We keep the York Drug and Alcohol Service (YDAS) Privacy Notice under review. It was last reviewed and updated in January 2019.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the Privacy and transparency information for all of the City of York Council (CYC).
Collecting personal data
- ensure you know why we need it
- only ask for what is necessary for the service we are providing to you - this may simply mean providing your name and address but for some services, we will need more details and sometimes special categories of personal data e.g. information about your health.
- protect it and make sure only those people who need access to it can see it.
- ensure you know if you have a choice about giving us information
- make sure we don’t keep it for longer than is necessary
We ask that you:
- give us accurate information
- tells us as soon as possible about any changes
- tell us as soon as possible if you notice any mistakes in the information we hold about you
See further details about the steps we take when we collect your personal data.
Using personal data
When we use your personal data, the YDAS complies with data protection regulations and is included in the City Of York Council’s registration with the Information Commissioner’s Office (ICO) – reference Z5809563- as the controller.
The council (“Data Controller”) has commissioned Changing Lives to provide the YDAS. This means that they are the processor of your personal data on our behalf.
We only use your personal information for the purposes described in this privacy notice.
It will be used by Changing Lives to provide you with the YDAS. This is necessary because we have a statutory requirement to provide health and social care services to our residents.
You can withdraw from the service at any time. If you no longer want to receive the service, please speak to your Support Worker. Or email us at firstname.lastname@example.org or telephone us on 01904 464680.
See further details about how we use your personal data.
Sharing personal data
We will share your personal information for the reasons set out in this privacy notice with:
- National Drugs Treatment Monitoring System (NDTMS)
- Safeguarding Adults and Children
- Another provider should you transfer to another area
- Police and Crime Commissioner
- our Public Health Team
- our Business Intelligence Hub
- Cyber Media– IT system provider
If we need to discuss your situation with other agencies, who are not listed in this privacy notice, we will always seek your permission to do so, unless the law requires or permits us to share it for another reason, or for example, it is necessary to do so to protect you or others from harm, a crime has or may be committed or where there might be a child or adult at risk.
Anonymised data may be used to provide statistical and demographic information, for example to report on and evaluate the service.
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.
Our legal basis for collecting and sharing personal data
We need to collect some information from you so that we can deliver the service to you. In order to do this we need to notify you about the reasons we use to collect this.
The lawful bases we use are:
- Public Task – because the we have “a duty to improve the health of the people and responsibility for commissioning appropriate public health services"
- Legitimate Interest - because we have a legitimate interest in using your personal data to deliver the service to you
- Vital Interest – because this applies where processing personal data is necessary to protect someone's life, for example where medical treatment is required and the client is incapable of providing it themselves
Retaining personal data
We will hold your personal information on a secure database and we will also keep paper files where necessary. All records are kept securely and will only be accessible to those people who need access to deliver the service.
We will keep your personal information for 7 years after your record has been closed or where there has been no interaction with you in that time. We will delete and destroy it securely.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
See further details about the further processing of personal data.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.