The data controller for your data
Brighton & Hove City Council is the data controller for purposes of the Data Protection Act (2018) and The General Data Protection Regulation (EU) 2016/679 ("GDPR") and is registered as a data controller with the Information Commissioner’s Office (ICO) under registration number Z5840053.
The council is committed to protecting your personal information. As a data controller, we have a responsibility to make sure you know why and how your personal information is being collected in accordance with relevant data protection law.
Why we’re collecting your data
We're collecting your data to assess transport eligibility and make arrangements for home to school transport and independent travel training (ITT).
The information you provide may be verified against information held by other council departments and used in the prevention of fraud.
Home to school transport vehicles have CCTV systems with audio installed.
Purposes for CCTV
All vehicles providing Home to School Transport are required to have CCTV installed.
This is to:
- reassure parents that the safety and wellbeing of their children can be monitored if need be
- assess the suitability of drivers and vehicular passenger assistants to work with children
- manage safe behaviour on school transport, safeguarding passengers and drivers
- manage and investigate allegations, complaints, offences and incidents
- prevent, deter and detect fraud and crime, antisocial behaviour, criminal damage, public disorder, unlawful behaviour and inappropriate conduct
- support the establishment, exercise or defence of legal and insurance claims
What is the lawful basis for collecting your data
There are various lawful bases relating to the different purposes described above.
General data processing associated with provision of home to school transport and monitoring of the suitability of provision via CCTV, is conducted under the lawful basis of public task [GDPR Article 6(1)(e)].
Assessment of the transport requirements of SEN children is likely to require processing of special category (sensitive) data which is done under the health and social care basis [ Article 9(2)(h)].
Investigating safeguarding allegations, including accessing CCTV for this purpose, is done under the lawful basis of legal obligation [Article 6(1)(c)] and substantial public interest [Article 9(2)(g)].
The data we may collect
The type of personal information collected from you is as follows:
- contact details - including name, address, email address, telephone number, and so on
- date of birth
- information about your family
- social and personal circumstances
- financial details for purposes of receiving or making payments
- images of you/ your child’s face and voice recorded on CCTV systems
Special category data
We may also collect special category of personal data that may include physical or mental health details.
Who we’ll share your data with
Your data may be shared with:
- schools that your child attends
- other council departments as necessary to perform transport tasks or comply with statutory duties
- third party transport providers responsible for transporting your child
- the Department for Education for mandatory reporting
How long we’ll keep data for and why
If you/your child do not receive transport assistance, we will hold your data on council systems for up to 6 years after receiving your application.
If your child receives transport assistance, we will hold your data for 6 years after your child has ceased to be transported.
After this time your data will be securely destroyed.
Images captured by CCTV will be retained no longer than necessary according to the Surveillance Camera Commissioner Code of Practice.
However, on occasions there may be a need to keep images for longer, for example:
- where a crime is being investigated
- to investigate a data breach
- to comply with legal requirements
This period can vary as it will depend upon the circumstances of the particular case, but for criminal or civil legal proceedings this could mean that the personal information is retained until after the legal case and any appeals have been concluded, which may be many years.
It will only be kept for the minimum period required and will be securely disposed of once it is no longer required.
How your data will be stored
Your information will be stored electronically on the council’s secure network.
We will only make your information available to those who have a need to see it.
Examples of the security measures we use are:
- training for our staff to make them aware of how to handle information and how and when to report when something goes wrong
- encryption - this means information is hidden so it cannot be read without special knowledge (like a password) - this is done with a secret code and the hidden information is said to then be ‘encrypted’
- controlling access to systems and networks to stop people who are not allowed to view your personal information from getting access to it
- regular testing of our technology and ways of working including keeping up to date on the latest security updates (commonly called patches)
- in all cases, your personal information will be securely destroyed once the retention periods described above expire
Transferring data outside the European Economic Area
Your information is not processed outside of the European Economic Area.
Depending on the lawful basis for processing your information you may have the right to:
- a copy of data held about you, an explanation for its processing and who it has been shared with – this right applies to data processed under any lawful basis
- rectification (correction) of data which is demonstrably wrong – this right applies to data processed under any lawful basis
- restrict processing – this right applies if it has been shown that there is no lawful basis for processing your data, but you wish it to be retained
- object to processing – this right does not apply where the council is under a legal duty to process your data, but can be used where you dispute that there is a lawful basis to process your data until the council can demonstrate what basis exists
- erasure – applicable only in circumstances where there is no longer a lawful basis to retain your data
- object to automated decision making – this right is applicable under all lawful bases for processing
How to get advice or make a complaint
Data Protection Officer
If you have a concern about how we collect or use your personal data you can contact the Council’s Data Protection Officer.
How to make a complaint
We aim to resolve all complaints about how we handle personal information. You also have the right to make a complaint about data protection to the Information Commissioner's Office.
Contact them by post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or phone 0303 1231 113.
You can also make a complaint or find out more information on the Commissioner's Office website.
If your complaint is not about data protection, find details on how to make a complaint about a council service.