Revenues, Benefits and Exchequer Services - privacy notice

Who we are

Derby City Council is the local government unitary authority for Derby vity. Our address is The Council House, Corporation Street, Derby, DE1 2FS. You can contact our Data Protection Officer on 01332 640763 or by email at data.protection@derby.gov.uk.

How do we collect information from you?

We collect information from you when you visit www.derby.gov.uk, when you fill in any forms using our customer portals or on our website, including myAccount; also when you contact us in writing, speak to us on the phone, by email or any other type of electronic communication, or talk to us face to face.

It also includes when you make a Benefits claim or report a change in circumstances to us over the phone.

What types of information do we collect from you?

We collect information from you when you visit www.derby.gov.uk; also when you contact us in writing, speak to us on the phone, by email or any other type of electronic communication, or talk to us face to face. We collect different categories of information about you, depending on the service you want from us and/or the reason why we need to process information relating to you. This could be personal information (for example your name and address), or other more sensitive data that we would only collect and use in very particular circumstances that are set out in law.

Details of information obtained from third parties

We collect data from the following sources:

• Other Council Departments, such as the Electoral Services team, the Registration Services team and the Welfare Reform team (this list is not exhaustive)
• Derby Homes
• Elected members
• Other local authorities
• Our contracted service providers' records and their available datasets/repositories
• Police
• Department for Work and Pensions, Home Office, National Asylum Support Service, HM Revenues & Customs, HM Courts & Tribunals Service, The Valuation Office Agency, Department of Education, Ministry of Housing, Communities & Local Government, the Prison Service and any other Government Departments, organisations and agencies as are appropriate
• The National Anti-Fraud network (NAFN)
• The National Fraud Initiative (NFI)
• The Contact Tracing and Advice Service (CTAS)
• Any relevant third parties as required to help prevent fraud, including private sector companies as allowed by law
• Banks and building societies
• Landlords, agents and appointees
• Employers
• Schools
• Medical practitioners
• External auditors
• Debt advice agencies
• NHS Test and Trace Service
• The Office for National Statistics
• Spotlight - the Government's digital due-diligence tool
• Anyone you give us permission to speak to on your behalf
• Anonymous sources, such as members of the public contacting the Council's Counter Fraud team to report suspected fraudulent activities

The data that we obtain from the above sources is usually not publicly available, but we will also obtain and use publicly available data sources wherever it is appropriate to do so for the processing of your data as allowed by law, including for the detection, prevention and prosecution of fraud.

What is the lawful basis?

The legal basis for data processing we are relying on comes from Article 6 of the UK General Data Protection Regulations (UK GDPR). The following sections apply;

• Article 6(1)(c) Legal Obligation - Processing is necessary for compliance with a legal obligation to which the controller is subject;
• Article 6(1)(e) Public task - the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
• Article 9(2)(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

We may also ask for your consent in certain circumstances in accordance with:

• Article 6 1 (a) the data subject has given consent to the processing of his or her personal data for one or more specific purpose
• We rely on the following conditions as per Article 9 (2) of the UK GDPR:
  • (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes
  • (g) processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject
  • (f) processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity

If we have asked for your consent you will be able to opt out any time by emailing council.tax@derby.gov.uk.

We process all information in accordance with our legal obligations and public tasks arising from the following provisions:

