How we use your data
How we use your data, our policies and how you can request your personal information.
Privacy notice
Brighton & Hove City Council is committed to protecting your personal information. As a data controller, we have a responsibility to make sure you know why and how your personal information is being collected, following relevant data protection laws.
The primary laws that govern how Brighton & Hove City Council collects and uses personal information (known as Data) about you are:
General Data Protection Regulation (GDPR)
Data Protection Act (DPA) (2018)
Our service privacy notices include details on how our teams collect, store and process your data.
Overview and purposes
We need you to give us your personal information so we can provide services to you as a local authority.
To deliver our services, meet our legal obligations and protect public funds, we need to collect, store, use, share and dispose of personal information. This is known as data processing.
We use your information to:
- verify your identity where required
- contact you by post, email or telephone
- maintain our records
We also receive and share information with third parties. This is usually with other public authorities or government departments, like:
- the police and court service
- the NHS
- HM Revenue and Customs
- the Department for Work and Pensions
We may also share information with other local authorities, contractors who provide services for us and members of the public.
Details of when information is shared and who it's shared with can be found in service-specific privacy notices.
We collect different categories of personal information, depending on the service we provide to you. In most cases, we'll need your name and contact details.
What personal data is
Personal data is specific information about a person that can be used to identify that person on its own or when put together with another piece of information.
Personal data about you is information like your:
- name
- address
- phone number
- date of birth
- National Insurance number
- NHS number
- gender
- email address
- IP address
- location-based data
- financial/bank details
Some types of personal information are more sensitive than others. This information is known as 'special category data' and includes information like:
- race
- ethnic origin
- religious or political beliefs
- trade union membership
- physical and mental health data
- biometric and genetic data, like photographs, fingerprints, facial recognition, and DNA
- sexual orientation
Stricter controls are in place to control when and how we can collect, use and store special category data.
Details of why and how we collect, use and store your personal and special category data can be found in the specific privacy notices for each service.
How we use your personal information
We use your personal information for the purpose it was collected and hold it centrally to ensure we maintain accurate records across the organisation. We also process personal data to prevent fraud.
We will not keep your personal information any longer than needed and will dispose of it securely. The length of time we need to keep information will depend on the purpose for which it's collected.
Our service-specific privacy notices give further information on how long we keep your information.
How we protect your data and keep it secure
Examples of the security measures we use are the following:
- training for our staff, making them aware of how to handle information securely and how and when to report when something goes wrong
- using encryption when data is being sent, meaning that information is scrambled so that it cannot be read without access to an unlock key
- pseudonymising data where possible, meaning that your identity will be removed, so that work can be done without your identity being known by the people doing that work
- controlling access to systems and networks allows us to stop people who are not allowed to view your personal information from getting access to it
- regular testing of our technology and ways of working, including keeping up to date on the latest security updates (commonly called patches)
Who we share your personal information with
To provide services and to meet our legal obligations as a local authority, we sometimes need to share your personal information with external organisations.
We'll only share your personal information where necessary, either to comply with the law or where permitted under data protection legislation.
Examples of organisations we may share your personal information with include:
- NHS
- HMRC
- police
- UK government departments and related agencies
- other local authorities
- Ombudsmen, like the Information Commissioner’s Office, The Care Inspectorate
- care providers and voluntary organisations
For more information about who we share your personal data with and why, see the section ‘Service Related Privacy Notices’.
We only share your information with partners or contractors who agree, through information-sharing agreements, to protect your information.
Sharing information outside of the UK
Almost all personal data we use is stored and processed in the UK. Some information may also be stored within the EU.
If we need to transfer your personal information outside of these areas for a particular activity, this will be explained in the relevant service-specific privacy notice. This will include a description of the protective measures in place to keep it safe.
Surveillance cameras and CCTV
Read our surveillance camera policy.
Closed Circuit Television (CCTV) is operated in and around our properties, including:
- customer service centres
- offices
- libraries
- council housing communal areas
We use CCTV for staff safety, crime prevention and detection, and to fulfil our statutory compliance with fire safety regulations. Footage from these cameras is normally held for 30 days.
Some council staff and contracted agents wear body cameras for:
- evidence gathering
- protection of their health and safety
We also have access to street cameras in common with Sussex Police. The infrastructure for these is owned by the police, who operate the cameras for law enforcement purposes.
We use these cameras for several purposes, including traffic management and traffic enforcement. All requests for access to footage should be directed to Sussex Police.
In addition, we separately operate fixed automatic number plate recognition (ANPR) cameras for monitoring and enforcing bus lanes.
We operate many car parks throughout Brighton & Hove and monitor these through fixed CCTV cameras for the prevention and detection of crime.
Footage from all cameras is retained in alignment with standards set by the Surveillance Camera Commissioner and following the fifth Data Protection Principle.
Electoral Register
The Electoral Register for Brighton & Hove is a separate legal entity from the council.
It's separately notified with the Information Commissioner as a data controller as Electoral Registration Officer, Brighton & Hove City Council.
Website cookies
You can decide what cookies are allowed and delete cookies at any time by adjusting the settings on your web browser. Learn more about how we use cookies on this website.
Data matching and prevention of fraud
We're legally required to protect the public money that we're responsible for. We may share information with other organisations responsible for auditing or managing public money to prevent and detect fraud. We do this through a process known as 'data matching'.
Data matching is where computer records held by one body are compared against other computer records, held by a different part of the same body, or those held by another organisation, to see how far they match. Where a match is found, it may indicate that there's an inconsistency that requires further investigation.
