We keep the Income Services Privacy Notice under review. It was last reviewed and updated in May 2022.
When we collect your personal data, City of York Council complies with data protection legislation, and is the registered ‘Data Controller’. Our data protection notification is registered with the Information Commissioners Office (ICO) reference Z5809563.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the privacy and transparency information for all of the City of York Council (CYC).
Personal data
'Personal data' is any information that relates to an identifiable living person; whether they are identified directly or indirectly by reference to a name, identification number, location data, an online identifier or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
For the purposes of data protection legislation, the term 'personal data' also includes:
- personal information that has been pseudonymised or key-coded (depending on how difficult it is to attribute the pseudonym to an individual)
- genetic data and biometric data (where processed) to uniquely identify an individual ('sensitive personal data' or 'special categories of personal data')
Your personal data will be used to help us to support you in receiving the correct advice and support for the services we provide. Personal data can include but is not limited to:
- name
- address
- contact Information including email and telephone number
- gender
- date of Birth
- national Insurance Number
- property Tenure
- income, Savings/Investments and Expenditure
- bank Details
- disabilities and Vulnerabilities
- medical Information
Non-personal data
Personal data doesn't include information relating to deceased people, groups or communities of people, organisations or businesses, nor to data relating to criminal convictions and offences. However, similar safeguards apply to data processing in those fields.
Collecting personal data
In most cases, we will require details of your full financial circumstances to support any application for social care funding, and we will require documentary evidence to support this. We collect most data directly from you in person, by phone or email and through our website. However, we may also collect data from third parties such as
- Department of Work and Pensions (DWP)
- Her Majesty’s Revenues and Customs (HMRC)
- prepaid Card Providers
- enquiries received from Councillors, MP’s or someone acting on your behalf
We may monitor and record electronic communications (website, email, phone and WhatsApp) for a number of reasons such as:
- records of conversations
- the detection, investigation and prevention of crime
We'll inform you if your call is being recorded or monitored.
Using personal data
When we collect your personal data, we'll tell you how we are going to use it.
We'll only use your personal information in accordance with data protection legislation, and for the purposes stated in this privacy notice.
We'll only ask for what is necessary for
- the purposes of conducting a financial assessment, billing and collecting social care contributions. This includes contacting you to remind you of non-payment of social care contributions
- ask for details of your bank when you want to pay for council services be Direct Debit
- use your data to set up prepaid card accounts where you receive a direct payment, payment for other council services, or welfare payments administered by the Council
- protect it and make sure nobody has access to it who shouldn’t
- ensure you know if you have a choice about giving us information
- only share your personal information with other City of York Council departments or with external partners, agencies and contractors involved in delivering services on our behalf
- make sure we don’t keep it for longer than is necessary
- delete or destroy it securely when we no longer have a need to keep it
We ask that you:
- give us accurate information
- tell us as soon as possible of any changes
- tell us as soon as possible if you notice mistakes in the information we hold about you
If you have a prepaid card, a limited number of authorised officers will be able to access transactional information relating to your account, to be able to assist you with queries you may have about your account and audit your prepaid account in line with our terms and conditions of payment.
Our legal basis for collecting and sharing personal data
We will collect your personal data to assess whether you are entitled to receive council funding towards care and support, and whether you are required to contribute towards care and support services.
Sharing personal data
We act in line with data protection legislation and don't disclose or share sensitive or confidential information without your explicit consent except where disclosure is required by law, or where we have good reason to believe that failing to do so, would put you or someone else at risk.
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.
Retaining personal data
We'll hold your data securely and only for as long as is needed. It will then be deleted in line with our Retention and Disposal Policy and Procedures.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Personal data in online Payments
The information you give to us when using our online payment system will only be used for the recording of your payment. We'll ensure that it is used for no other purpose and is not disclosed to a third party such as other companies or individuals, unless required to do so by law for the prevention of crime and the detection of fraud.
We'll hold it securely and only for as long as is needed. It will then be deleted in line with our Retention and Disposal Policy and Procedures.
Personal data in Emails
Emails that we send to you or you send to us, may be retained as a record of contact and your email address stored for future use in accordance with our record retention schedules.
If we need to email sensitive or confidential information to you, we may perform checks to verify the correct email address and may take additional security measures.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.
See further details of your rights relating to personal data.