• Census Act 1920
• Part 2A of the Public Health (Control of Disease) Act 1984
• Housing Benefit (General) Regulations 1987
• Local Government Finance Act 1988, as amended
• The Children Act 1989 and 2004
• Local Government and Housing Act 1989
• Non-Domestic Rating (Collection and Enforcement)(Local Lists) Regulations 1989
• Local Government Finance Act 1992 as amended
• Council Tax (Administration and Enforcement Regulations) 1992
• Social Security Administration Act 1992
• Social Security Contributions and Benefits Act 1992
• Council Tax (Deductions from Income Support) Regulations 1993
• The Education Act 1996, as amended (see Children and Families Act 2014)
• Housing Benefit (Recovery of Overpayments) Regulations 1997
• Social Security Administration Act Section 3 Social Security Act 1998
• Section 115 of the Crime and Disorder Act 1998
• Welfare Reform and Pensions Act 1999
• The Regulation of Investigatory Powers Act 2000
• Child Support, Pensions and Social Security Act 2000
• Housing Benefit (General) Amendment (No 2) Regulations 2001
• Council Tax and Non-Domestic Rating (Electronic Communications) (England) Order 2003
• The Business Improvement Districts (England) Regulations 2004
• Housing Benefit (General) Regulations (Revised) 2006
• Housing Benefit (State Pension Credit) Regulations 2006
• Fraud Act 2006
• Council Tax Benefit Regulations 2006
• Council Tax Benefit (State Pension Credit) Regulations 2006
• Welfare Reform Act 2007
• Statistics and Registration Service Act 2007
• Localism Act 2011
• Welfare Reform Act 2012
• Council Tax Reduction Schemes (Default Scheme) (England) Regulations 2012
• Council Tax Reduction Schemes (Prescribed Requirements) (England) Regulations 2012, as amended
• Local Government Finance Act 2012 as amended
• The Social Security (Civil Penalties) Regulations 2012
• The Social Security (Overpayments and Recovery) Regulations 2013
• Council Tax Reduction Schemes (Detection of Fraud and Enforcement)(England)Regulations 2013/501
• Universal Credit Regulations 2013
• Prevention of Social Housing Fraud (Power to Require Information)(England) Regulations 2014/899
• Section 54A of the Modern Slavery Act 2015
• UK General Data Protection Regulation 2021
• Data Protection Act 2018
• Small Business grand Fund (SBGF) and Retail, Hospitality and Leisure Grant Fund (RHLGF) government guidance
• Coronavirus Act 2020
• Section 151 Local Government Act 1972
• Local Government Act 2003
• The MHCLG Local Authority guidance - Expanded retail discount 2020 to 2021: coronavirus response
• De Minimis Regulation (Commission Regulation (EU) No 1407/2013)
• Any relevant legislation relating to the recovery of sundry debts
• The Local Audit and Accountability Act 2014
• The Council Tax (Demand Notices & Reduction Schemes)(England)(Amendment) Regulations 2022

How is your information used?

We may use your information to:

• Bill, administer and collect Council Tax, including the processing of refunds, discounts, exemptions, non-discretionary and discretionary reliefs and grants
• Bill, administer and collect Business Rates, including the processing of refunds, discounts, exemptions, non-discretionary and discretionary reliefs and grants
• Bill, administer and collect Business Improvement District (BID) levies, including the processing of refunds, discounts, exemptions, non-discretionary and discretionary reliefs and grants
• Process and pay Housing Benefit, second adult rebate for pensioners, Council Tax Support. This includes the risk scoring of claims made online, by Xantura Limited.
• Process and administer Discretionary Housing Payments and Council Tax Hardship, including the recovery of overpaid amounts
• Administer Test and Trace Support claims and payments, including any discretionary claims and awards as required. This includes any activities as required by Government such as assisting HMRC to determine income tax liabilities relating to Test and Trace Support payments and awards
• Administer COVID-19 Local Restrictions Support Grants for Closed Businesses as well as grant payments for other related schemes where needing to assess eligibility for payment.
• Bill, administer and collect Housing Benefit overpayments and overpaid Council Tax Support including the processing of refunds
• Process applications for free school meals
• Bill, administer and collect Sundry Debts, including the processing of refunds
• Process financial assessments relating to Home Care Charging and Residential Care Charging
• Investigate and prosecute Fraud
• We may send you communications about services you are already receiving and those you may benefit from that are linked to those you already receive
• Ask agencies, government departments or other public bodies to give us information they have about you
• Check information you have provided, or information about you that someone else has provided, with other information we hold
• Carry out our obligations arising from any contracts entered into by you and us
• Get information about you from certain third parties, or give information to them to check the accuracy of information, prevent or detect fraud or protect public funds including by conducting data matching exercises
• Identify vulnerable Housing Benefit and Council Tax Support claimants to support COVID-19 activity
• Conduct bank account validation, including whether a bank account is open and belongs to the individual/company concerned and returning a score indicating the strength of the match between the datasets held by the Council and the contracted service provider.
• As part of Derby City Council’s response to the impact of Covid-19, we may contact Landlords and/or Tenants in certain circumstances with information and guidance on what support is available from Derby City Council and how to access that support.
• Assist the ONS to perform its functions under the Statistics and Registration Service Act 2007 and the Census Act 1920.
• Instances of COVID Grant Fraud may be referred to the National Anti-Fraud Network (NAFN), and if a case is categorised as organised, large scale, systematic or crosses Local Authority boundaries by NAFN, they may pass the case to the National Investigation Service (NATIS) who investigate serious and organised fraud on behalf of Department for Business, Energy and Industrial Strategy (BEIS).
• In certain instances, overpayments of COVID Grants may also be passed to Department for Business, Energy and Industrial Strategy (BEIS) for recovery action.
• Administer the Council Tax Energy Rebate Scheme

This is to help us:

