Privacy Notice for CSW Group – SENDIASS Service
Under data protection law, individuals have a right to be informed about how CSW Group uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.
This privacy notice explains how we collect, store and use personal data about individuals who are using the SENDIASS service commissioned by Cornwall County Council, but provided by CSW.
Our Data Protection Officer is provided by i-West (see ‘Contact us’ below).
The personal data we hold
We process data relating to young people and their parents or carers who receive services from the SENDIASS service. Personal data that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to:
- Name of Young Person
- Name of parent/carer
- Telephone Number
- Mobile Number
- Email Address
We may also collect, store and use information about you that falls into “special categories” of more sensitive personal data which may include, but is not restricted to:
- Data concerning health/learning difficulties and disabilities.
Please refer to our Special Categories of Personal Data Policy for further information as to how we process this.
Why we use this data
Some of the purposes for which we process your personal data include (this is not an exclusive list):
- Enabling us to provide a service to the young people who sign up for it and to deliver services and support
- Managing those services, we provide to you
- Training and managing the employment of our workers who deliver those services
- Investigating any worries or complaints you have about our services
- Keeping track of how our services are being used
- Checking the quality of services (internally and by external organisations)
- Helping with research and planning of new services.
Our lawful basis for using this data
We only collect and use personal information about you when the law allows us to or where you have given us consent to use it in a certain way or we use it where we need to:
- Comply with a legal obligation
- Carry out a task in the public interest
- We need to protect your vital interests (or someone else’s interests)
Where we process more sensitive data (known as special category personal data) on you we need an additional separate condition for processing. The bases we mainly use are:
- With your explicit consent
- Employment, social security and social protection (if authorised by law)
- If you have made the information public (for example on social media)
- In connection with legal claims or judicial acts
- Reasons of substantial public interest (with a basis in law)
- Health or social care (with a basis in law)
- Public health (with a basis in law)
- Archiving, research and statistics (with a basis in law)
- To maintain your vital interests where consent is physically or legally incapable of being given (e.g. where you are unconscious and in need of medical assistance), and where your health data is then shared).
If consent is the only legal basis, we have to use your personal information, you have the right to withdraw consent it at any time by contacting firstname.lastname@example.org.
Some of the reasons listed above for collecting and using personal information about you overlap, and there may be several grounds which justify CSW’s use of your data.
Collecting this information
In order to be able to provide a service and carry out our functions, we ask for personal information.
How we store this data
The data which you provide us with is stored securely on our case management system. Access to the system is only granted to those who need it and who are working with this service.
Personal data that we collect is stored in line with our data retention policy, which is available upon request.
When it is no longer required, we will delete or securely dispose of your information.
Who do we share your information with?
We may use a range of organisations to either store personal information or help deliver our services to you. Where we have these arrangements, we take measures to satisfy ourselves that the organisations are reputable, trustworthy and comply with data protection law.
If we are going to share data, it is usually with your consent. However, there are some circumstances where we may share information without your consent, for example:
- If a court orders that we provide the information or other legal reason to do so for example, in order to prevent crime and fraud or
- To protect someone’s vital interests (life or death) or
- To comply with a public task (duty), for example:
- If we feel that we are under a public duty to share the information, for example, if there are serious risks to yourself, members of the public, our staff, other professionals or to protect a child or vulnerable adult. If we are worried about your physical safety or feel we need to take action to protect you or others from being harmed in other ways, we will aim to discuss this with you and, if possible, get your permission to tell others about your situation before doing so.
- If you do not give consent, we may still share your information if we believe the risk to others is serious enough to do so. There may also be rare occasions when the risk to others is so great that we need to share information straight away. If this is the case, we’ll make sure that we record what information we share and our reasons for doing so. We’ll let you know what we’ve done and why, if we think it is safe to do.
- We do not transfer data outside of the UK, or the European Economic Area.
How to access the personal information we hold about you
Individuals have a right to make a ‘subject access request’ to gain access to personal information that the CSW Group holds about them.
If you make a subject access request, and if we hold information about you, we will:
- Give you a description of it
- Tell you why we are holding and processing it, and how long we will keep it for
- Explain where we got it from, if not from you
- Tell you who it has been, or will be, shared with
- Let you know whether any automated decision-making is being applied to the data, and any consequences of this
- Give you a copy of the information in an intelligible form
You may also have a right for the personal information which you have provided to us, to be transmitted electronically to another organisation in certain limited circumstances. If you would like to make a request, please contact our Data Protection Lead (DataProtection@cswgroup.co.uk).
Young people have the same rights as adults over their personal data and CSW will assess each request on its own merits. Young people can find out what personal information we hold about them and how we use it by making a subject access request as long as we judge that they can properly understand their rights and what this means.
Those with parental responsibility can make a request with respect to their child’s data where the young person is not considered mature enough to understand their rights over their own data. (A benchmark may be under the age of 12 however this will be judged on a case by case basis). If a young person is able to give valid consent, we will provide the information to them or their parents if it is considered to be in their best interests. Parents also have the right to make a subject access request with respect to the personal data CSW holds about themselves. If you would like to make a request please contact DataProtection@cswgroup.co.uk.
Your other rights regarding your data
Under data protection law, individuals have certain rights regarding how their personal data is used and kept safe. You have the right to:
- Object to the use of your personal data if we are processing it on the basis of public interest; the exercise of official authority, or legitimate interests, in which case we will consider your objections particularly those around damage or distress, and balance them against the interests of CSW Group to continue to process the data
- Object to your data being used to send you direct marketing
- Object to the use of your personal data for decisions being taken by automated means (by a computer or machine, rather than a person)
- Request that inaccurate data is amended
- In certain circumstances, have personal data deleted or destroyed, or the processing of the data restricted
- You have the right to ask us to stop using your personal information. However, if this request is approved (as there may be another basis upon which we are processing the information) this may cause delays or prevent us from being able to provide our service to you
- Where possible we’ll seek to comply with your request, but we may need to hold or use your personal information because we are required to by law
- You may also have the right for the personal information which you provided to be transmitted electronically to another organisation in certain limited circumstances. To exercise any of these rights, please contact DataProtection@cswgroup.co.uk
We take any complaints about our collection and use of personal information seriously.
If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please consider raising this with us in the first instance.
To make a complaint, contact our Data Protection Lead DataProtection@cswgroup.co.uk, If it cannot be resolved, our Data Protection Officer who is i- West (part of One West) and can be contacted at email@example.com.
Alternatively, you can make a complaint to the Information Commissioner’s Office:
- Report online at https://ico.org.uk/concerns/ or
- Call 0303 123 1113 or
- Write to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact DataProtection@cswgroup.co.uk