Welfare rights service privacy notice

Read our privacy notice for information on how we collect, store and process your data.

The data controller for your data

Brighton & Hove City Council is the data controller for the purpose of the Data Protection Act (2018) and The General Data Protection Regulation (EU) 2016/679 ("GDPR") and is registered as a data controller with the Information Commissioner’s Office (ICO) under registration number Z5840053.

Brighton & Hove City Council is committed to protecting your personal information. As a data controller, we have a responsibility to make sure you know why and how your personal information is being collected in accordance with relevant data protection law.

Why we’re collecting your data

The Welfare Rights Team collects your personal information for the purpose of providing advice and support to help you get the most from your benefits. The information we collect from you will vary depending on the nature of the service. We will only collect personal information that is relevant to the issue you have raised with us. Our processing activity may include:

  • giving benefit advice
  • representing you if you make a benefits appeal or if your benefit claim is turned down
  • working with organisations that can offer legal help
  • using general or anonymised information to train other organisations to give benefit advice
  • publishing general information about claiming benefits

We may use your information where relevant to:

  • identify your needs and consider the support you require 
  • review and challenge the advice you have received from other agencies 
  • safeguard you against abuse 
  • maximise your household income
  • signpost you to other services who can provide specialist advice and support  
  • present information and evidence in support of you in relation to Social Security legislation, employment legislation, debt advice and housing rights
  • identify issues that have may have a large scale impact on a wider group of people and report those issues via research and reports without disclosing your own personal identity

We will use your information to help us confirm your identity when you contact our services. We may also check your data with other sources to ensure the information you have provided is accurate. Sometimes we will receive information about you from other organisations, including the Department for Work and Pensions, HM Revenues and Customs, landlords or professionals who are supporting you. 

It is important you keep your information up-to-date. If you do not provide the information requested it may not be possible to provide you with effective advice or support and you may have difficulty accessing welfare benefits and challenging decisions.

The legal basis for collecting your data

We have a legal basis for processing your information because we are performing a task carried out in the public interest or official authority.

In circumstances where we collect special category data, such as about health needs or ethnic origin, to provide advice and advocacy we have a legal basis of substantial public interest to process this information for these purposes.

The data we may collect

The type of personal data we may collect from you is as follows:

  • Information about you, such as your name, address, date of birth, telephone number, email address, National Insurance numbers
  • Details about your household income, earnings, self-employment, allowances, benefits, tax credits, pensions, student finance, savings and investments, property ownership, child care costs, including those of your partner 
  • Information about your landlord, your rent and any services it includes
  • Property details, such as the number and type of rooms in your home 
  • Details about other people in your household and their relationship to you 
  • Details about your debts and creditors
  • Other relevant information needed to provide you with effective support, such as your employment history or evidence of education or training

We may also collect special category (sensitive data) personal data that may include:

  • Information about physical or mental health issues, disabilities and care and support needs that may affect your entitlement to benefits or discretionary assistance  
  • Details of your ethnic origin, immigration status or EEA Worker status to help us decide if you have a right to access public funds or are eligible to access social security benefits 

Who we’ll share your data with

We share information with a range of organisations depending on the service being provided and the statutory requirements we have to comply with. When you authorise us to act on your behalf, we require people to share information with us to further your case.  We will only ask for information that is required to support the case. We will only share information where it is necessary and appropriate to do so and ensure it is used safely and securely. We require anyone we share information with, or who uses it on your behalf, to do so too. All our staff receive training on data protection and information security.

