Privacy Notice for Emergency Planning

Data Controller: Mole Valley District Council

Mole Valley District Council (“MVDC”) is the body exercising control over the purpose for which and the manner in which your personal data is processed.

Data Controller’s contact details:

MVDC Pippbrook, Dorking RH4 1SJ. Telephone: 01306 885001.

Data Protection Officer:

Mr Tom Penlington (Legal Services Manager). Telephone: 01306 879354

The legal basis for and the purposes of the processing:

MVDC has a statutory duty, as a Category 1 Responder, to plan and prepare for emergencies, including response and recovery. This includes the anticipation of assessment and risks, production of plans for controlling or mitigating the impact of emergency incidents and business disruptions as well as effectively responding to, and recovering from, an emergency. These responsibilities as a Category 1 Emergency Responder are set out by the Civil Contingencies Act (CCA) 2004.

The amount and type of data collected will differ depending on the reason for data collection. We routinely collect data to be provided in our Emergency and/or Business Continuity Plans. This includes contact details of individuals whose role includes supporting MVDC’s response to an emergency and/or business disruption.

We may also collect information at the time of an emergency and/or business disruption to assist us to deliver a timely and effective response and recovery.

The Emergency Planning team are able to process relevant personal information. This is because one or more of the conditions referred to below, as set out in the UK GDPR/Data Protection Act 2018 apply:

• Consent: the individual has given clear consent for MVDC to process their personal data for a specific purpose
• Statutory Duty: Processing is necessary for compliance with a legal obligation to which the controller is subject
• Public task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• Vital interests: Processing is necessary to protect someone’s life

Where special category personal data is processed, an additional condition as set out in the UK GDPR/ Data Protection Act 2018 must also be satisfied. The two most likely special category conditions are likely to be:

• The data subject has given  explicit consent to the processing for one or more specified purposes
• The processing is necessary because of the strength of public interest in having appropriate measures in place to assist vulnerable people in emergency situations

(The full text for the above conditions are set out in articles 6 and 9 of the UK GDPR).

The source of the personal data:

Contact details: The information we hold is provided by the individual. This personal information includes name, mobile and home telephone numbers and home location.

Vulnerable people data: The information is provided by the relevant service (Assisted Waste Collections, Community Alarm, Day Centre, Benefits and Dial-A-Ride). Across the data sets, this personal information includes name, address, contact number, date of birth, and the category for the vulnerability.

During an incident: The information we hold is provided by the individual. Their personal information includes name, address, contact details, gender, nationality, next of kin details (incl. contact information) and welfare information (incl. medical information and religion).

Recipients and categories of recipients of the personal data:

In some cases, we may be required to share your personal information with other agencies. The CCA 2004 places a duty on Category 1 and 2 responders to share information upon request which relates to the performance of their duties or functions relating to the preparedness, response and recovery stages if an emergency. Personal data can be requested and the responder receiving the request must comply unless an exemption applies.

We therefore may share this information with other services within MVDC, and other Surrey Local Resilience Forum partners that have a legitimate role in preparing for, responding to, and recovering from emergencies. These partners includes, but are not limited to, Category 1 & 2 responders named in the CCA 2004.

Further information on onward transfers:

MVDC will not transfer the personal data you have provided outside of the UK or European Union unless this is permitted in accordance with the Data Protection Act 2018

How long the personal data will be kept for:

The personal data you have supplied will be retained and destroyed in accordance with MVDC’s Records Retention and Disposal Schedule.

Statutory Obligations to provide the personal data:

There is no statutory obligation on you to provide any personal data about you, however, if you do not it may not be possible to provide assistance to you in the event of an emergency.

Automated Decision Making:

The personal data provided by you will not be used for any automated decisions.

Data Subject Rights:

From 25 May 2018 you will have some specific rights in respect of your personal data. These may include some or all of the following rights to:

• see what personal data about you MVDC holds at any time (subject to certain caveats, for example where third parties are identified);
• have MVDC correct any errors (if any) in the personal data it holds about you
• request your personal data is erased (though this right will not apply where MVDC is processing your personal data because it is necessary to comply with a legal obligation).
• Request processing of your personal data is restricted (this will only apply in certain situations, for example where its accuracy is contested, where the processing is unlawful and you oppose its proposed erasure by MVDC, or where MVDC no longer needs to process the personal data but it is required by you in connection with legal claims).
• Following any changes to your personal data made as a result of (i) rectification, (ii) erasure, or (iii) restriction, MVDC will inform any third party recipients of the changes made, unless this is impossible or would involve disproportionate effort.
• object to the processing where the processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the data controller (though MVDC will still be able to continue with the processing in certain circumstances, such as if there are compelling grounds for the processing which override your interests).
• The Right to data portability which provides you with the right to receive personal data (which you have previously provided to MVDC) in a commonly used and readable format.

Will the personal data be processed for a different purpose?

No. If MVDC needs to inform recipients about any action it has taken under the Data Protection Act then it will do so by placing a Notice on MVDC’s website informing the public of any relevant changes

If you are dissatisfied with how your personal data is processed by MVDC then you have the right to complain to the Information Commissioner who can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF.

Google Analytics

MVDC uses Google Analytics software to collect information about how you use www.molevalley.gov.uk. MVDC does this to help make sure the site is meeting the needs of its users and to help us make improvements.

The cookies MVDC uses for this purpose are:

Universal Analytics

Google Analytics

How do I prevent being tracked by Google Analytics?

If you are uncomfortable with this tracking, you can take the following actions:

• Use a tracking-blocker, such as Privacy Badger
• Clear cookies after every browsing session

Install the Google Analytics opt-out extension.