Devon County Council (DCC) is collecting and or processing your personal data as a Data Controller under Data Protection Legislation and our ICO registration number is Z6475582. This privacy notice concerns the processing of personal data that is necessary for the purposes of responding to customer feedback as governed by the Customer Feedback Policy and Procedure.

This notice explains what information we collect, why we collect it and how we keep it secure. It also explains your rights and our legal obligation. Should you wish to find out more about Devon County Council’s data protection policies please contact our Data Protection Officer.

We will notify you of any changes to this privacy notice

This privacy notice was last updated 22/12/2021. If we use your personal data for any new purposes, updates will be made to the policy information and changes communicated, where necessary in accordance with current data protection legislation. Any queries relating to this privacy notice please contact the Data Protection Officer.

What information are we processing?

When responding to Customer Feedback we may collect the following personal data when you provide it to us:

Your name
contact details such as address, phone number, email address and preferred contact method
Information you provide us within this feedback
Equalities data that you choose to provide us, such as your ethnicity, religion, sexuality, disability or if you are a carer

We will follow our Data Protection policies to keep your information secure and confidential.

Purpose of collecting or processing your personal data

We use the personal data that you provide us to investigate your feedback and to provide you with a response. When investigating your feedback, we may request comments from third parties who are commissioned by the Council and may have been responsible for delivering a service on our behalf.

We may use your complaint to train staff in how to investigate and respond to customer feedback. In these cases, we will remove any information that may identify you and amend various details to ensure that you will not be identified beyond the trainers.

The legal basis for us collecting your personal data

We rely on article 6(1)(e) of the UK General Data Protection as the lawful basis to collect and use your personal data (processing is necessary for the performance of a task carried out in the public interest). The provision of contact details, including name, address or email address is required from you to enable us to respond to your feedback. If you do not provide your contact details, we will not be able to keep you updated with progress of any investigations we may make because of your feedback.

We rely on article 9(2)(g) of the UK General Data Protection Regulation as the lawful basis to collect and use your special category data for statutory purposes (e.g. when investigating your complaint) or for equalities monitoring, (e.g. when identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people with the view to enabling such equality to be promoted or maintained.)

Where you give us information regarding your health because you require a reasonable adjustment to access our service, we will keep this information with your record to ensure that we can communicate with you in the way that you need. In these cases, we rely on your explicit consent.

Occasionally we may rely upon Schedule 2, Part 1, Paragraph 5 of the Data Protection Act 2018 as the lawful basis to process personal data where the processing is necessary for the exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

We may also process criminal offence data where this is mentioned as part of a complaint. If that is the case, we will rely on the appropriate equivalent conditions in Schedule 1 of the Data Protection Act 2018, namely statutory purposes, legal claims, and judicial acts.

Personal data that is collected for any of the purposes outlined in this notice is never used for direct marketing purposes and is not sold on to any other third parties.

Recipients or categories of recipients that we may share your personal data with

We may share the feedback you provide to us with individuals who may need to help us respond to your feedback. In some cases that may include your name and contact details but only if this is necessary.

We may share your personal data with:

services within the council who can respond to your feedback
NHS where a complaint relates to health and social care services and is being considered by both the Council and an NHS body
third party suppliers who are commissioned by the council to deliver services that you have provided feedback about. This may include care homes, waste and highway contractors, schools, public health contractors, academies, NHS bodies, Education providers and district councils.
Members of Parliament or an advocate if you have asked them to act on your behalf
The Local Government and Social Care Ombudsman or the Information Commissioner’s Office, if you have requested that they investigate your complaint.

Data sharing enables these bodies to investigate any proportion of your feedback that relates to a service that they provide on the Council’s behalf. In certain instances, it may not be possible to investigate your complaint without sharing limited personal data.

Please note that we will only share your personal data when we have lawful grounds to do so. Any personal data that we do share will be kept to the minimum that is necessary for the intended purpose.

We may share personal data with law enforcement or other authorities if we are required by law to do so. There may also be situations where third parties have a statutory right of access to the information or where a court order requires that access be given.

International transfers

Devon County Council does not intend to transfer your personal data to countries that UK data protection laws do not apply. However, if this should become necessary, we will ensure that one or more of the following legitimising conditions are met, to ensure compliance with our data protection obligations:

Adequacy decision
A legally binding and enforceable instrument between public authorities or bodies;
Binding corporate rules in accordance with Article 47;
Standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);
Standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);
An approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights; or
An approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights.

How long will we hold your personal data?

To comply with data protection legislation Devon County Council will only keep personal data for as long as necessary and in line with our organisation’s retention schedule. Personal data you provide to us in relation to a complaint or customer representation about services will be retained for six years from the year of receipt.

Personal data provided to us in relation to a compliment or other type of feedback will be retained for two years from the year of receipt.

Your data protection rights

Under Data Protection Legislation, you have the right to obtain a copy of their personal records held by us, this is called a Subject Access Request (SAR).

Details of how to make a request can be found here.

Further details on your rights under data protection legislation and how to exercise them, are available here.

Complaints

If you have any comments, queries or complaints about this privacy notice or the processing of your personal data please contact our Data Protection Officer

Alternatively, if you are not happy with the way that DCC is handling your personal data, you are entitled to appeal to the Information Commissioners Office (ICO). The Information Commissioners Office enforces and oversees the Data Protection Regulations.
Contact details are below:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email: casework@ico.org.uk

Automated decisions

Devon County Council does not intend to use the personal data that you supply us in your feedback, to make automated decisions that might impact on you or others.