Your personal data may be shared with:

  • other council departments
  • other central government organisations and statutory bodies, such as the Department for Work and Pensions, HM Revenue and Customs, HM Courts and Tribunals Service, the Valuation Tribunal Service, HM Land Registry, the Cabinet Office and HM Prison service
  • ombudsman and regulatory authorities
  • third parties commissioned by the council or customers to process data or provide goods and services, including contractors, enforcement agents and IT software providers, removal companies
  • debt collection and tracing agencies
  • the Insolvency Service and Insolvency Practitioners
  • credit reference agencies
  • law enforcement and fraud prevention agencies, such as Sussex Police and prosecuting authorities
  • Housing Associations, registered providers, landlords and their agents
  • health, social care and welfare organisations
  • voluntary, charitable and community organisations who assist people in need
  • internal and external auditors
  • the council operates shared services with Surrey County Council and East Sussex County Council. We may share your information with one of these partners if necessary to provide these services

If you have given us your written permission your information may be shared with:

  • a named friend or family member; a support worker or other individual authorised by you to act on your behalf, such as a charity or voluntary sector representative

There are other specific situations where we may be required to disclose information about you, such as:

  • where we are required to provide the information by law
  • where disclosing the information is required to prevent or detect a crime, including fraud
  • where disclosure is in the vital interests of the person concerned

How long we’ll keep data for and why

The retention of your personal information is in line with the Storage Limitation principle in the General Data Protection Regulation. How long we keep it will vary according to the services you are involved with and the legal basis for processing within those services.

However the principles we will use to determine how long your data will be kept include:

  • what type of services you received and whether you are still receiving them
  • whether we are still under a legal obligation either to you or under UK law
  • any standards and guidance set out by the various regulators for our functions
  • whether you have expressed a preference about your data being retained, such as through exercising a right to restrict processing

How your data will be stored

  • Our customer database is hosted remotely in a secure cloud environment owned and maintained by our approved data processor. All data centres are located within the UK
  • Your information will be stored on paper and electronically. We will only make your information available to those who have a right to see it. Some examples of the security measures we use include:
    • Training for our staff how to process information securely and how and when to report incidents when something goes wrong
    • We use encryption so information is hidden and cannot be read without specialist knowledge, such as a password. This is done with a secret code and the hidden information is then said to be ‘encrypted’.
    • Pseudonymisation, meaning we will use a different name so we can hide parts of your personal information from view. This means someone outside of the council could work on your information for us without knowing your personal details.
  • We control access to systems and networks to stop people who are not allowed to view your personal information from gaining access to it.
  • We regularly test our technology and ways of working, including keeping up to date with the latest security updates (commonly called patches).

Transferring data outside the European Economic Area

We do not transfer any of your personal information outside of the UK.

Your rights 

Depending on the legal basis for processing your information you may have the following rights:

  • A right to a copy of data held about you, an explanation for its processing and who it has been shared with – this right applies to data processed under any lawful basis
  • A right to rectification (correction) of data which is demonstrably wrong – this right applies to data processed under any legal basis
  • A right to restrict processing – this right applies if it has been shown that there is no legal basis for processing your data but you wish it to be retained 
  • A right to object to processing – this right does not apply where the council is under a legal duty to process your data but can be used where you dispute that there is a legal basis to process your data until the council can demonstrate what basis exists
  • A right to erasure – this applies where there is no longer a legal basis to retain your data
  • A right to portability of your data (having it moved to another organisation) – this right applies only where the legal basis was either consent or the performance of a contract but data will usually be transferred to another local authority if a child in care moves to a new location.
  • A right to object to automated decision making – this right is applicable under all lawful bases for processing

How to get advice or make a complaint

Data protection contacts

If you wish to discuss any of your data protection rights, you can contact the Data Protection Team on 01273 29 59 59 or by email at data.protection@brighton-hove.gov.uk.

The council has also appointed a Data Protection Officer. Contact the Data Protection Officer.

Whilst we would prefer that you contact us first with any concerns that you might have, you can also contact the Information Commissioner’s Office. The ICO is the national regulator with responsibility for ensuring compliance with data protection.

Information Commissioner’s Office

You also have the right to lodge a complaint with a supervisory authority.

Contact details for ICO are stated below:

The ICO can be contacted:

  • on their website
  • by phone: 0303 123 1113
  • by post: Wycliffe House, Water Ln, Wilmslow SK9 5AF

This privacy notice will be subject to review when there is a change.

  • Date: May 2019
  • Date for review: May 2020