Data protection and freedom of information

Since 1 January 2005, all requests for information received by a public authority have been answered in accordance with the Freedom of Information (FOI) Act 2000 or the Environmental Information Regulations 2004 (EIRs). The only exception will be an individual's request for their own personal data, which must be handled under the terms of the General Data Protection Regulations.

Obtaining information

There are 3 ways to obtain information

• Using the Publication Schedule - This lists the type of information which the council routinely publishes and where to obtain it from.
• Using the Council's Open Data page - This page publishes data the Council is frequently asked for and is intended to provide easy access to useful information.

The information you want may already be included in these publications, so please check here first.  If you are not able to find the information you need, you may put your request in writing or online using the freedom of information request form.

Freedom of information request form

Our response to your request

Within 20 working days of your written request, we will:

• confirm to you whether we hold the information;
• advise you if a fee will be charged; and
• provide you with the information (after any relevant fee has been paid) unless an exemption applies.

If we require further clarification on your request, we may contact you. At this point, the clock stops and restarts when you come back to us with further information.

Please note that the 20 days excludes the day we receive the request and bank holidays.

Fees

The Act allows us to charge for answering Freedom of Information requests in the following circumstances:

• disbursement costs such as printing, photocopying and postage.
• when estimated staff costs involved locating or compiling the information exceeds £450. Under these circumstances, we can refuse the request on grounds of cost, or charge the applicant £25 per hour for the estimated work.

For disbursement costs, we will charge 10p per sheet for photocopying and printing documents, and recover the cost of postage or any other transmission costs from the applicant. We will not charge if the costs are less than £5.

Exemptions

Some information is protected under 23 exemptions, for example, personal data or commercially sensitive information. Under these circumstances we will not release the information to you and will write to you to explain why.

Further information

If you need further assistance, please contact Freedom of Information at Chichester District Council.

You can also find more detailed guidance on the website of the Information Commissioner .

Complaints

If you are dissatisfied with the response from the council, you may write to the Head of Business Improvement Services to ask for a review of the decision (please contact Freedom of Information). You will receive an acknowledgement of the request within 3 working days and a full response will be provided within 20 working days.  If you are still dissatisfied, you may contact the Information Commissioner.

Chichester District Council manages personal data in accordance with the provisions of the Data Protection Act 2018. The Act applies to personal information about living, identifiable, persons.

The collection, holding and use of data is governed by eight principles.

Data protection principles

Chichester District Council manages personal data in accordance with the provisions of the General Data Protection Regulations (GDPR). The Regulations apply to personal information about living, identifiable, persons.

The GDPR outlines six data protection principles that this Council follows when collecting, processing and storing individuals' personal data. The data controller is responsible for complying with the principles.

The Principles are :

1. Lawfulness, fairness and transparency

The first principle is relatively self-evident: organisations need to make sure their data collection practices don't break the law and that they aren't hiding anything from data subjects.

The Council has a Register of Processing which sets out why we obtain, hold and use personal information.

2. Purpose limitation

The Council only collects personal data for a specific purpose, clearly state what that purpose is, and only collects data for as long as necessary to complete that purpose.  In almost all cases the Council "basis of processing" is to carry out the public duties of a local authority.

Some Processing is done for archiving purposes in the public interest or for scientific, historical or statistical purposes.

3. Data minimisation

The Council must only process the personal data that they need to achieve its processing purposes. This both improves security and makes it easier for the Council to keep data accurate and up to date.

4. Accuracy

The accuracy of personal data is integral to data protection. The GDPR states that "every reasonable step must be taken" to erase or rectify data that is inaccurate or incomplete.

Individuals have the right to request that inaccurate or incomplete data be erased or rectified within 30 days.

5. Storage limitation

Similarly, organisations need to delete personal data when it's no longer necessary.

The time the Council generally considers that it needs to hold onto data will relate directly to the reason why it is processing it and for each area that is detailed on the processing register.  More detail of this can be seen in the Retention Scheme (below)

6. Integrity and confidentiality

The GDPR states that personal data must be "processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures".

Technological and organisational best practices are constantly changing but the Council will work hard to maintain security of your information. This includes encryption and/or pseudonymising personal data wherever possible, and other options which are suitable and appropriate for the type of information being held.

Data matching

The council is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing or administering public funds in order to prevent and detect fraud.

The Cabinet Office is responsible under Part 6 of and Schedule 9 to the Local Audit and Accountability Act 2014 for carrying out data matching exercises.

Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information.

Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it indicates that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

The council participates in the Cabinet Office's national fraud initiative. This is a data matching exercise to assist in the prevention and detection of fraud. The Council is required to provide particular sets of data to the relevant minister of the Cabinet Office for matching for each exercise.

The use of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under its powers in Part 6 of and Schedule 9 to the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under the Data Protection Act 2018.

The Cabinet Office has published a code of practice guidance.

For further information on the Cabinet Office's legal powers and the reasons why it matches particular information please visit GOV.UK  

For further information on data matching at the Council please e-mail your request for information to the Customer Service Centre.

Persons wishing to make an access request regarding personal data held by the council should write to the Data Protection Officer at the council stating the topic(s) of information required. In most cases a fee is not payable when making a request for your personal data.

For further information see the   Information Commissioner's Office .

Chichester District Council (CDC) manages personal data in accordance with the General Data Protection Regulation (GDPR) 2016 and is a public authority as defined within the GDPR.

CDC is the data controller for:

• Season tickets applications and administration
• ANPR (Automatic Number Plate Recognition) in the Avenue de Chartres car park (Metric)
• Off-street Penalty Charge Notices (PCN)
• Off-street pay and display (Parkeon/Flowbird)
• Mipermit cashless parking and virtual season tickets

CDC is the data processor for:

• On-street penalty charge notices
• On-street permits, applications and administration

For Mipermit cashless parking and virtual season tickets, Chipside Ltd is the data controller and for on-street penalty charge notices and permit applications and administration, West Sussex County Council is the data controller.

Whether CDC is the data controller or the data processor, we are committed to doing the right thing when it comes to how we collect, use and protect your personal data. Examples of personal data we collect are, your address and other contact details, proof of residency such as bills or tenancy agreements, vehicle registration marks and DVLA data, Blue Badge information and other documents submitted in relation to Penalty Charge Notices.     

We will protect your privacy and any personal data that you provide in relation to the work we undertake and your contact with us will be stored securely and used only for the correct purposes.

Why we need your information and how we use it

Season Tickets Applications and Administration

The purpose of processing your personal data is to enable us to deliver a service whereby we can operate waiting lists and administer season tickets for parking in off-street car parks within the district.

We rely on GDPR Articles 6 (1) (b) and (e) which means that processing is necessary in order to permit use of a parking space in a car park and for us to perform a public task in line with the Chichester District Council (Off-Street Parking Places) (Civil Enforcement and Consolidation) Order 2012 as amended.

ANPR in the Avenue de Chartres Car Park

The purpose of processing your personal data is to allow a vehicle access to use Avenue de Chartres Car Park.

By way of the information we obtain we will use your data to ensure that vehicles can gain access to the car park, make a payment using a payment machine and exit the car park. 

We rely on GDPR Articles 6 (1) (e) and (f) as the lawful basis for processing data as it is necessary to enable us to perform a task in the exercise of official authority. We also process data in pursuit of our [and/or another's] legitimate interests in accordance with the Chichester District Council (Off-Street Parking Places) (Civil Enforcement and Consolidation).

Penalty Charge Notices (PCNs)

The purpose of processing your personal data is to administer CDC's processing of PCN-s and appeals under Civil Parking Enforcement. We will use your data to process PCNs which are issued to vehicles in respect of parking contraventions.

We rely on GDPR Articles 6 (1) (c) and (e) which means that processing is necessary in order for us to comply with a legal obligation and/or to carry out a task in the public interest and/or in the exercise of official authority given to us as the data controller, namely the traffic management and civil enforcement legislation.

Where special category data is provided and processed, such as medical evidence or a death certificate the relevant legal basis we are relying on is the GDPR Article 9 (1) (f), as processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.   

All processes are carried out in line with traffic management / parking-related legislation and using secure systems. The information you provide will only be used for the parking-related purposes for which it was obtained.

Off Street Pay and Display and Mipermit

The purpose of processing your data is to enable a customer to obtain pay and display tickets in rural and coastal car parks, to use Mipermit for a season ticket or to validate a stay in a car park for a specific period of time against a specific vehicle registration.

We rely on GDPR Articles 6 (1) (b) and (e) which means that processing is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract or for us to perform a public task which is carried out in line with the Chichester District Council (Off-Street Parking Places) (Civil Enforcement and Consolidation) Order.

On Street Permits, Applications and Administration

The purpose of processing your personal data is to administer civil parking enforcement, the processing of on-street parking and for permit administration.

We rely on GDPR Articles 6 (1) (b) and (e) which means that processing is necessary to for us to perform a public task which is carried out in line with the West Sussex County Council (Chichester District) (Parking Places and Traffic Regulation) (Consolidation) Order 2010 - as amended.

