Privacy Notice for Health and Safety

Data Controller:

Mole Valley District Council (“MVDC”) is the body exercising control over the purpose for which and the manner in which your personal data is processed.

Data Controller’s contact details:

MVDC Pippbrook, Dorking RH4 1SJ. Telephone: 01306 885 001.

Data Protection Officer:

Mr Tom Penlington (Solicitor): Telephone: 01306 879 354

The legal basis for and the purposes of the processing:

MVDC collects your personal data in order to comply with health and safety legislation. The processing is necessary for compliance with our legal obligations under:

• Health and Safety at Work etc. Act 1974
• Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1985
• Management of Health & Safety at Work Regulation 1999
• Construction (Design and Management) Regulations 2007

The personal data collected is used for the purpose of:

• Records of accidents/incidents
• RIDDOR reports
• Staff safety
• Health and safety training

The personal information that you will be asked to submit for the purposes of health and safety is your: name, address, telephone number, age (if under 18) and details of any injury. In the case of MVDC staff it will also include your department. Information will also be collected electronically via the use of Cookies. Please see the section on Cookies at the end of this Privacy Notice for further information.

In the case of members of the public who pose a risk to staff safety, personal information may be collected without consent under the UK Data Protection Act 2018. This will include your name, address and details of any incidents.

The source of the personal data:

All personal information held about you will be collected directly from you or via the relevant officers within the council.

Recipients and categories of recipients of the personal data:

Recipients of the personal data:

• MVDC staff involved in the administration and management of health and safety

Personal data collected may be shared with:

• Authorised and relevant E-CINS users
• Health and Safety Advisor
• MVDC staff involved in the administration and management of health and safety
• Health and Safety Executive (see the HSE Privacy Notice for further details)
• Posturite (see the Posturite Privacy Notice for further details)

Further information on onward transfers:

MVDC will not transfer the personal data you have provided outside of the UK or European Union unless this is permitted in accordance with the Data Protection Act 2018

How long the personal data will be kept for:

The personal data you have supplied will be retained and destroyed in accordance with MVDC’s Records Retention and Disposal Schedule.

Statutory Obligations to provide the personal data:

You have the right to request that we stop, or restrict the processing of your personal data, in certain circumstances. Where possible we will seek to comply with your request, but we may be required to hold or process information to comply with a legal requirement.

Automated Decision Making:

The personal data provided by you will not be used for any automated decisions.

Data Subject Rights:

From 25 May 2018 you will have some specific rights in respect of your personal data. These may include some or all of the following rights to:

• see what personal data about you MVDC holds at any time (subject to certain caveats, for example where third parties are identified);
• have MVDC correct any errors (if any) in the personal data it holds about you, and to have incomplete personal data completed. In certain situations, however, MVDC can retain the personal data in dispute. You will be informed whether this is the case when we respond to your request;
• request your personal data is erased (though this right will not apply where MVDC is processing your personal data because it is necessary to comply with a legal obligation);
• request processing of your personal data is restricted (this will only apply in certain situations, for example where its accuracy is contested, where the processing is unlawful and you oppose its proposed erasure by MVDC, or where MVDC no longer needs to process the personal data, but it is required by you in connection with legal claims);
• object to the processing where the processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the data controller (though MVDC will still be able to continue with the processing in certain circumstances, such as if there are compelling grounds for the processing which override your interests).

Will the personal data be processed for a different purpose?

No. If MVDC needs to inform recipients about any action it has taken under the Data Protection Act then it will do so by placing a Notice on MVDC’s website informing the public of any relevant changes

If you are dissatisfied with how your personal data is processed by MVDC then you have the right to complain to the Information Commissioner who can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF