Who controls your data
A controller makes decisions about what to do with people's information. A processor follows their instructions.
We are the data controller when we use your personal information to fulfil our public tasks. County councils have authority over social services, so our tasks include assessing your care needs and creating a plan of action. When we get help with this from anyone else, they are a data processor.
Your district or borough council is a data controller, too. There are 8 of these in our county. They are the data controller when they use your personal information to fulfil their public tasks. They have authority over housing, so their tasks include assessing your housing needs and making decisions about use of funding such as the DFG. When we help them, we are a data processor.
Whether acting as controller or processor, what matters most is that we work together. We collaborate with district and borough councils on a key document called the Derbyshire Adaptation Partnership Request (DAPR) form. The DAPR form relates to recommendations for DFG funding.
Legal basis of processing
We will use one of 3 bases when processing your data:
- public task
- legal obligation
- contract
The next section explains how we use each basis.
Information we collect and why
Public task
We collect information relating to your social care needs, including:
- name, address, email, telephone
- national insurance number and date of birth
- details of the people who live with you
- evidence of your income, savings, investments and benefit
- more sensitive information such as your medical history and NHS number, your religious, racial or ethnic background
- anything we need to know to keep people safe, including responsibility for children or background information received from the police or courts
Our public tasks as social services authority come from legislation such as the Care Standards Act 2000, the Care Act 2014 and the Children Act 1989. For instance, if we arrange supply of equipment to help you with living at home, we process your personal information under these public tasks. To find out more about what information we process and why, see the adult social care and health privacy notice and the children's services privacy notice.
Your district or borough's public tasks are set out in the Housing Grants, Construction and Regeneration Act 1996. This act lists works which may be funded this way and requires the housing authority to consult with us about suitability of works. The DFG is awarded when they are satisfied the relevant works are necessary, appropriate, reasonable and practicable. For more information, contact us.
Legal obligation
Sometimes we process personal information because of a legal obligation. For instance, we keep records of our data processing compliance because the UK's General Data Protection Regulation (UK-GDPR) says we must. If the law requires, we may have to share your information with other organisations, such as HM Courts and Tribunals Service or HM Revenues and Customs.
Contract
If we agree to arrange adaptations to your home, we process your personal information using an Agency Service Agreement. This creates a contract between us as data controller and you as data subject. Someone else can act on your behalf if you do not have legal capacity. You do not have to use our services in the construction phase. The choice is yours.
How long we keep your information
Information we process as part of a public task or a legal obligation
If you are an adult, we generally keep your personal information for 6 years from last contact with you. For more information, see the adult social care and health retention schedule.
If you are a child, we generally keep your information a lot longer - which can be anything from 6 years after the last contact with you to 100 years after the last contact with you depending on the type of support you have received from us. For more information, see the children's services retention schedule.
Information we process under contract
If you are a supplier, we delete your information 6 years after the contract ends. See the finance retention schedule.
If you are our employee, we delete your personal information according to the human resources retention schedule.
Sharing your information
Like all the districts, boroughs and several voluntary organisations, members adhere to an information sharing protocol, which helps data controllers and data processors work together. We only share your information if we really need to. Please let us know if there is any personal information you would prefer us not to share.
The referral stage
Information may come to us from you, a family member, a carer, or from a relevant agency or professional such as your doctor. If the referral is submitted through an online form or our contact centre, we capture the information we need and destroy anything else.
Assessment and planning
Our occupational therapists or community care workers visit you to get information and create a plan. We consult you to ensure the plan is suitable. We share information as needed, such as:
- telling your district or borough council of our recommendations, so they can help
- informing you of how to give your district or borough council details of your finances so they can see if you are eligible for the DFG. They are controller of this data as the housing authority but have a duty to consult us under the Housing Grants, Construction and Regeneration Act 1996. Under the Regulatory Reform Order 2002, they may refer hardship cases back to us for discretionary assistance (another of our public tasks)
- introducing you to charities who can help with funding or advice
- getting in touch with schools, care agencies and the NHS, for continuity of care
- introducing you to our disability design team. They get to know you and your home and involve third parties such as architects, surveyors, structural engineers and tradespeople
- if you rent: talking to your landlord about what you need and gaining their permission
- if you own your own home: finding out about the property through the Land Registry
- contacting the planning authority to discuss and resolve planning consent matters and contacting relevant bodies to discuss and agree building control issues
Procurement and construction
You might need planning permission. If so, the local planning authority will be your district or borough council, or the Peak District National Park Authority (PDNPA) if your home is in the Peak District National Park. The planning application is made on the Planning Portal (a joint venture between central government and TerraQuest Solutions Ltd). From there, it is transferred to your local planning authority, which publishes it on its own planning website, with existing and proposed plans. The application includes your address but not details of your home security or medical history. It may reveal information by inference: for example, a proposed ramp suggests someone at the house has mobility issues. The application remains available through the Planning Portal until 6 months after closure. Your local planning authority may continue to display the application on its website for longer than this.
There is a similar process for building regulations approval and publication of information regarding address and nature of building work is needed. Building regulations assessment and approval is handled by Derbyshire Building Control Partnership (DBCP), which will receive details of the proposed adaptations to your home.
If the cost is more than £50,000, there must be a transparent procurement process to ensure fairness for companies competing for work. If we arrange works for you, we publish a specification online through EastMidsTenders (provided by Proactis Group Ltd). The purpose is to find the best contractors for the job and to get an accurate tender price. This means the specification has to include your home address - but it is only visible to people who have created an account and registered their interest. We practise data minimisation by leaving out other personal information.
If the works cost less than £50,000, we don't publish the specification but share it with approved contractors. We look for quality not just the lowest price. This includes finding companies that handle your personal information responsibly. If you need equipment rather than construction, our occupational therapists may procure it through the Integrated Community Equipment Service (ICES). We share this online platform with the Derby and Derbyshire Integrated Care Board, and consider the suitability of non-routine purchases at panel meetings with ICES team members.
As work is carried out or equipment is procured, we pass on as much of your information as the suppliers need to get the job done. When choosing suppliers, we only use data processors who agree to follow our instructions as data controller. For more information, contact us.
Keeping your information safe
As a data controller, security matters to us a lot. Find out how we keep your information secure.
We instruct data processors to keep your information secure and dispose of it when no longer needed. We tell them not to use it for anything other than the agreed plan. For instance, they can't use it for marketing calls or sell it to a third party.
Your rights and who to contact about them
You can find out more about your rights as a data subject but here are the main things you need to know:
- if you want a copy of your own information, please ask us
- if you want to complain about how we handle your personal data you can contact the data protection officer:
- you have the right to contact the Information Commissioner
Find out other ways to contact us.