This Privacy Notice was last updated December 2022. It is regularly reviewed and may be updated or revised at any time. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes.
- Introduction
- What is personal information and how do we collect it?
- How and why we use your personal information
- Legal Basis for processing
- Information sharing
- Data retention
- How we keep your information safe
- Automated decisions
- Cookies
- Your rights
- Data Transfer beyond European Economic Area ("EEA")
- Contact our Data protection officer.
Wigan Borough Council (“the Council”) respects your privacy and is committed to protecting your personal data.
This Privacy Notice explains:
- How we use your personal information
- Your privacy rights and how the law protects you.
For further information relating to specific departments view Privacy Notices for all Council Services.
Personal information can be anything that identifies and relates to a living person. This can include information that when linked with other information, allows a person to be uniquely identified. For example, this could be your name and contact details.
The law treats some types of personal information as ‘special’ because the information requires more protection due to its sensitivity. This information consists of:
- Racial or ethnic origin
- Sexuality and sexual life
- Religious or philosophical beliefs
- Trade Union membership
- Political opinions
- Genetic and bio-metric data
- Physical or mental health
- Criminal convictions and offences.
We collect personal information in general where:
- You have entered into a contract with us
- You or your legal representative has given consent
- As required by law (e.g., mandated by statute or Court Order)
- It is necessary for employment purposes
- It is necessary to perform statutory functions (including law enforcement)
- It is necessary to deliver for health or social care services
- It is necessary for exercising or defending legal rights
- You have made your information publicly available
- It is necessary for archiving, research or statistical purposes
- Dealing with legal disputes involving you, or other employees, workers and contractors including accidents at work
- Ascertaining your fitness to work
- Providing support in maintaining attendance at work
- Complying with health and safety obligations and public access legislation
- Preventing fraud, including sharing data and matching of personal information for the national fraud initiative
- Conducting data analytics studies to review and better understand employee retention and turnover rates
- For equal opportunities monitoring purposes
- It is provided to us e.g., by schools, for onwards submission to central government.
Please note that this is not an exhaustive list.
Your personal information may be collected and used for one or more of the Council’s services, regulatory functions and/or administrative activities depending on your relationship with the Council and nature of your contact with us.
Generally, we may need to use some information about you:
- In delivering services and support by ensuring other statutory or voluntary agencies with whom the Council is working, are able to deliver ‘joined up’ services to you
- In planning future services
- In collecting taxes, administering grants and welfare benefits
- For managing and checking the quality of our services
- To keep track of spending on services
- If you apply for a job or become employed by us
- For ensuring the health and safety of our staff
- To help investigate any concerns or complaints you have about our services and for answering enquiries under access legislation
- In carrying out our regulatory activities, such as enforcement, planning, safeguarding, licensing etc.
- To improve the general experience of our customers and of visitors to our websites
- For managing any online transactions you may elect to make and/or marketing choices or preferences you may have expressed
- In the event of civil disasters and or emergencies
- For archiving, research, or statistical purposes (including research and evaluation undertaken by the Council or in combination with neighbouring authorities to inform future service planning where the use of fully anonymised information would frustrate the purpose of research)
- To determine eligibility for certain benefits (e.g., free school bus passes).
Please note that this is not an exhaustive list.
Further details on how your information is used by our services can be found on Privacy Notices for all services.
We will only use your personal data when the law allows us to.
There are a number of legal reasons why we need to collect and use your personal information. The privacy statement for each service explains which specific reasons we have used for that service.
Generally, the legal bases we rely on for using your personal information are:
- It is necessary to perform our public tasks
- It is necessary to perform our statutory functions
- It is required by law or we have a legal obligation to collect the information (e.g., where there is required under statute or a Court Order)
- It is necessary to protect someone in an emergency or to protect public health
- You have entered into a contract with us
- It is necessary for the purpose of pursuing a legitimate interest
- You, or your legal representative have given consent and this consent has not been withdrawn
- It is necessary for employment related purposes
- It is necessary in relation to exercising or defending legal rights
- It is necessary to deliver health or social care services
- It is necessary to protect you or others from harm
- You have made your information publicly available
- It is necessary for archiving, research, or statistical purposes
- It is necessary in the substantial public interest for wider societal benefits and is authorised by law
- It is necessary for fraud prevention and the protection of public funds
- Our legitimate interests (or those of a third party), provided your interests and fundamental rights do not override those interests.
