We keep the York Drug and Alcohol Service (YDAS) Privacy Notice under review. It was last reviewed and updated in December 2020.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the privacy and transparency information for all of the City of York Council (CYC).
Collecting personal data
- ensure you know why we need it
- only ask for what is necessary for the service we are providing to you - this may simply mean providing your name and address but for some services, we will need more details and sometimes special categories of personal data e.g. information about your health.
- protect it and make sure only those people who need access to it can see it.
- ensure you know if you have a choice about giving us information
- make sure we don’t keep it for longer than is necessary
We ask that you:
- give us accurate information
- tells us as soon as possible about any changes
- tell us as soon as possible if you notice any mistakes in the information we hold about you
- create a strong password for your own Recovery Plan access, avoid sharing the password and change it regularly to keep secure
Special Category Data
As part of this service Changing Lives may process “special categories of data” as described in Data Protection legislation. These are more sensitive personal data which require a higher level of protection and include the following:
- Ethnic origin
- Religious beliefs
- Health information
- Sexual orientation; and
- Information about your sex life.
There are extra reasons or conditions that apply for this category of information. The conditions that will most often apply are:
Health or social care: the processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services
Public health: the processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices
Using personal data
When we use your personal data, the YDAS complies with data protection regulations and is included in the City Of York Council’s registration with the Information Commissioner’s Office (ICO) – reference Z5809563- as the controller.
The council (“Data Controller”) has commissioned Changing Lives to provide the YDAS. This means that they are the processor of your personal data on our behalf.
We only use your personal information for the purposes described in this privacy notice.
It will be used by Changing Lives to provide you with the YDAS. This is necessary because we have a statutory requirement to provide health and social care services to our residents.
You can withdraw from the service at any time. If you no longer want to receive the service, please speak to your Support Worker. Or email us at firstname.lastname@example.org or telephone us on 01904 464680.
Our legal basis for using personal data
We need to collect some information from you so that we can deliver the service to you. In order to do this we need to notify you about the reasons we use to collect this.
The lawful bases we use are:
- Public Task – because the we have “a duty to improve the health of the people and responsibility for commissioning appropriate public health services"
- Legitimate Interest - because we have a legitimate interest in using your personal data to deliver the service to you
- Vital Interest – because this applies where processing personal data is necessary to protect someone's life, for example where medical treatment is required and the client is incapable of providing it themselves
Sharing personal data
Where appropriate we will share your personal information for the reasons set out in this privacy notice with:
- National Drugs Treatment Monitoring System (NDTMS)
- Safeguarding Adults and Children
- Another provider should you transfer to another area
- Police and Crime Commissioner
- our Public Health Team
- our Business Intelligence Hub
- Cyber Media – IT system provider
- TEWV (Tees Esk and Wear Valley) Mental Health Services
- MEAM (Making Every Adult Matter)
- Changing Lives Housing Services (if you are residing in a CL property)
If we need to discuss your situation with other agencies, who are not listed in this privacy notice, we will always seek your permission to do so, unless the law requires or permits us to share it for another reason, or for example, it is necessary to do so to protect you or others from harm, a crime has or may be committed or where there might be a child or adult at risk.
Anonymised data may be used to provide statistical and demographic information, for example to report on and evaluate the service.
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.
Retaining personal data
We'll hold your personal information on a secure database and we will also keep paper files where necessary. All records are kept securely and will only be accessible to those people who need access to deliver the service.
We'll offer you access to your Recovery Plan through secure web link so that you can review and record your recovery progress from home. It's important that you protect and keep secure your login details.
We'll keep your personal information for 7 years after your record has been closed or where there has been no interaction with you in that time. We'll delete and destroy it securely.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.