Privacy notice for Disclosure and Barring Service (DBS) applicants

Devon County Council (DCC) is a data controller under Data Protection Legislation and our ICO registration number is Z6475582. This privacy notice concerns the processing of personal data that takes place by the Devon County Council Safer Recruitment Service.

This notice explains what information we collect, why we collect it and how we keep it secure. It also explains your rights and our legal obligation. Should you wish to find out more about Devon County Council’s data protection policies please contact our Data Protection Officer.

How will we use the personal information supplied to us?

We collect your personal data in order to:

Process applications for criminal records checks (DBS checks)

This will result in searches by the DBS and police, issuing a DBS certificate to the applicant and in certain circumstances, obtaining fingerprints.

Submit ‘Adult First’ checks

This is a service provided by the DBS under the Police Act 1997. It can be used in exceptional cases where a person is permitted to start regulated activity work with adults before a DBS certificate has been obtained. This service is only available to organisations who are eligible to access the DBS adults’ barred list and who have requested a check of the barred list on their DBS application form. The DBS Adult First check allows an individual to be checked against the DBS adults’ barred list ahead of the Disclosure certificate being issued. This preliminary result is sent to us.

Submit ‘DBS First checks’

This is a service provided by Capita to check a list of people who are barred from working with children. It can be used in exceptional cases where a person is permitted to start regulated activity work with children before a DBS certificate has been obtained. This service is only available to organisations who are eligible to access the DBS children’s barred list.

Carry out external ID validations in accordance with the requirements of the DBS code of practice

This service is provided by GB Group plc. We will use this service only if the applicant is unable to comply with the Route 1 identity verification.

Carry out qualification and sanction checks

For staff and those involved in the management of schools, using the Department for Education secure access service, provided by the National College for Teaching and Learning.

The information we collect about you depends on the reason for your application with us. We may use the information we obtain for any of the purposes listed above, where required.

Please note we may use previous applications you have submitted to assist in the checking process.

Who is the data controller?

Devon County Council acts as the data controller for personal data provided as part of the DBS process.

Who are the data processors?

A data processor is anyone (other than an employee of a data controller) who processes that data on behalf of the controller.

Devon County Council have a range of suppliers who process data on our behalf. These include:

Our data processors comply with all relevant requirements under data protection legislation.

What are the legal grounds for processing my information?

The DBS was established under the Protection of Freedoms Act (PoFA) 2012 on 1 December 2012. Disclosure functions of the DBS are contained within Part V of the Police Act 1997.

We provide a service which enables employers in the public, private and voluntary sectors to make suitability decisions. We do this by providing an application process to access information provided by the DBS and Police, to enable them to determine whether individuals are unsuitable, or unable to undertake certain work. For example, with occupations involving regular contact with vulnerable groups, including children.

In addition to the above, we may share information with third parties for other purposes where we are legally required to do so.

Why would Devon County Council hold my personal data?

We will only hold your data if you have:

  • previously used or are using our DBS application service
  • been referred to the DBS for consideration under the Safeguarding Vulnerable Groups Act 2006 (SVGA) or Safeguarding Vulnerable Groups (Northern Ireland) Order 2007

If we ask you for personal information, we will:

  • make sure you know why we need this information
  • only ask for information that we need
  • ensure only those appropriate have access to it
  • store your information securely
  • inform you if the information will be shared with a third party
  • ask you to agree to us sharing your information where you have a choice
  • only keep your information for as long as we need to
  • not make it available for commercial use (such as marketing)
  • ensure you are provided with a copy of data we hold on you, on request – this is called a Subject Access Request
  • ensure there are procedures in place for dealing promptly with any disputes or complaints.

In return, we will ask you to:

  • give us accurate information
  • tell us as soon as possible if there are any changes in your application detail.

This helps us to keep your information up to date and secure.

Who we may share your personal data with and why?

Data will be passed to organisations and data sources involved with the DBS where we are legally required to do so. This includes:

In some cases, it may be necessary for us to share information with:

  • Capita – if it is necessary to perform checks against the Children’s Barred List
  • Department for Education secure access – to carry out qualification and sanction checks as required by Statutory guidance provided by the Department for Education
  • GB Group plc – to carry out external ID validation checks, but only in circumstances where applicants are unable to follow the Route ID Verification route as detailed by the DBS guidance

How is my personal data stored?

Your personal data is stored securely with organisational and technical measures in place to protect against unauthorised and unlawful access, processing or disclosure.

How long will DBS hold my information?

Your personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.  We aim to retain personal data in accordance with our Corporate Retention Schedules.

Personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject.

The legal basis for us collecting and sharing your personal data

Where we are collecting personal data about you for the provision of one of the services outlined in this privacy notice, we rely upon the following lawful conditions:

  • Article 6(1)(c) of the General Data Protection Regulations – processing that is necessary for DCC to fulfil a statutory obligation
  • Article 9(2)(b) – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law
  • Part V of the Police Act 1997

If we feel that it is necessary to share your personal data with professionals to ensure you or someone you work with is safeguarded from harm, we rely upon the provisions of the Safeguarding Vulnerable Groups Act 2006 and Children Act 1989 and 2004.  Where it is necessary to share medical or social care information for these purposes, we rely upon article 9(2)(h) of the General Data Protection Regulation (information necessary for medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems).

