When processing your personal data, the council is required under Articles 13 and 14 of the General Data Protection Regulation (GDPR) to provide you with the information contained in this Privacy Notice.

This notice explains what the council will collect, who it will be shared with, why we need it and how we will use it. The council will continually review and update this privacy notice to reflect service changes, feedback from customers and changes in the law.

Name: Cumbria County Council

Address: Cumbria House, 117 Botchergate, Carlisle, Cumbria CA1 1RD  

Registration Number: Z5623112

Search the Information Commissioner's Register of Fee Payers.

You can view the council's Data Protection Registration Certificate (PDF 261KB)


Data Protection Officer

The Council's Data Protection Officer is Claire Owen.  You can contact the Data Protection Officer by:

GDPR Article 4 defines personal data as: any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

GDPR Article 9 defines special category personal data as: racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

In general, the council collects the following types of personal data (dependent on the nature of the service(s) you are applying for or receiving):

  • Contact Telephone Numbers (Mobile/Landline)
  • Date of Birth 
  • Email Addresses
  • Identifiers 
  • Name
  • Postal Address
  • Visual Images, Personal Appearance and Behaviour 

We may also collect special category personal data that may include:

  • Criminal Proceedings, Outcomes and Sentences
  • Education
  • Employment
  • Finance 
  • Offences (including alleged offences)
  • Physical or Mental Health
  • Political Affiliation/Opinions
  • Racial or Ethnic Origin
  • Religious or Other Beliefs
  • Sexuality
  • Trade Union Membership

Visit the 'Service Specific Privacy Notices' for further details of personal or special category personal data collected by individual services.

In general, the council will collect personal or special category personal data from you in the following ways:  

  • on a paper or online form
  • by telephone
  • by email
  • recorded by CCTV cameras, or
  • in person by a member of our staff or one of our partners


The council collects personal or special category personal data to enable it to:

  • support internal financial and corporate functions by maintaining accounts and records
  • support and manage employees
  • promote services and market local tourism
  • conduct public/health awareness campaigns
  • manage property
  • provide leisure and cultural services
  • provide education services
  • carry out surveys and consultations
  • administer the assessment and collection of taxes and other revenue i.e. benefits, grants
  • carry out licensing and regulatory activities
  • provide social services to adults and children
  • assist with crime prevention and prosecution of offenders i.e. CCTV
  • undertake research
  • provide all commercial services i.e. administration and enforcement of parking regulations and restrictions
  • provide non-commercial activities i.e. refuse collections from residential properties
  • manage archived records for historical research
  • match data under local and national fraud initiatives
  • support public health services 

To provide services the council may need to collect personal or special category personal data from or about the following:

  • businesses, customers and suppliers
  • carers or representatives
  • claimants
  • complainants, enquirers or their representatives
  • healthcare users 
  • landlords
  • licence and permit holders
  • offenders and suspected offenders
  • patients
  • people captured by CCTV images
  • professional advisers and consultants
  • recipients of benefits
  • representatives of other organisations
  • staff, persons contracted to provide a service
  • students and pupils
  • traders and others subject to inspection
  • witnesses

Where there is a lawful reason to do so the council may share personal or special category personal data with: 

  • business associates and other professional advisers
  • courts, prisons and tribunals
  • credit reference agencies
  • current, past and prospective employers
  • customers
  • customs and excise
  • data processors
  • debt collection and tracing agencies
  • educators and examining bodies
  • employees and agents of the data controller
  • family, associates or representatives of the person whose personal data we are processing
  • financial organisations
  • fire authorities
  • healthcare, social and welfare organisations and professionals
  • housing associations and landlords
  • international law enforcement agencies and bodies
  • law enforcement and prosecuting authorities
  • legal representatives
  • licensing authorities
  • local and central government departments
  • Local Government Ombudsman/Information Commissioner
  • partner agencies, approved organisations and individuals working with the police
  • persons making an enquiry or complaint
  • police complaints authority
  • police forces
  • political organisations
  • press and the media
  • private investigators
  • professional advisers and consultants
  • professional bodies
  • providers of goods and services
  • regulatory bodies
  • religious organisations
  • security companies
  • service providers
  • students and pupils including their relatives, guardians, carers or representatives
  • survey and research organisations
  • the disclosure and barring service
  • trade unions
  • voluntary and charitable organisations

The council is required by Articles 6 and 9 of the General Data Protection Regulation (GDPR) to have a relevant legal basis for processing your personal or special category personal data.  In general, the council collects and uses your data where:

  • you, or your legal representative, have given consent
  • you have entered into a contract with us
  • it is necessary to perform our legal or statutory duties
  • it is necessary to protect someone in an emergency
  • it is required by law
  • it is necessary for employment purposes
  • it is necessary to deliver health or social care services
  • you have made your information publicly available
  • it is necessary for legal cases
  • it is to the benefit of society as a whole
  • it is necessary to protect public health
  • it is necessary for archiving, research, or statistical purposes

If we have consent to use your personal information, you have the right to remove it at any time.  For further information visit Your Rights (below).