Please note that this is not an exhaustive list.
If you have provided us with your consent to use your personal information, you can withdraw your consent at any time by emailing our Data Protection Officer.
We may be obligated in certain circumstances to share your data with third parties, including third-party service providers and other partner agencies. These third parties will also be required to comply with the provisions of the General Data Protection Regulations (GDPR).
Why might you share my personal information with third parties?
We may share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.
Which third-party service providers process my personal information?
"Third parties" includes third-party service providers (including contractors and designated agents) and other partner agencies.
How secure is my information with third-party service providers and other entities?
All our third-party service providers and other entities are required to take appropriate security measures to protect your personal information in the same way that we are. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data in accordance with our instructions.
When might you share my personal information with other entities?
We will share your personal information with other entities as part of our regular reporting activities on Council performance, in the context of a business reorganisation or departmental restructuring exercise, for system maintenance support and hosting of data.
We use your personal information for the purpose it was collected and hold it centrally to ensure we maintain accurate records across the organisation. We also process all personal data for the prevention of fraud.
We will only keep your personal information for as long as the law specifies or where the law does not specify this, for the length of time determined by our business requirements. Your information will be disposed of in a secure way.
Additionally, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
In some circumstances, you can ask us to delete your data. View Your Rights.
Our service specific privacy notices provide further detail on how long we keep your information.
We are committed to making sure your personal information is safe and protected from accidental loss or alteration, inappropriate access, misuse or theft. As well as technical, physical and organisational measures, we make sure our staff are well-trained, informed and security-aware to minimise privacy risks from human error and threats from unauthorised access to your data.
In addition, we limit access to your personal information to employees, agents, contractors and other third parties who have a business need to know.
Automated decision-making
Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision-making in the following circumstances:
- Where we have notified you of the decision and given you 21 days to request a reconsideration
- Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights
- In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.
If we use automated decision making, our service specific privacy notices will explain this.
To find out how we use cookies view our Cookie Notice.
- Access – you may request a copy of the personal information we hold about you
- Rectification and erasure – you may request that we rectify or delete any of your personal information if you consider it is incomplete, factually incorrect, processed unlawfully or, is unnecessary or no longer needed
- Object – you may object, at any time, to your personal information being processed
- Restrict processing – you may request restriction of processing of your personal information for certain reasons, for example:
- If you have objected to the processing or asked us for erasure and we need time to consider your request and let you know our decision
- You require us to retain your information for the establishment, exercise or defence of your own legal rights.
- Data portability - You may request to receive personal information that you have provided to us in a structured, machine-readable form and to have us transmit the personal information to another organisation where technically feasible
- Automated decision-making (including profiling) – where we use only an automated system which does not involve a human being, you have the right to request that a decision which legally affects you is reviewed by an appropriate officer
- Right to withdraw consent - Where the legal reason for processing your personal information is based on your consent, you have the right to withdraw your consent at any time. This will not affect the lawfulness of our processing prior to the withdrawal of your consent.
For more information about how these rights apply in particular circumstances, please visit the ICO website (external link).
To exercise your rights as outlined above, please write to our DPO.
You will not have to pay a fee to access your personal data (or access any of the other rights as outlined above). However, we may charge a reasonable fee for the administrative costs of complying with your request if, for example, it is clearly unfounded, excessive or repetitive. Alternatively, we may refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We will try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have a number of requests. In this case, we will keep you updated.
We'll only send your data outside the EEA:
- With your consent
- To comply with a lawful and legitimate request
- If we use service providers or contractors in non-EEA countries.
If we do transfer your information beyond the EEA, we'll make sure that it's protected in the same way as if it was being used in the EEA.
If we propose to make a transfer in response to a lawful and legitimate request we will normally tell you in advance unless there are compelling reasons, such as law enforcement or, reasons of safety which justify not doing so.
If you wish to raise a concern or seek clarification about any aspect of this notice please email our Data Protection Officer. Please provide documents to prove your identity along with a description of your concern.
We will respond to all requests within one month.
If you are unhappy with the way that we handle your concern you may complain to the Information Commissioners Office (ICO) (external link) at: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
You do not have to raise a complaint with us first but we would encourage you to contact our DPO so we can consider your concerns as quickly as possible.