Where special category data is provided and processed, such as medical evidence or a death certificate the relevant legal basis we are relying on is the GDPR Article 9 (1) (f), as processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

Who your information may be shared with

The Parking Services department may share personal data with other organisations for law enforcement and regulation purposes, criminal prosecutions and court proceedings. We may also share it in order to establish, exercise or defend our legal rights which include the prevention and detection of fraud.

Under civil parking enforcement we will also share data with the Traffic Penalty Tribunal, the Traffic Enforcement Centre, the courts, enforcement agents and agents providing services to CDC in carrying out its role in pursuing unpaid PCNs.

How we protect your information

Parking services uses secure back office systems to hold data. Only authorised officers will access data and systems. Where another body/organisation accesses or owns the system, there is a data sharing agreement or contract in place which outlines data protection requirements.  

Your right of access

You have the right to obtain from the data controller confirmation as to whether or not personal data concerning you is being processed and other information such as why and how it is being processed. Where this is the case, you have a right to access the data we hold and can contact using the contact details in the 'How to contact us' section.

How long we keep your information

The time CDC generally considers that it needs to hold onto data will relate directly to the reason why it is processing it and for which parking function or service as set out in the Parking Services Retention Policy, which you can see on CDC's website under Retention guidelines.

How you can contact us

If you would like to discuss anything in this privacy notice, please contact the Parking Services team, either by email at parkingservices@chichester.gov.uk or by phone: 01243 534500.

Your rights

You have certain rights under UK data protection legislation, including:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling.

If you have a concern about the way we are collecting or using your personal data, we request that you raise this with us in the first instance. Alternatively, you can contact the Information Commissioner's Office .

Pay on foot privacy impact assessment

For the purposes of the General Data Protection Regulation 2016 (GDPR):  Chichester District Council (the Council) is a data controller and JDI Solutions Ltd is a data processor.

Data is held in order to comply with the Council's legal obligations in relation to consulting on the preparation of a range of local planning policy documents including the Local Plan.

Data is held with your consent where you have asked to be added to our consultee list. This consent is assumed to be ongoing until you notify us otherwise. You may notify us of this or of any changes to your details in any of the following ways:

• By logging on to the consultation system at https://chichester.oc2.uk/login and either updating or deleting your record under "My Account".
• By email: planningpolicy@chichester.gov.uk
• By letter to:

Planning Policy

Chichester District Council

East Pallant House

East Pallant

Chichester

PO19 1TY

Information we collect

Name

Address

Email (where provided)

Telephone number (where provided)

Agent contact details (if applicable)

Site information (if applicable)

How we use the information we collect

We will use the details you have provided to contact you about planning policy matters.

The Council is required to register and publish representations made in relation to planning policy consultations. For this we require a name and address, and preferably an email address, to be provided. Only your name (and where relevant your organisation) will be published alongside your representation.  At examination stage your contact details and representations will be passed to the Programme Officer and Planning Inspector as part of the examination process.

Further information can be found in the register of data processing on our https://www.chichester.gov.uk/dataprotectionandfreedomofinformation webpage (note that this document is currently under review):

How long will we keep the data

Contact details for those organisations identified as relevant authorities or specific consultation bodies in the Town and Country Planning (Local Planning) Regulations 2012 will be held for as long as those organisations retain that status.

Contact details for individuals who wish to be kept informed but who are not making formal representation  on any planning policy consultation will be kept until the Local Plan has been adopted and passed the period for judicial review - unless you ask us to remove your details sooner (see above for ways to do this).

Where individuals have made a formal representation their data becomes part of the public record and will be stored and processed for as long as the data is required. You can however opt out of further communications about planning policy matters such as the Local Plan by notifying us by email or letter as above.  

Once the Local Plan has been adopted individuals will be asked to opt in again to be informed of subsequent planning policy related consultations.

The Council's information retention scheme (currently under review) is available on our website.

Please note that any personal information will be processed by the Council in line with the principles and rights set out in the GDPR and the Data Protection Act 2018.  This means for example that (other than in the ways identified above) your personal details will only be accessed by authorised persons and will not be shared with anyone else.  

Changes to our privacy notice

We reserve the right to update this privacy notice at any time.  You will be notified if there are significant changes.  The privacy notice can be viewed on the Council's website.

Please read our contact services data protection policy:

Chichester District Council manages personal data in accordance with the provisions of the General Data Protection Regulations (GDPR). The Regulations apply to personal information about living, identifiable, persons.

When you contact the Customer Services team we will ask you for certain personal information in order to be able to assist with your enquiry. Some of this information will need to be recorded and stored on our systems.

