Environmental Health privacy notice

When you contact Environmental Health Services you will need to provide us with some personal information.

As the 'data controller' for the personal information - or data - we hold about you, South Ayrshire Council decides how your personal information is used/processed and what it is used for.

This statement provides more details about this and provides information on how to get in touch with us if you need to know more.

Your personal data - what is it?

Personal data is information relating to a living person who can be identified from that data. Identification can be based on the information alone, or in conjunction with any other information. The processing of personal data is governed by the General Data Protection Regulation 2016 (GDPR) and supplemented by the Data Protection Act 2018.

What Personal Data will we collect from you?

We will only collect the personal information we need to provide you with relevant information, services and support. The personal data we may collect includes:

• Name
• Date of birth
• Address
• Telephone Number
• Mobile Number
• Email
• Gender
• Heath conditions

When investigating communicable disease we may also collect data relating to:

• Food consumption history
• Travel history

We will log and keep your personal information on our environmental health management system and electronic document management system

How will we use your information?

All personal data is processed only by our environmental health staff. We will only collect the personal data we need in order to protect public health or give advice. We will use your personal data to contact you regarding a service request, investigation or inspection. This will be for matters relating to:

• Food Safety
• Occupational Health and Safety
• Public Health
• Communicable Disease
• Environmental Protection
• Pest Control
• Animal Welfare
• Housing

What is the legal basis for using/sharing your information?

Processing is necessary under the terms of the GDPR for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller as per Article 6(1) (e) of the GDPR, and the task or function has a clear basis in law. The main laws relating to Environmental Health are (this list is not exhaustive):

• Food Safety Act 1990
• Health and Safety at Work, etc Act 1974
• Public Health etc. (Scotland) Act 2008
• Environmental Protection Act 1990
• Civic Government (Scotland) Act 1982
• Housing (Scotland) Act 1987

A full list of Environmental Health legislation is available on request.

Special category data

For some activities, we also need to process more sensitive personal information about you known as special category data, for example health information. Processing is necessary for reasons of substantial public interest as set out in Article 9(2) (g) of the GDPR and meets a condition in Part 2 of Schedule 1 of the Data Protection Act 2018.

Law Enforcement processing

When we are undertaking an investigation we are processing personal information under part three of the Data Protection Act 2018 which sets out the requirements for the processing of personal data for 'law enforcement purposes' (LEP). The six law enforcement principles are broadly the same as those in the GDPR, and are compatible across the two regimes.

Data subjects rights are similar to those found in the GDPR, however, the transparency requirements are not as strict, due to the potential to prejudice an ongoing investigation in certain circumstances.

When processing sensitive data (under the DPA) we must be able to demonstrate that the processing is strictly necessary and satisfy one of the conditions in Schedule 8 of the DPA or is based on consent.

Body Worn Personal Video Badge Cameras (Bodycams)

We will only collect the minimum amount of personal information we need to protect staff or where appropriate record evidence where an offence is suspected. The personal data we will collect includes:

• Video recording
• Audio recording
• Motor vehicle registration numbers

Body worn cameras may capture more sensitive information about individuals, including health details, race or ethnic origin and criminal behaviour.

How will we use your information collect by Bodycams?

The cameras will only be activated when there is a perceived threat to staff, to record evidence where we suspect an offence may be being committed or if there is a suspected breach of Health and Safety. You will be informed by the operator that the cameras are being activated.

The footage will be:

• use as evidence of harassment or abuse against our staff
• prevent or detect crime
• use as part of an investigation to take enforcement action in line with the regulatory areas we enforce (where necessary)

However, if an allegation of misconduct is made against a staff member, footage may be used in the investigation to provide a true and fair assessment of events

What is the legal basis for using/sharing your information captured by Bodycams?

The legal basis for processing this data is either to comply with our legal obligations under the Health and Safety at Work Act 1974 as per Article 6(1) (c) of the GDPR, or the processing is necessary for the performance of a task carried out in the public interest by the Council.

Local authorities such as South Ayrshire Council are authorised to employ the use of video recording to promote the prevention of crime or the welfare of victims of crime. This power is contained in section 163 of the Criminal Justice and Public Order Act 1994.

As stated, recordings may capture more sensitive information about people. We also need to process this more sensitive personal information about you for reasons of substantial public interest as set out in the Data Protection Act 2018. It is necessary for us to process it to carry out key functions as set out in law.

Who will we share your information with?

The Council has a duty to protect public health and to prevent or detect fraud or crime therefore we may share your information with other Council services, local authorities or national regulators and bodies:

• NHS Ayrshire & Arran
• Health Protection Scotland
• Food Standards Scotland
• Health and Safety Executive
• Police Scotland
• Fire Scotland
• Crown Office and Procurator Fiscal Service
• Drinking Water Quality Regulator
• Scottish Environmental Protection Agency
• Scottish Government
• HMRC
• UK Border Agency
• Department of Environment, Food and Agriculture
• Animal and Planning Health Agency
• Council Services, e.g. Housing, Building Standards, Planning, Licensing, Waste Management, Social Work
• Our insurers
• Third party insurers
• Other enforcement agencies

How long do we keep hold of your information?

We keep your personal data for no longer than reasonably necessary. Your information will be retained in line with our Corporate Records Retention Schedule as follows:

View South Ayrshire Council's full Records Retention Schedule.

What are your rights?

The lawful basis for processing/using your personal data directly impacts which rights are available to you. For example, some rights will not apply, if we are processing your data under public task (Article 6 (1) (e)) we are not required to:

• Erase your personal information in certain circumstances.
• Enable the right to data portability

However, you do have the following rights and can ask us to:

• Correct your personal information if it is inaccurate;
• Complete your personal information if it is incomplete;
• Restrict the processing of your personal information in certain circumstances; and

You also have the right to object to the processing of your personal information.

What are the consequences of failing to provide personal information?

Where the provision of your information to the Council is a statutory or contractual requirement, or a requirement necessary to enter into a contract, you are obliged to provide the information.

In relation to the investigation of food safety, licensing, communicable disease, public health, environmental protection and pest control matters it is a legal offence to withhold information or obstruct an officer in their duties. Withholding or obstructing an officer in his duties may result in a report being submitted to the Crown Office and Procurator Fiscal Service for the instigation of a criminal prosecution.

What about Automated Decision- Making?

The Council does not use profiling or automated decision-making. Some processes are semi-automated (such as data matching for the prevention or detection of fraud), but an actual person will always be involved before any decision is reached affecting any individual.

Do you require this statement in a different format?

Please contact us if you require this information in an alternative format.

How can you get in touch with us?

If you wish to obtain any records held by the Council relating to you, or if you have any general data protection queries, please contact the Council's Data Protection Service at:

Data Protection Officer
South Ayrshire Council
County Buildings
Wellington Square
Ayr
KA7 1DR

Email: DataProtection@south-ayrshire.gov.uk
Telephone: 01292 612 223

If you have a complaint

If you are unhappy with the way the Council has dealt with your personal information, you can complain to the Data Protection Officer using the contact details noted above. If you remain dissatisfied, you have the right to complain to the Information Commissioner:

Information Commissioner's Office
45 Melville Street
Edinburgh
EH3 7HL

Email: scotland@ico.org.uk
Telephone: 0303 123 1113

If you have no internet access

Please contact us at the above postal address or telephone number if you wish to have copies of any of the above information and you do not have access to the internet. We will endeavour to let you have hard copies of the information.