'll also process their personal data.


Retaining personal data

For information governance, data protection, EIR, FOIA, rights of individuals:

We'll keep your personal data for 2 years after your last contact with us.

This means if we don’t hear from you in that time period, we'll delete your personal data from our records.

For MP enquiries, complaints, concerns, comments, compliments for adults social care, and complaints for children’s social care:

We'll keep your personal data for 6 years after your last contact with us.

This means if we don’t hear from you in that time period, we'll delete your personal data from our records.

For records relating to children, we have to comply with the requirements of the national enquiry and will keep them for the duration of that enquiry, or for 6 years whichever is the longest.


Further processing of personal data

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.

The new notice will:

  • explain this new use before we start the processing
  • set out the relevant purposes and processing conditions

Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.

See further details about the further processing of personal data.


Your rights relating to personal data

When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.

See further details of your rights relating to personal data.


Also see

Comment on this page