We may also need to share some personal data about you, so that we can support third party organisations to discharge their regulatory requirements. This includes organisations such as:

  • The data protection regulator (the Information Commissioner’s Office)
  • The Care Quality Commission
  • The Disclosure and Barring Service
  • Police Forces

We may also share information to enable us to comply with court orders and other legal obligations.  If this is necessary, we will only share the minimum amount of personal data needed for this purpose.

What are my rights? How will Devon County Council protect them?

We are committed to protecting your rights under the GDPR.

Your right to be informed

This page provides you with information in relation to how your data is processed as a DBS applicant. This ensures that we are transparent with regards to what we will do with the information you supply to us on your standard or enhanced application.

Your right to access to your personal data held by the DBS – known as a Subject Access Request

You have the right to request a copy of the information we hold about you. On receipt of a valid application we will tell you whether we hold any data about you and provide you with a copy. Further information on how to apply can be found here.

Your right to request that information held is accurate. Can I update it?

If you think that the information held by us is incorrect, you have the right to request that it is corrected. If you challenge the accuracy of data that was provided to us by a third party we will send your request for correction to that party for their consideration.

It is the duty of both you and the employer or organisation who verifies your identity, to ensure that the information you have submitted on your application form is accurate.

If you believe you have submitted an error on an application that is still in progress you will need to contact us immediately on 01392 383266

If you wish to dispute information contained on a completed DBS certificate you can raise a dispute by contacting the DBS on 03000 300 190. Read the DBS guidance on GOV.UK for more information about disputes.

Your right to request erasure of your personal data

In certain circumstances you have a right to have personal data held about you erased. At the DBS we will only do this if certain criteria are met. There are some circumstances where this cannot be done therefore, we advise you to seek independent advice before you submit your application to us.

Any requests for information to be erased will be considered on a case-by-case basis.

There are some specific circumstances where the right to erasure does not apply and we may refuse your request.

Your right to prevent DBS from processing information which is likely to cause you damage or distress

You have the right to request restriction of processing where it has been established that the following applies:

  • where processing is unlawful.

Should you wish to restrict processing of your application you will need to call Devon County Council’s  Safer Recruitment Service helpline on 01392 383266 (Option 1) or email disclose@devon.gov.uk Any requests to stop processing will be considered on a case-by-case basis.

Right to receive an electronic copy of any information you have consented to be supplied to us – known as data portability

You have the right, where this is technically feasible, to electronically receive any personal data you have provided to Devon County Council to process, on a consent basis.

Please note that basic, standard and enhanced certificates are processed under our legal obligation, under Part V of the Police Act 1997, and barring information is processed under the Safeguarding and Vulnerable Groups Act 2006. Therefore, this information falls outside of the right to data portability.

The DBS will consider requests for portability on a case-by-case basis.

You have the right to object to the processing of your information

Should you wish for the DBS to stop processing your application you will need to withdraw the application by contacting them on 03000 200 190 (Option 4).

You have rights relating to automated decisions being made about you

Our disclosure process is generally automated. However, if the DBS identifies that there is potentially police information held about you, this is then sent to the relevant police force for consideration regarding information which may be disclosed on your certificate. This is not an automated process and involves the judgment of the chief officer in respect of the police force which holds that data.

You have the right to object to any automated decision making. It should be noted that you would need to inform the DBS of this on submission of your application, as the certificate can be issued quite quickly. Please contact the DBS helpline on 03000 200 190.

Contacting the Data Protection Officer

Devon County Council’s Data Protection Officer can be contacted by phone on 01392 383000 (ask for Martin Lawrence), by email at keepdevonsdatasafe@devon.gov.uk or post to Data Protection Officer, Room 120, County Hall, Topsham Road, Exeter, EX2 4QD.

You have the right to make a complaint to Devon County Council and the Information Commissioner’s Office (ICO)

If you wish to make a complaint to us regarding the way in which we have processed your personal data you can make a complaint to the Data Protection Officer using the contact details above.

If you then remain dissatisfied with the response received, you have the right to lodge a complaint to the ICO at the following address:

The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk

Restrictions

There are restrictions to the rights of individuals and these are outlined described in more detail on the ICO website.

Transfer outside the European Economic Area

We do not transfer information about you outside of the United Kingdom. If you have spent time in the Channel Islands or the Isle of Man, it is likely that your data will be passed to police forces in that area, by the DBS. If any of your data must be transferred outside of the UK, the DBS will ensure that an adequate level of protection is put in place.

Our staff and systems

  • All DCC countersignatories are vetted by the Disclosure & Barring Service at an Enhanced level
  • All DCC countersignatories undertake data protection e-learning and are aware of their responsibilities under the Council’s data protection policy

Our IT systems have appropriate organisational and technical measures in place to help prevent unauthorised access, processing and disclosure.

Notification of changes

If we decide to change our Privacy policy, we will add a new version here.

Safer Recruitment Service
Devon County Council
Great Moor House
Bittern Road
Exeter
EX2 7NL

Email: disclose@devon.gov.uk

Tel:01392 383266 (Option 1)