We will take appropriate steps to make sure we hold records about you (on paper and electronically) in a secure way, and we will only make them available to those who have a right to see them.  Our security includes: encryption, access controls on systems and security training for all staff.   You can find further information in the following documents:

If you access information online, the council website does not store or capture personal information, but merely logs a number called your IP address which is automatically recognised by the system. The system will record personal information if you:

  • subscribe to or apply for services that require personal information
  • report a fault and give your contact details for us to respond
  • contact us and leave your details for us to respond

For further information visit our Cookies web page.

We have installed CCTV systems in some of our premises used by members of the public, for the purposes of public and staff safety and the prevention and detection of crime. CCTV is also installed on the outside of some of our buildings for the purposes of monitoring building security and crime prevention and detection.

Images captured by CCTV will not be kept for longer than necessary. However, on occasions there may be a need to keep images for longer, for example where a crime is being investigated.

Civil Enforcement Officers (CEOs) who undertake the enforcement of parking restrictions, are each equipped with a Body Worn Video Device (BWVD)  which has both video and audio recording capability.

During their work the CEOs are vulnerable to verbal and physical abuse. The BWVDs can act as a deterrent to abusive and aggressive behaviour and prevent a situation escalating and the recording can also be used as evidence in cases where a CEO has been assaulted or abused. It can also be used to investigate complaints about a CEO.

The council's Body Worn Video Device and Hand Held Unit Policy (PDF 289KB) details the operational procedures for using the devices, data storage and requests for access to footage.

Individuals can request a copy of the footage under the Data Protection Act using the council's online form.

We will only disclose images and audio to other authorised bodies who intend to use it for the purposes stated above.  Images and audio will not be released to the media for entertainment purposes or placed on the internet for public viewing.

We operate CCTV and disclose in accordance with the codes of practice issued by the Information Commissioner and the Home Office.

The Council participates in the Cabinet Office's National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise.

For further information on how your data is processed by the council and the Cabinet Office please read the Privacy Notice - National Fraud Initiative (PDF 239KB)

In order for Elected Members to act on your behalf and resolve the issues you have raised they need to collect some personal data.  This could include your name and address, and/or sensitive personal data, which could be concerning your health or ethnic origin.

In some circumstances your explicit consent may be needed to allow for the processing of your data. If this is needed the relevant Elected Member will contact you directly.

Elected Members will:

  • only share data with the organisations necessary to deal with your enquiry i.e. different council departments, and to resolve any issues you have raised
  • not share your data with third parties, unless it is required for law enforcement purposes to prevent or detect crime, to protect public funds or where required or permitted to share data under other legislation
  • keep your data secure using the council's secure IT and email systems
  • retain/destroy your data in accordance with the council's Retention and Disposal Schedule

You have the right to access your data and to rectify mistakes, erase, restrict, object or move your data in certain circumstances.

You can withdraw your consent for your data to be processed as described above at any time.  If you would like this to happen or you have a complaint about how your data is handled please contact your Elected Member.

If you are not satisfied with the response or believe the Elected Member is not processing your personal data in accordance with the law you can complain to the Information Commissioner's Office (ICO).

It may sometimes be necessary to transfer personal or special category data beyond the UK to comply with legal or other obligations.  Where data is required to be transferred to the European Union or other adequate countries the council will ensure that all relevant safeguards are in place before this takes place and that all aspects of the General Data Protection Regulation (GDPR)/Data Protection Act 2018 are complied with.

The data, collected from or supplied by you, will be kept on a secure system and can only be accessed by authorised employees.   

Cumbria County Council will only store your information for as long as is legally required in accordance with the council's Retention and Disposal Schedule (EXCEL 267KB) or in situations where there is no legal retention period established best practice will be followed.  To help you understand the Schedule the council has published a Retention Schedule - Quick User Guide (PDF 787KB). If you have any questions about the Schedule or the Quick User Guide please contact: record.centre@cumbria.gov.uk.

If you experience any problems in relation to your personal data or you see something that doesn't look right, get in touch to report it as a Data Breach.

