The aim of this policy document is to set out how, within the provisions of applicable Data Protection legislation (specifically the Data Protection Act 2018 and the UK General Data Protection Regulations), Colchester City Council will seek to protect special category and criminal convictions personal data.
This policy should be read in conjunction with Colchester City Council’s Data Protection Policy and Retention Policy.
This document is to meet the requirements of paragraph 1 of Schedule 1 of the Data Protection Act 2018. The Data protection Act 2018 states that an appropriate policy document be in place where:
- the processing of special category or criminal convictions personal data is necessary to carry out functions which are imposed or conferred by law on the council
- the subject of the data in connection with employment, social security or social protection matters.
- It also meets the requirement of paragraph 5 Schedule 1 of the Data Protection Act 2018 that an appropriate policy document be in place where the processing of special category personal data is necessary for reasons of substantial public interest.
Definition special category data
The legislation makes a distinction between 'personal data' and 'special category data'. Special category data is defined in Article 9 of the UK General Data Protection Regulation as personal data revealing:
- Racial or ethnic origin
- Political opinion
- Religious or other beliefs
- Trade union membership
- Physical or mental health or condition
- Sexual life or sexual orientation
- Criminal proceedings or convictions
- Philosophical
- Genetic data
- Biometric data.
Definition of criminal convictions data
Article 10 of the UK General Data Protection Regulation defines criminal convictions data as personal data relating to an individual’s criminal convictions and offences or related security measures.
Section 11 of the Data Protection Act 2018 states that criminal convictions data includes personal data relating to:
- The alleged commission of offences by the data subject.
- Proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.
Examples of criminal convictions data also includes information linked to security measures and restrictions, such as bail conditions, cautions, and restraining orders, and less obvious types of information, such as personal data relating to witnesses, victims of crime, and details of allegations (proven and unproven). It may also include information about civil measures which may lead to a criminal conviction if not adhered to.
Conditions for processing special category and criminal convictions data
Examples of areas of Colchester City Council that exercise law enforcement functions are:
- wardens
- fraud investigations
- environmental services
- food safety
- health and safety
- licensing
- planning and private sector housing.
Article 9 lists the conditions for processing special category data:
- The data subject has given explicit consent.
- The processing is necessary in the context of employment law, or laws relating to social security and social protection.
- The processing is necessary to protect vital interests of the data subject or of another natural person.
- The processing is carried out, in the course of the legitimate activities of a charity or not-for-profit body, with respect to its own members, former members, or persons with whom it has regular contact in connection with its purposes.
- The processing relates to personal data which have been manifestly made public by the data subject.
- The processing is necessary for the establishment, exercise, or defence of legal claims, or for courts acting in their judicial capacity.
- The processing is necessary for reasons of substantial public interest.
- The processing is required for the purpose of medical treatment undertaken by health professionals, including assessing the working capacity of employees and the management of health or social care systems and services.
- The processing is necessary for reasons of public interest in the area of public health.
- The processing is necessary for archiving purposes in the public interest, for historical, scientific, research or statistical purposes, subject to appropriate safeguards.
In addition, Schedule 1 of the Data Protection Act 2018 establishes conditions that permit the processing of the special categories of personal data and criminal convictions data. The Schedule is split into four parts:
- Part 1 – Conditions relating to employment, health and research.
- Part 2 – Substantial public interest conditions.
- Part 3 – Additional conditions relating to criminal convictions.
- Part 4 – Appropriate policy document and additional safeguards.
Data protection principles
Article 5 of the UK General Data Protection Regulations describes the data protection principles. Below sets out details of how Colchester City Council will comply with these in relation to the processing of special category and criminal offence personal data:
- Special category and/or criminal convictions data is only processed where a lawful basis applies, and where processing is otherwise lawful.
- Special category and/or criminal convictions data is processed fairly.
- Data subjects receive full privacy information so that any processing of special category and/or criminal convictions data is transparent.
- The council will only collect and process special category and/or criminalor criminal convictions data for specified, explicit and legitimate purposes.
- The council will not use special category and/or criminal convictions data for purposes that are incompatible with the purposes for which it was collected.
- The council will only collect the minimum special category and/or criminal convictions data that is required for the purpose for which it is collected.
- The council will ensure that the data we collect and process is adequate and relevant.
- Special category and/or criminal convictions data will be accurate and kept up to date where necessary.
- The council will only keep special category and/or criminal convictions data in identifiable form as long as is necessary for the purposes for which it is collected, or where we have a legal obligation to do so.
- The council will ensure there are appropriate organisational and technical measures in place to protect special category and criminal convictions data.
Accountability principle
Colchester City Council are responsible for demonstrating compliance with these principles. The Council's Data Protection Officer holds responsibility for:
- ensuring that records are kept of all personal data processing activities, and that these are provided to the Information Commissioner on request
- carrying out Data Protection Impact Assessment (DPIA’s) for any high-risk personal data processing
- providing independent advice and monitoring of services personal data handling
- having in place internal processes to ensure that personal data is only collected, used, or handled in a way that is compliant with Data Protection Legislation
- keeping records of personal data breaches
- ensuring any reuse of criminal convictions data is enacted in accordance with the requirements of the Law Enforcement Directive.
Retention and erasure
Colchester City Council will ensure, where special category personal data or criminal convictions personal data are held or processed, that:
- There is a record of that processing and that records will set out, where possible, the envisaged time limits for erasure.
- Data subjects receive full privacy information about how their data will be handled.
- Where we no longer require special category or criminal convictions data for the purpose for which it was collected, the Council will delete it or render it permanently anonymous.
- They retain personal information for as long as necessary to fulfil the purposes it was collected for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
Details of the retention periods for personal data can be found in the Council's Retention Policy.
Data subject rights
The Council recognise the legal rights of those whose personal data it is processing and will ensure that appropriate information is provided to them advising them of their rights, and that policies and procedures are maintained to ensure that the organisation is able to recognise information rights requests and handle them appropriately when they are exercised. These rights include:
- Right to information about data processing operations
- Right of access to personal data
- Right of rectification of personal data
- Right of erasure of personal data
- Right to restriction of processing
- Right to object to data processing operations under some circumstances
- Right not to be subject to decisions made by automated processing under some circumstances
- Right of complaint about the organisation’s processing of personal data and the right to a judicial remedy and compensation
The information commissioner (ICO)
Colchester City Council are registered with The Information Commissioner (ICO) as a data controller.
Policy review
This policy document will be retained in accordance with Part 4 of Schedule 1 of the Data Protection Act. It will be made available to the Information Commissioners Office (ICO) on request.
The policy will be reviewed on an annual basis and updated as necessary at these reviews.
Further information
For further information about our compliance with Data Protection Legislation, visit www.colchester.gov.uk/privacy or email dpo@colchester.gov.uk.
Version control
Purpose: To specify how we comply with Data Protection Legislation with regard to the processing of special category and criminal convictions personal data
Status: Final
To be reviewed: August 2024