Data matching also helps us to make sure that our records are up-to-date and correct.
We take part in the National Fraud Initiative’s anti-fraud data matching exercise.
We may share your information with debt management agencies and the courts to help collect any outstanding debts. We may also share your information for the same purposes with other public organisations, including neighbouring councils that handle public funds, and with police forces.
We may also provide forwarding addresses for council tenants to utility companies that are collecting outstanding debts.
Artificial Intelligence
Brighton & Hove Council is utilising Artificial Intelligence (AI) technologies to help protect and further develop our services for citizens, so we can continue to deliver them well and efficiently.
We're committed to upholding transparency and exercising responsible management in the use of AI within our business processes. This notice is intended to inform you about our application of AI and outline your rights concerning its use.
We prioritise protecting your privacy and ensuring that all AI implementations adhere to ethical and transparent standards.
We'll be exploring new possibilities to test fast-evolving technologies in areas where they have not previously been applied, while at the same time assessing and managing the associated risks.
We'll use AI to enhance the quality and efficiency of the services we provide. This involves processing personal data through AI systems for the following purposes:
- to test AI tools to improve the quality and efficiency of services
- to provide services to you using AI tools where appropriate
- to manage our internal processes and increase the efficiency of administrative tasks
- for internal research and analysis purposes to help improve our services
Why we process your personal information
In most cases, we'll process your personal data using AI tools to improve the efficiency, quality, and speed of our business processes. A lot of these processes are already happening manually. Using AI to automate these processes allows our resources to be used where they're needed most.
We may use third-party AI tools and services to support our AI initiatives. In such cases, any supplier who has access to your data is assessed for compliance with Data Protection legislation before they process any information.
We will not allow your personal data to be used solely by the AI technology provider to improve their AI products.
The lawful basis for processing
The lawful basis for processing personal data using AI will depend on the specific nature and objectives of each workstream.
When we process personal information relating to residents or service users, this will occur under the appropriate lawful basis in accordance with UK General Data Protection Regulation (UK GDPR) requirements or to meet our legal and statutory obligations as outlined in the relevant privacy notices.
Use of Copilot
We're currently utilising Microsoft Copilot 365 (Copilot) within the council to enhance staff productivity and efficiency. It's essential to emphasise that this AI tool will not be employed to make decisions regarding service users or residents.
Copilot is being implemented to support our staff in tasks such as:
- meetings: Copilot assists with meetings by taking minutes, producing summaries and actions, and helping staff catch up on missed meetings
- writing: Copilot helps with writing documents and emails, such as suggesting ways to word something, helping to create drafts and formatting documents
- presentations: Copilot is used to speed up the time it takes to create PowerPoint presentations
- data analysis: Copilot is used to analyse and visualise data, identify trends, create reports and graphs
The council's data, used with Copilot, is stored within our secure Microsoft tenant, which is held within the UK. The data is under the council's control and is not used to train or improve Microsoft or third-party AI models.
Automated information
We do not currently use AI for automated decision-making. There's always human intervention to review and approve any outputs from the AI tools. Decisions are not made solely by automated means.
Commitment to Security
We remain committed to treating your information securely in line with data protection law, particularly where we are utilising new technology.
Implementing new and fast-developing technology requires a staged approach, which is inherently iterative in nature. This means that the considerations in this privacy notice may be subject to change, i.e. why information is processed, how it is intended to be used, and who it will be shared with, may not be known yet or may change as the project evolves.
Therefore, this privacy notice will be kept under review accordingly to ensure that it is up to date and accurate.
The right to be informed
You have the right to know about the collection and use of your personal data. We'll inform you through our service-specific notices.
The right of access
You can request to know what information we hold on you, along with an explanation of how it's used, by making a “Subject Access Request”.
The right to rectification
You have the right to ask us to update, amend or change your information if it's factually inaccurate or incomplete.
The right to erasure
You have the right to ask us to delete your personal information where it can be shown that we no longer have a lawful basis to retain it, or the information was collected based on consent only, and you have withdrawn your consent.
The right to restrict processing
You have the right to request that we limit the use of your personal data for specific purposes if you do not believe we have a lawful basis for a particular purpose or where you consider the data to be incorrect.
Upon receiving a restriction request, we're obligated to consider our use of the data and provide you with a response.
The right to data portability
You can, in certain circumstances, ask us to provide you with the information you have supplied to us, where it was obtained based on consent or performance of a contract.
The right to object
You have the right, in certain circumstances, to object to us collecting, using and storing your information.
Upon receiving a request of this type, we're required to stop using your data whilst we investigate and provide a response.
Rights relating to automated decision-making and profiling
We'll tell you if we make an automated decision, including profiling, with your personal information. If we do this, you have the right to ask us to make this decision manually instead.
At present, we only use automated decision processes to identify first-round offers of school placements. These offers are subject to appeal, and you have the right to seek a review of your school placement offer by a Council Officer.
Find more information on how to exercise your rights under data protection legislation.
How to get advice or make a complaint
Data Protection Officer
If you're concerned about how we collect or use your personal data, you can contact our Data Protection Officer.
How to make a complaint
We aim to resolve all complaints about how we handle personal information. You also have the right to make a complaint about data protection to the Information Commissioner's Office.
To contact the Information Commissioner's Officer:
- write to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- phone 03031 231 113
You can also make a complaint or find out more information on the Commissioner's Office website.
If your complaint is not about data protection, find details on how to make a complaint about a council service.