Emails

If you email us, we may keep a record of your contact and your email address and the email for our record keeping of the transaction.  We suggest that you keep the amount of confidential information you send to us via email to a minimum and use our secure online forms and services.  You can sign up for email alerts for selected services using an external service from GovDelivery, with control over your preferences.

Telephone calls

The council will inform you if your telephone calls are being recorded or monitored and will not record any financial card details if you make payments by telephone.

The General Data Protection Regulation (GDPR) provides you with the right to access information the council, as a public authority holds about you. Upon receipt of a valid request the council will:

  • provide you with a response within one month
  • let you know if your request is subject to an extension
  • make reasonable efforts to comply with the format of your request
  • inform you if your request is going to be refused or a charge is payable.

You can make a Data Subject Access Request by contacting:

Email:information.governance@cumbria.gov.uk 

Post: Cumbria County Council, Information Governance Team, Parkhouse, Baron Way, Carlisle CA6 4SJ

Telephone: (01228) 221234

Online:Online contact form

In addition to your right of access the General Data Protection Regulation (GDPR) also gives you the following rights:

  • the right to be informed via the council's Privacy Notice
  • the right to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point
  • the right of rectification, we must correct inaccurate or incomplete data within one month
  • the right to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information
  • the right to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future
  • the right to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked
  • the right to object. You can object to your personal data being used for profiling, direct marketing or research purposes
  • you have rights in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

Where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent, we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on - in which case, we will let you know. Your withdrawal of your consent won't impact any of our processing up to that point.

Where our processing of your personal data is necessary for our legitimate interests, you can object to this processing at any time. If you do this, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim. 

Unless otherwise stated above you can exercise any of these rights by contacting:

Email:dataprotection@cumbria.gov.uk 

Post: Cumbria County Council, Legal and Democratic Services, 1st Floor, Cumbria House, 117 Botchergate, Carlisle, Cumbria CA1 1RD

Online: Online contact form

When exercising the rights mentioned above please be aware that under GDPR Article 12(6) additional information can be requested to verify that you are the data subject if your identity is unconfirmed. Please note that:

  • additional documentation is only required when the council cannot verify your identity using internal council systems that relate to the service you are requesting information about
  • the council will contact you for this documentation prior to processing your request
  • the statutory deadline for responding to your request will start when you have provided the additional documentation
  • failure to provide additional documentation may lead to the council rejecting your request.

If you have any concerns about the information contained in service specific Privacy Notices please contact the named officer.

If you have concerns about the way the council has processed your data, please contact the council's Data Protection Officer by:

Email: dataprotection@cumbria.gov.uk 

Post: Cumbria County Council, Legal and Democratic Services, 1st Floor, Cumbria House, 117 Botchergate, Carlisle, Cumbria CA1 1RD

Online: Online contact form

If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you can complain to the Information Commissioner's Office (ICO)


Service specific Privacy Notices:

Privacy Notice - Blue Badges (PDF 716KB)

Please refer to our Children and Young People Privacy Notices:

Privacy notice - complaints, concerns and investigations (PDF 234KB)

Privacy Notice - Residential Care Homes - Employee Vaccination Programme (PDF 233KB)

Privacy Notice - Self-Testing for Staff, Service Users and Visitors (PDF 720KB)

Privacy Notice - Cumbria Fire and Rescue Service - COVID-19 Equality Impact Assessments (PDF 219KB)

Privacy Notice - Cumbria Fire and Rescue Service - Planning Improvement and Performance Team (PDF 650KB)

Privacy Notice - Cumbria Library Service (PDF 225KB)

Privacy Notice - Cumbria Registration Service (PDF 895KB)

Privacy Notice - Data Breaches and Cyber Incidents (PDF 257KB)

Privacy Notice - UK Community Renewal Fund (PDF 209KB)

These documents contain links to the Cumbria County Council intranet.  If you do not have access to the intranet and need copies of the documents, please contact:

your Line Manager

the Service Centre - telephone: 01228 223333

People Management - telephone: 01228 221231


Privacy Notice - Community Transport (PDF 254KB)

Privacy Notice - English National Concessionary Travel Scheme (PDF 239KB)

Privacy Notice - Homes for Ukraine Scheme - Guests (PDF 358KB)

Privacy Notice - Homes for Ukraine Scheme - Hosts (PDF 246KB)

Privacy Notice - Performance Intelligence/Public Health (PDF 308KB)

Privacy Notice - Health and Wellbeing Service (PDF 230KB)

Privacy Notice - Planning and Development Control (PDF 609KB)

Privacy Notice - School admissions (PDF 612KB)

Privacy Notice - Trading Standards (PDF 121KB)