School transport service privacy notice

Read our privacy notice for information on how we collect, store and process your data.

The data controller for your data

Brighton & Hove City Council is the data controller for purposes of the Data Protection Act (2018) and The General Data Protection Regulation (EU) 2016/679 ("GDPR") and is registered as a data controller with the Information Commissioner’s Office (ICO) under registration number Z5840053.

The council is committed to protecting your personal information. As a data controller, we have a responsibility to make sure you know why and how your personal information is being collected in accordance with relevant data protection law.

Why we’re collecting your data

We're collecting your data to assess transport eligibility and make arrangements for home to school transport and independent travel training (ITT).

The information you provide may be verified against information held by other council departments and used in the prevention of fraud. 

Home to school transport vehicles have CCTV systems with audio installed.

Purposes for CCTV

All vehicles providing Home to School Transport are required to have CCTV installed.

This is to:

  • reassure parents that the safety and wellbeing of their children can be monitored if need be
  • assess the suitability of drivers and vehicular passenger assistants to work with children
  • manage safe behaviour on school transport, safeguarding passengers and drivers
  • manage and investigate allegations, complaints, offences and incidents
  • prevent, deter and detect fraud and crime, antisocial behaviour, criminal damage, public disorder, unlawful behaviour and inappropriate conduct
  • support the establishment, exercise or defence of legal and insurance claims

What is the lawful basis for collecting your data

There are various lawful bases relating to the different purposes described above.

General data processing associated with provision of home to school transport and monitoring of the suitability of provision via CCTV, is conducted under the lawful basis of public task [GDPR Article 6(1)(e)].

Assessment of the transport requirements of SEN children is likely to require processing of special category (sensitive) data which is done under the health and social care basis [ Article 9(2)(h)].

Investigating safeguarding allegations, including accessing CCTV for this purpose, is done under the lawful basis of legal obligation [Article 6(1)(c)] and substantial public interest [Article 9(2)(g)].

The data we may collect

Personal data

The type of personal information collected from you is as follows:

  • contact details - including name, address, email address, telephone number, and so on
  • date of birth
  • information about your family
  • social and personal circumstances
  • financial details for purposes of receiving or making payments
  • images of you/ your child’s face and voice recorded on CCTV systems

Special category data

We may also collect special category of personal data that may include physical or mental health details.

Who we’ll share your data with

Your data may be shared with:

  • schools that your child attends
  • other council departments as necessary to perform transport tasks or comply with statutory duties
  • third party transport providers responsible for transporting your child
  • the Department for Education for mandatory reporting

How long we’ll keep data for and why

If you/your child do not receive transport assistance, we will hold your data on council systems for up to 6 years after receiving your application.

If your child receives transport assistance, we will hold your data for 6 years after your child has ceased to be transported.

After this time your data will be securely destroyed.

Images captured by CCTV will be retained no longer than necessary according to the Surveillance Camera Commissioner Code of Practice.

However, on occasions there may be a need to keep images for longer, for example:

  • where a crime is being investigated
  • to investigate a data breach
  • to comply with legal requirements

This period can vary as it will depend upon the circumstances of the particular case, but for criminal or civil legal proceedings this could mean that the personal information is retained until after the legal case and any appeals have been concluded, which may be many years.

It will only be kept for the minimum period required and will be securely disposed of once it is no longer required.

How your data will be stored

Your information will be stored electronically on the council’s secure network.

We will only make your information available to those who have a need to see it.

Examples of the security measures we use are:

  • training for our staff to make them aware of how to handle information and how and when to report when something goes wrong
  • encryption - this means information is hidden so it cannot be read without special knowledge (like a password) - this is done with a secret code and the hidden information is said to then be ‘encrypted’
  • controlling access to systems and networks to stop people who are not allowed to view your personal information from getting access to it
  • regular testing of our technology and ways of working including keeping up to date on the latest security updates (commonly called patches)
  • in all cases, your personal information will be securely destroyed once the retention periods described above expire

Transferring data outside the European Economic Area

Your information is not processed outside of the European Economic Area.

Your rights

Depending on the lawful basis for processing your information you may have the right to:

  • a copy of data held about you, an explanation for its processing and who it has been shared with – this right applies to data processed under any lawful basis
  • rectification (correction) of data which is demonstrably wrong – this right applies to data processed under any lawful basis
  • restrict processing – this right applies if it has been shown that there is no lawful basis for processing your data, but you wish it to be retained
  • object to processing – this right does not apply where the council is under a legal duty to process your data, but can be used where you dispute that there is a lawful basis to process your data until the council can demonstrate what basis exists
  • erasure – applicable only in circumstances where there is no longer a lawful basis to retain your data
  • object to automated decision making – this right is applicable under all lawful bases for processing

How to get advice or make a complaint 

Data Protection Officer 

If you have a concern about how we collect or use your personal data you can contact the Council’s Data Protection Officer.  

How to make a complaint 

We aim to resolve all complaints about how we handle personal information. You also have the right to make a complaint about data protection to the Information Commissioner's Office.  

Contact them by post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or phone 0303 1231 113. 

You can also make a complaint or find out more information on the Commissioner's Office website. 

If your complaint is not about data protection, find details on how to make a complaint about a council service.