• Meet our statutory and non-statutory duties, including providing data to assist with the completion of surveys, including the private sector housing stock condition & health survey
• Administer work accurately and efficiently
• Assess any contribution to means-tested payments or grants provided by the Council
• Bill, administer and collect debt
• Trace debtors
• Risk score claims made to determine evidence requirements
• Provide you with information
• Contribute to intelligence gathering to assess impacts of changes to identify need
• Check the information you have given us to make sure we are handling your data correctly, and for other purposes allowed by law
• Prevent fraud and the misuse of public funds
• Support COVID-19 activity including:
  • Making use of the data easement permitted by the Department for Work and Pensions relating to the identification of vulnerable Housing Benefit and Council Tax Support claimants to support COVID-19 activity. We may use the following information to that end: your name, your national insurance number, your address and your contact details. We may use other data, but only if allowed by the Department for Work & Pensions
  • The payment of Business Support Grants; any such storage, processing or sharing of information will be done in the public interest in order to support the effective management of public funds
  • The administration of Test and Trace Support payments, discretionary awards and any other activities as required by Central Government
  • The administration of COVID-19 Local Restrictions Support Grants for Closed Businesses, including any activities to estimate and measure the likely incidence of fraud and error in the Scheme. Data will be shared with the Department for Business, Energy and Industrial Strategy for research and evaluation purposes. You may also be contacted for research purposes.
  • Support the administration of the Council's COVID-19 Additional Relief Fund (CARF)
  • Any other activity permitted by law.

Business Grants for COVID-19 financial support

The Council will routinely consider data submitted for COVID-19 grant schemes to assess your eligibility for up-and-coming grant schemes in accordance above provisions. You can inform us about any changes to your circumstances by email: business.rates@derby.gov.uk.

Council Tax Energy Rebate Scheme

On 3 February 2022, the UK Government announced measures to help protect millions of households from rising energy costs. This includes a council tax energy rebate for households in England, whose primary residence is valued in council tax bands A to D on 1 April 2022, being a one-off cash payment of £150.

This payment will operate outside of the council tax system, using the council tax database to identify eligible households.

For further information on eligibility for this scheme, please visit our Council Tax Energy Rebate page.

We will process the personal data that we already hold about you within the council tax database or you provide to us for this purpose including:

• Full name
• Full residential address
• Council tax reference and banding information
• Email address
• Mobile telephone number
• Home telephone number
• Bank account details
• Evidence in relation to Council Tax discounts and exemptions
• Date of Birth

We will obtain your personal data from our existing council tax database and any additional data you provide, if required, such as bank details, for payment to be made. This may include ‘special category data’ such as health data when related to council tax exemptions and discounts.

The Council Tax Energy Rebate Scheme will end on 30th November 2022

We will routinely use information received as part of the application process to assess your eligibility for this scheme, and for up-and-coming schemes in accordance with the above provisions. As part of this scheme, we will re-use any information you have provided for any further payments due under this scheme, please inform us of any changes in your circumstances by email: council.tax@derby.gov.uk.

Energy Bills Support Scheme Alternative Funding and Domestic Alternative Fuel Payment Scheme Alternative Funding

On 19^th December 2022, the UK Government announced measures to help support households with energy costs. Energy Bills Support Scheme (EBSS) Alternative Funding is for households who did not receive the original Energy Bill Support Scheme payment automatically, such as those without their own electricity supply or those without a direct relationship with the electricity supplier.

The Alternative Fuel Payment scheme provides a payment to domestic energy consumers in Great Britain that use alternative fuels such as heating oil, LPG or biomass as their primary source of heating. Most eligible households will receive this payment automatically via their electricity supplier. A small proportion of households will need to apply for the payment, for example because they do not have a relationship with an electricity supplier.

The application portal is accessible here:

• www.gov.uk/apply-energy-bill-support-if-not-automatic

Application Data provided to the Department for Energy Security and Net Zero (DESNZ) will be passed to local authorities for verification checks and decision for payment.

The data provided includes, but is not limited to:

• your name, address, date of birth, postcode and contact details
• bank account details
• documents you upload as proof of address
• documents you upload as proof of purchase for Alternative fuels

The purpose of this is to:

• confirm your identity
• facilitate payment
• prevent, detect and investigate fraud and errors

Special category data will not be expressly requested in connection with applications for the scheme, but it is possible that co-incidental collection and sharing of special category data could occur as a result of information provided by applicants (or third-party individuals acting on your behalf) in connection with the applications, including, but not limited to, information relating to the ethnic origin of applicants or data concerning applicant's health or age.

