Data protection
The Data Protection Act 1998
The Data Protection Act 1998 (DPA) came into force in 2000 and allows you access to information the council holds about you subject to certain restrictions. The DPA also requires that the council protects any personal information it holds about you (known as personal data) by setting certain rules and conditions. Further information about the DPA can be found on the Information Commissioner's website: www.ico.gov.uk/for_the_public/personal_information.aspx.
We regard the lawful and correct treatment of personal data as vital to maintaining the confidence of the many individuals we deal with. We will treat personal data lawfully and correctly and will comply with the data protection principles as set out in the DPA.
Data controllers
All users of personal data are referred to as Data Controllers within the DPA. Data Controllers, such as the council, must work within the requirements of the DPA when obtaining and using personal information. The Information Commissioner regulates the DPA and maintains a public register of all Data Controllers. Each register entry gives details of the Data Controller and a general description of what the personal data held is used for. The council's register entry can be viewed at: www.ico.gov.uk/ESDWebPages/DoSearch.asp
What personal information do we hold?
We hold a vast range of information, some of which is personal. A few examples include the data used for the assessment and collection of Council Tax and Business Rates, the payment of benefits, grants and loans administration and for the collection of domestic waste.
What are your rights?
Your rights under the DPA are:
- To ask what personal information we hold about you.
- To be given a copy of the information (a £10 charge is payable).
- To be given details about the purposes for which we use the information and of other organisations or persons to whom it is disclosed.
- To ask for incorrect data to be corrected.
- To ask us not to use personal information about you for direct marketing; which is likely to cause damage or distress.
- To be compensated for damage or distress should these be caused by our failure to comply with certain requirements of the DPA.
Do we need your consent to use information about you?
Normally, the personal information we hold about you has been collected for a specific purpose. Your consent may be required when we want to use data for a different purpose from that for which it was gathered. However, consent is not required where we are obliged under law to assist in the prevention and detection of crime or where the information is required to perform a statutory function such as the collection of Council Tax. All application forms and requests for your personal information must explain why we require the information requested and whether or not we need your consent. If you have an enquiry or concern regarding the processing of personal data by us, please contact:
Head of Legal and Democratic Services
St Edmundsbury Borough Council
West Suffolk House
Western Way
Bury St Edmunds
Suffolk IP33 3YU
Phone: 01284 757141
Email: joy.bowes@stedsbc.gov.uk
Subject access requests
If you wish to make a request to receive the information we hold about you, you will need to print out and complete a subject access request form (PDF 195Kb). You will be required to provide a proof of identity and a fee of £10 is payable which should be sent with your completed subject access request form to:
Head of Legal and Democratic Services
St Edmundsbury Borough Council
West Suffolk House
Western Way
Bury St Edmunds
Suffolk IP33 3YU
Cheques should be made payable to St Edmundsbury Borough Council. There are circumstances where we may not be able to provide you with all of the information we hold about you either because it is exempt from disclosure or where it may disclose personal information about another individual. Guidance on the exemptions may be found on the Information Commissioner's website at: www.ico.gov.uk/for_organisations/data_protection/the_guide/exemptions.aspx.
The DPA states that a response to a subject access request must be provided within 40 days of receipt of a request. You will be given a copy of the information we hold to keep and check for accuracy. This will either be a printout from a database, a photocopy of your manual records or both.
If the information is incorrect you must write to us and tell us what information is incorrect and ask that it be corrected. We must confirm it has been corrected within 21 days of receiving your request. If we do not agree that the information is incorrect you may ask us to record your disagreement.
If you wish to complain about the way in which your request has been processed then your complaint will be dealt with as a Step 2 complaint in accordance with our complaints procedure. If you are still not satisfied following our response to your complaint you have a right of appeal to the Information Commissioner.
The Information Commissioner has a helpline you can call for help and advice to solve data protection problems on 0303 123 1113.
National Fraud Initiative and data matching
We are required by law to protect the public funds we administer. We may share information provided to us with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud.
The Audit Commission currently requires us to participate in a data matching exercise to assist in the prevention and detection of fraud. The Audit Commission is responsible for running the National Fraud Initiative and carrying out data matching exercises.
Data matching involves comparing computer records held by one body against other computer records held by the same or another body. This is usually personal information. Computerised data matching allows fraudulent claims and payments to be identified. Where a match is found it indicates that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.
We are required to provide particular sets of data to the Audit Commission for matching for each exercise.
The use of data by the Audit Commission in a data matching exercise is carried out with statutory authority under its powers in Part 2A of the Audit Commission Act 1998.
It does not require the consent of the individuals concerned under the Data Protection Act 1998. Data matching by the Audit Commission is subject to a code of practice which can be found on its website at www.audit-commission.gov.uk/fraud/nfi/pages/codeofdatamatchingpractice.aspx.
Freedom of information
The Freedom of Information Act 2000
The Freedom of Information Act 2000 (FOIA) came into force in 2005 and gives you a general right to access information we hold in order to create a better public understanding of how we carry out our duties, why we make our decisions and how we spend public money. The FOIA also promotes a culture of openness and accountability across the public sector.
The Environmental Information Regulations 2004
All environmental information held by us falls under the Environmental Information Regulations. Environmental information is divided into the following six main areas:
- the state of the elements of the environment, such as air, water, soil, land and biological diversity
- emissions and discharges (gases and fluids), noise, energy, radiation, waste and other such substances
- measures and activities such as policies, plans, and agreements affecting or likely to affect the state of the elements of the environment
- reports, cost-benefit and economic analyses
- the state of human health and safety, contamination of the food chain
- cultural sites and built structures (as they may be affected by environmental factors).
A guide to the FOIA and EIR can be found on the Information Commissioner's website at: www.ico.gov.uk/for_the_public/official_information.aspx.
Publication scheme
We are required to produce, maintain and disclose information in accordance with a publication scheme. The scheme sets out what kinds of information we proactively make available, and how we will do it. More information on our publication scheme can be found at:
Requests for information and your right to know
You may ask for any information you think we may hold. The right only covers recorded information which includes information held on computers, in emails and in printed or handwritten documents as well as images, video and audio recordings.
You don't have to know whether the information you want is covered by the Environmental Information Regulations or the Freedom of Information Act. It is for us to decide which law we will need to follow when responding to your request.
A request for information must be made in writing either by emailing: foi@stedsbc.gov.uk or writing to:
Head of Legal and Democratic Services
West Suffolk House
Western Way
Bury St Edmunds
Suffolk IP33 3YU
Please state clearly what information you require, your name, and an address for correspondence.
We will respond as soon as possible, and no later than 20 working days after receiving your request. The reply will confirm or deny whether or not we hold the information, and either provide the information, or explain why it has not been provided.
If you are unhappy with our response you may wish to complain about the way in which your request has been processed. Your complaint will be dealt with as a Step 2 complaint in accordance with our complaints procedure. If you are still not satisfied following our response to your complaint you have a right of appeal to the Information Commissioner.
Exempt information
The FOIA and the EIR recognise that there will be valid reasons why some kinds of information may not be disclosed, such as if its release would damage commercial interests or contained personal information about another individual. For some exemptions we must consider whether the public interest in withholding the information outweighs the public interest in releasing it. If we decide that the information cannot be released we must tell you and explain why.
We are not obliged to deal with vexatious or repeated requests or, in some cases if the cost exceeds an appropriate limit. In addition the FOIA and the EIR do not provide the right of access to personal information about you. This is dealt with by means of a subject access request as detailed above.