This notice explains why we ask for your personal information, how that information will be used and how you can access your records.

Why we need your information and how we use it

When you contact the Customer Services team we will collect certain personal information from you. The type of information we collect will depend on the service you are requesting.

We use your information in a variety of ways:

To process your service request, for example to let our waste management service know that they have missed your bin collection

To check your identity when you contact us asking for information; for example if you want to discuss personal Housing related issues with us

1.     To help us investigate any concerns or complaints that you may have about services that you receive from the Council.

What type of information is collected from you

The information we collect is recorded and then stored on our secure Customer Record Management (CRM) system.  In order to administer our services we collect the following information from you:

1.     name

2.     address

3.     Contact Details (phone, email etc.)

We will only ask for personal information that is appropriate to enable us to deliver our services. In some cases, you can refuse to provide your details if you deem a request to be inappropriate. However, you should note that this may impact on our ability to provide some services to you.

Who your information may be shared with (internally and externally)

Sometimes, in order to process your enquiry we need to share the information that you give us; either with other departments within the Council or with other agencies; WSCC who control the parking zones within Chichester and South Downs National Park Planning Authority, Chichester act as their agent for all park applications within our district.

We will often have to share the information you have given us with other teams or services within The Council; but this will be for the express purpose of processing your enquiry.  For example if you contact Customer Services to report  a problem with parking in your area, then when we pass this to our Parking team they may wish to get in touch with you for more information.

How we protect your Information

We have implemented generally accepted standards of technology and operational security in order to protect personal data from loss, misuse, or unauthorised alteration or destruction.  

For any payments which we take from you online we will use a recognised online secure payment system.

How long we keep your data

The time the Council generally considers that it needs to hold onto data will relate directly to the reason why it is processing it and for each area that is detailed on the processing register.  More detail of this can be seen in the Retention Scheme (below)

Accuracy

The accuracy of your information is important to us to be able to provide relevant services more quickly. We are working to make our record keeping more efficient. In the meantime, if you change your address or email address, or if any of your circumstances change or any of the other information we hold is inaccurate or out of date please email us or write to us at:

Chichester District Council manages personal data in accordance with the General Data Protection Regulations 2016 and is a public authority as defined within those regulations.

The revenues department refers to - council tax, business rates, housing benefit, council tax reduction and the collection and enforcement of the BID levy. Revenues department related personal data will be processed for the public purpose of the exercise of duties related to the local authority functions of the revenues department, including related processing specifically financial and criminal investigations or any administrative tasks reasonably required to carry out those functions.

Revenues department data will be provided to the Cabinet Office for data matching purposes in accordance with Section 6 of the Local Audit and Accountability Act 2014 as part of the National Fraud Initiative or where otherwise provided for in law.

This data will be used for cross-system and cross-authority comparison for the prevention and detection of fraud.

For more information, please see our data protection policy section, which provides further guidance on your rights and access to the Cabinet Office's National Fraud Initiative web pages, or contact the relevant revenues department on 01243 785166.

The revenues department will share information including personal data with other departments in the council to support the effective carrying out of this work in particular IT, legal and finance departments. The council will also share personal data with partner bodies where statute allows sharing information and personal data with those bodies.

The revenues department will share personal data externally where it is reasonably required to carry out elements of the revenues department's work of the council under a data processing or data sharing agreement including where that processing is required to improve our services to you. Information will also be shared when requests are received by legitimate law enforcement bodies carrying out their own public role.

Chichester District Council's benefits department manages personal data in accordance with the General Data Protection Regulations 2016 and is a public authority as defined within those regulations.

Chichester District Council, as the data controller, is committed to protecting your privacy and any personal data that you provide in relation to your application, claim or as supporting evidence will be stored securely and used only for this purpose. We will not use your information for any other purpose or give it to anyone else unless it is necessary to establish entitlement or we are required to do so by law.  

This gives you the legal right to put right any information about you which we get wrong. It also means that we must not share details about your claim, except where we need to do so to establish entitlement.  However the law also says that we must protect the public funds we handle and we may share information that is given to us with other organisations that inspect or handle public funds, to prevent and detect fraud. Examples are:

• The Department for Work and Pensions
• HM Revenues & Customs
• The National Audit Office
• The Cabinet Office.

The National Audit Office appoints an auditor who checks the council's accounts. The Cabinet Office is responsible for the National Fraud Initiative (NFI) which carries out data matching exercises. Data matching is comparing computer records held by one organisation with other computer records held by the same organisation or a different one. This is usually personal information.