The Department for Energy Security and Net Zero (DESNZ)’s privacy notice relating to the scheme is here:

• https://ebss.apply-for-energy-bill-alternative-funds.service.gov.uk/s/gb-privacy-notice

  and

• https://online.apply-for-alternative-fuel-support.service.gov.uk/s/privacy

This sets out what DESNZ will do with your data.

COVID-19/Coronavirus

Coronavirus has been added as a notifiable disease under the Health Protection (Notification) Regulations 2010. Under the Public Health (Control of Disease) Act 1984 and associated Regulations, Section 1 of the Localism Act 2011, Section 31 of the Local Government Act 2003; and the Coronavirus Act 2020 and associated Regulations the Council has a legal duty to store, process and share personal information. The information will be stored, processed and shared as part of the national, and local Coronavirus Test and Trace operations where necessary for investigations, as well as the testing and tracing of individuals, groups or businesses; and to assist in the investigation into cases of Coronavirus; Coronavirus outbreaks and issues of non-compliance with the Acts and associated Regulations. The information will also be used; interrogated and mapped to inform the Councils actions and decision-making processes. Any such storage, processing or sharing of information will be done in the public interest in order to promote health and wellbeing.

During the investigation of cases and/or outbreaks of Coronavirus, information which is gathered may be shared between departments within Derby City Council; with other Councils associated with an outbreak; other health services or with other government bodies associated with the control of the Coronavirus. The Council has a duty to notify national Government bodies, such as Public Health England, and the relevant local authority where an individual resides (if different), where there are suspected Coronavirus cases. The Council will disclose the information under Article 9(2)(j) of the UK GDPR (processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health), and confidential information may be lawfully disclosed in the public interest, without consent, where the benefits to an individual or to society outweigh both the individual’s and the public interest in maintaining the confidentiality of such data.

The Council may contact staff, service users, residents, patients, businesses and premises with messages relating to Coronavirus by text, phone, letter or e-mail. This contact is not direct marketing; therefore we do not need your Consent before contacting you. There is more information available on the ICO's website.

Research and statistics

Anonymised and pseudonymised data may be used for research and statistical purposes. Any data collected may be used for research and statistical purposes that are relevant and compatible with the purpose that the data was collected for.

Who has access to your information?

We may share your information with:

• Other Council Departments, such as the Business Systems team, the Business Support team, the Economic Regeneration team and Parking Services (this list is not exhaustive). We may also share your information with the Customer Management team for the administration of Test and Trace discretionary awards (managed under the Council’s Local Assistance Scheme).
• Derby Homes
• Elected members
• Schools in the Derby City Area
• Relevant individuals such as landlords and agents. Housing Benefit landlords and agents have access to restricted details about their tenant's payments, where the landlord / agent is receiving their tenant's Housing Benefit direct from us
• External organisations such as:
  • Government departments, organisations and agencies,
  • Other local authorities
  • Courts and Tribunals
  • The Rent Office
  • The Valuation Office Agency
  • The Police
  • The National Asylum Support Service (NASS)
  • The National Anti-Fraud network (NAFN)
  • The National Fraud Initiative (NFI)
  • The National Investigation Service (NATIS)
  • The Contact Tracing & Advice Service (CTAS)
  • Social housing landlords (for Housing Benefit claimants in social housing)
  • Banks and building societies
  • External auditors
  • Enforcement agents
  • Debt advice agencies
  • Medical practitioners (if you are claiming a discount for severe mental impairment)
  • Your employer
  • Any relevant third parties as required to help prevent fraud, including private sector companies as allowed by law
  • Office for National Statistics
  • Contracted service providers and IT companies used for technical support and their sub-processors; these are as follows:
    • Bristow and Sutor
    • Capita Business Services Limited
    • Datatank Limited
    • Equita Limited
    • Ernst & Young LLP
    • Experian Finance PLC
    • Financial Data Management Limited
    • Liberata UK Limited
    • Northgate Public Services (UK) Limited
    • PayPoint and its subcontractors
    • Rimini Street Incorporated
    • Velocity Technology Solutions Incorporated
    • Wilkin Chapman LLP and its subcontractor Lexis Nexis Risk Solutions (UK) Limited
    • Wilks Head and Eve LLP
    • Xantura Limited.

These may be subject to change.

We will not sell or rent your information to third parties. We will not share your information with third parties for marketing purposes.

What are your rights?

