Policy on processing special categories and criminal convictions data
Personal data is any information by which a living individual can be identified. This policy document explains the Council’s responsibilities when it processes personal data which is more sensitive and so needs more protection. This is referred to in the legislation as “special category data” and criminal offence data.
This policy has been produced in accordance with the Council’s obligations under the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018 (“DPA 2018”). It should be read alongside the Council’s Record of Processing Activities, and the Council’s Privacy Policy.
Special category data is data concerning the following:
- health
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data
- sex life or sexual orientation
Criminal offence data is data concerning the following:
- criminal allegations
- criminal offences
- criminal proceedings
- criminal convictions
Article 9(1) of the GDPR prohibits the processing of special category data unless a condition in Article 9(2) is met. There must also be a lawful basis for processing under Article 6 GDPR. They do not need to be linked. These conditions must be determined before any processing of the special category data occurs and they must be documented. Account must also be taken of the DPA 2018, which adds more specific conditions and safeguards:
- Schedule 1 Part 1 contains specific conditions for the various employment, health and research purposes under Articles 9(2)(b), (g), (i) and (j).
- Schedule 1 Part 2 contains specific “substantial public interest” conditions for Article 9(2)(h).
For the Council, the processing of special category personal data (sensitive processing) is only permitted where it is necessary for a function conferred by law or for Government purposes and it is necessary for reasons of substantial public interest.
There is a further requirement that this condition will only be met if the sensitive processing is carried out in accordance with this policy. Council staff must therefore have regard to this policy when carrying out sensitive processing and where the Council is the controller of the personal data.
Personal data about criminal offences and convictions can only be processed if there is a lawful basis under Article 6 and either legal authority or official authority under Article 10. The DPA 2018 provides that the processing of such data meets the requirements of Article 10 only if it meets a condition set out in Part 1, 2 or 3 of Schedule 1.
Where the processing of such data is carried out in reliance on a condition in Part 1, 2 or 3 of Schedule 1 which requires the controller to have an appropriate policy in place when the processing is carried out, the Council must have regard to this policy.
Purpose
The purpose of this policy is to explain:
- Council procedures which are in place in order to ensure compliance with data protection principles when carrying out sensitive processing and the processing of criminal offence data
- Retention and erasure policies concerning the processing of that information.
Compliance with data protection principles
a) ‘lawfulness, fairness and transparency’
The Council will ensure that special category data will be processed lawfully, fairly and in a transparent manner in relation to the data subject. It will only process fairly and will not mislead data subjects about the purposes of the sensitive processing. It will also ensure that data subjects receive full privacy information so that all sensitive processing is transparent.
b) 'purpose limitation’
The Council will carry out sensitive processing when permitted to do so by law. It will be for specified, explicit and legitimate purposes such as for granting Council licences and approval to join the Approved Contractor Scheme, and as set out in a privacy notice. If it is used for a new purpose it must still be compatible with the initial purpose and the data subject must be informed before the further sensitive processing is carried out. Any use of Council data for a non-Council function is required to have a specific lawful basis and it must be compatible with data protection obligations; the processing must therefore be proportionate and necessary.
c) 'data minimisation’
Each Council service has an application form or process to ensure the Council only collects the information necessary to determine entitlement or deliver services. Data subjects will not be asked to answer questions and provide information that is not necessary.
Council internal guidance, training and policies require staff to use only the minimum amount of data required to enable specific tasks to be completed.
Where processing is for research and analysis purposes, wherever possible this is done using anonymised or de-identified data sets.
In all cases, the Council will ensure that the sensitive processing is kept to a minimum and that the data collected and used is adequate and relevant.
d) 'accuracy’
Providing complete and accurate information is always required, as for example, when applying for a Council service or to join the Approved Contractor Scheme. Data subjects are required to notify the Council of relevant changes in their circumstances, such as changes of address or criminal record. Where permitted by law, and when it is reasonable and proportionate to do so, the Council may check this information with other organisations – for example the Home Office, the Police or HMRC. The Council will also try to ensure that the information it collects and uses is accurate and up to date.
If a change is reported by a data subject to the Council regarding only one function or service, whenever possible this will also be used to update other functions or services, both to improve accuracy and to avoid the data subject having to report the same information multiple times.
e) 'storage limitation’
The Council will only keep personal data in a form which permits identification of data subjects for as long as necessary for the purposes of the sensitive processing or where it has a legal obligation to do so. Once the personal data is no longer needed, it will be deleted or rendered permanently anonymous.
f) 'integrity and confidentiality’
The Council will ensure that personal data will be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures. It will ensure that appropriate organizational and technical measures are in place to protect the personal data, whether the data is being processed by its own staff or by a process on its behalf.
How often will this policy document be reviewed?
The Council will formally review this document on an annual basis.