Computerised data matching allows us to identify claims and payments that may be fraudulent. A match means that there is an inconsistency between the two sets of records, and identifies the need for this inconsistency to be investigated. The inconsistency may be because of fraud or because of incorrect data, however this would not be known until the matter had been investigated.

The Council has to give information to the NFI for data matching exercises you can find out more about the kind of data required in their guidance at:

The law says that the Audit Commission has legal powers to use data in data matching exercises and that it does not have to get agreement of the people whose details are being matched.

The NFI documents setting out the code of practice for data matching can be found at:

Data sharing with credit reference agencies

We may also share information with a credit reference agency to prevent and detect fraud.  Where the Authority deems it necessary additional checks may be made on a claim, this includes obtaining information from a credit reference agency. This is additional check is carried out via the National Anti-Fraud Network and does not leave a footprint on an individual's credit account. Such checks may be carried out where there is a reasonable level of doubt that the information given on an application or a declaration of a change is correct.      a

Other ways we may use your details

As well as sharing details with the Audit Commission and other organisations that inspect or handle public funds, we may also use our customers' details within the council for

• Keeping the electoral roll correct
• Collecting debts owed to the Council (for example Council Tax): and
• Preventing and detecting fraud and other crime.

Privacy notice for Building Regulations applications

Building legislation (The Building Act 1984 and The Building Regulations 2010 (as amended)) requires Chichester District Council to keep records of any person that deposits or has an application deposited on their behalf for proposed building work that is subject to the Building Regulations.

Who processes my data?

The information that you provide with the Building Regulations application will be processed by Chichester District Council, which is the data controller for the purposes of the Data Protection Act.

What is my data used for?

The information provided including any personal data, will only be used to deal with your Building Regulations application.

Who sees my data?

The Building Regulations applications are closed and as such no personal data is uploaded to the councils website.

We will keep your data after completion of your project.  Your information will not be shared unless there are legal reasons to do so.

Information you provide will only be used for the stated purpose.  You can find further information about the processing of your data on the data protection page.  Individuals have a number of rights under data protection law, including the right to request their information.

The  Environmental Information Regulations (EIR) came into force on 01 January 2005 giving members of the public the right to access environmental  information held by the council.

What information do they cover?

They cover information on the state of the environment, such as:

• air, water, soil, flora, fauna (including humans), diversity, genetically modified organisms.
• information on emissions and discharges, noise, energy, radiation, waste and other such substances.
• measures and activities such as policies, plans, and agreements.
• reports, cost benefit and economic analyses.
• the state of human health and safety, contamination of the food chain.
• cultural sites and built structures (as they may be affected by environmental factors).

Obtaining information

Requests can be made in writing, verbally or online using the Environmental Information Regulations request form.

Environmental Information Regulations request form

Your request must include your name and address and details of the information required.

Our response to your request

Within 20 working days of your request, we will:

• confirm if we hold the information.
• advise if a fee will be charged.
• provide you with the information (after any relevant fee has been paid), unless an exemption applies.

If your request is complex and voluminous, then we can have up to 40 working days to respond.

Exemptions

Some information requested may not be provided by the council as there are some grounds for refusing to disclose environmental information.

Fees

The Regulations permit the council to charge for providing environmental information except in two instances mentioned below:

• access public registers or lists of environmental information; or,
• to examine the information (at a place chosen by the council).

We reserve the right to charge for the following activities at a fixed rate of £25 per person engaged per hour, for:

• determining whether we hold the information requested.
• locating the information, or a document containing the information.
• retrieving the information.
• extracting the information from documents containing it.
• other costs of making available the information (e.g. supervision of scanning and photographing of documents, postage and photocopying costs).
• postage and other means of transmission (e.g.CD-Roms) will be charged at cost and photocopying at 10p per A4 sheet.

The council will waive the first £5 of any fees or costs chargeable.

Complaints

If you are dissatisfied with the response from the council, you must write to the Head of Business Improvement Services within 40 days to ask for a review of the decision (please contact Freedom of Information). You will receive an acknowledgement of the request within 3 working days and a full response will be provided within 20 working days.  If you are still dissatisfied, you may contact the Information Commissioner.

 Privacy Impact Assessment Body Worn Video [32kb]

 Privacy Impact Assessment Chichester CCTV [214kb]

Re-Use of information is defined as: 'The re-use of Council owned information by a third party for a purpose other than the initial purpose for which that information was produced.'

On 1 July 2005 the Reuse of Information Regulations came into effect. The aims of the regulations are to encourage the re-use of public information by third parties and to remove barriers to re-use.

The following documents have been prepared to help with Re-use of information enquiries.