• Access – you can request copies of any of your personal information that is held by the Council.
• Rectification – you can ask us to correct any incorrect information.
• Deletion – you can ask us to delete your personal information. The Council can refuse to delete information if we have a lawful reason to keep this.
• Portability – you can ask us to transfer your personal data to different services or to you.
• Right to object or restrict processing – you have the right to object to how your data is being used and how it is going to be used in the future.
• Right to prevent automatic decisions – you have the right to challenge a decision that affects you that has been made automatically without human intervention, for example an online form with an instant decision.

National Data Opt Out

We are one of many organisations working within health and social care to improve health and wellbeing for patients as well as the public. Information collected from you when you use our services may be stored and shared with services or partner organisations for purposes other than your individual care, for instance to help with:

• Improving the quality and standards of care provided
• Research into the development of new treatments
• Preventing illness and diseases
• Monitoring safety

This may only take place when there is a clear legal basis to use this information. Confidential information about your health and care will only be used in limited circumstances where it is not possible to use anonymised data.

You have a choice about whether you want your confidential information to be used in this way. If you are happy for your information to be used in this way you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.

For more information or to register your choice to opt out please visit https://www.nhs.uk/your-nhs-data-matters/. You can choose to opt in at any time.

Please be aware that the National Data Opt Out does not apply to information used for marketing purposes, your data would only be used in this way with your specific agreement.

All Health and Social Care organisations should have systems and process in place so they can be compliant with the national data opt-out and apply your choice to any confidential patient information they use or share for purposes beyond your individual care.

Our organisation is compliant with the national opt out policy.

How long will we keep your information for?

We keep and dispose of all records in line with our record retention schedule. We will comply with Data Protection legislation.

What security precautions are in place to protect the loss, misuse or alteration of your information?

We are strongly committed to data security and will take reasonable and appropriate steps to protect your personal information from unauthorised access, loss, misuse, alteration or corruption. We have put in place physical, electronic, and managerial procedures to safeguard the information you provide to us. However, we cannot guarantee the security of any information you transmit to us. We recommend that you take every precaution to protect your personal information.

Keeping your data up to date

We want to ensure any information we hold is accurate. You can help us by promptly informing us of any changes to the information we hold about you.

Details of any automated decision processes

During the processing of Housing Benefit, second adult rebate for pensioners and Council Tax Support claims, automated risk scoring of claims made online is done by Xantura Limited. This process is used to determine what evidence claimants need to provide in support of their claims, with the procedure for this being set out in the Council's Risk Based Verification Policy. The automatic risk profiling done by the software is reviewed by Benefits assessors before a decision is made on each claim, and the automated profiling can be manually over-ruled where appropriate in accordance with local guidance.

Automatic processing can also take place during the processing of Single Person Discount claims. When this happens, the decisions made can be reviewed by Council Tax staff and manual intervention can take place where appropriate in accordance with local guidance.

Automated processing takes place during the bank validation process when businesses make a claim from The Small Business Grant Fund and The Retail, Hospitality and Leisure Grant Fund. The validation of bank account details is done using Experian's data repository to provide bank validation and account verification score matching to verify whether a bank account is open and belongs to the individual/company proposed. During the automated checks, a score is returned by Experian to the Council indicating the strength of the match between the data held by Experian and the data submitted by the Council. Where the strength of match is sufficiently strong, we will consider making an award to the individual/company involved. For quality assurance purposes and for the detection and prevention of fraud, sample checks of the processed data will be made by the Council. Experian may also be used for the bank validation process used during the administration of Test and Trace payments and discretionary awards.

Automatic processing takes place during the collation & analysis of data by Wilkin Chapman & Lexis Nexis Risk Solutions (UK) Limited in order to:

• gather intelligence for the Council
• make assessments on debtors' propensity to pay
• make recommendations about the appropriate methods of recovery that the Council should consider taking to collect outstanding debt in each case.

When this happens, the information provided may be reviewed manually by Council Tax staff to decide how the Council will act on the information that has been provided to it, in accordance with local guidance.

Under 13

If you are accessing online services and are under the age of 13‚ please ask for your parent/guardian's permission beforehand whenever you provide us with personal information.

Cookies

Cookies are small text files which identify your computer to our servers. They are used to improve the user experience. View what cookies we use and how you can manage them.

IP addresses

Internet Protocol (IP) addresses are collected when our site is used:

• for statistical/analytical purposes
• to identify any malicious activity.

Complaints

If you would like to make a complaint regarding the use of your personal data you can contact our Data Protection Officer:

• By post: Information Governance, Council House, Corporation Street, Derby, DE1 2FS
• By phone: 01332 640763
• By email: data.protection@derby.gov.uk

For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner's Office (ICO):

• By post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• By phone: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number

Alternatively, visit ico.org.uk or email casework@ico.org.uk.