Trading Standards privacy notice

As the 'data controller' for the personal information - or data - we hold about you, South Ayrshire Council decides how your personal information is used/processed, and what it is used for.

This statement provides more details about how Trading Standards uses your personal data and provides information on how to get in touch with us if you need to know more.

Your personal data - what is it?

Personal data is information relating to a living person who can be identified from that data. Identification can be based on the information alone, or in conjunction with any other information. The processing of personal data is governed by the General Data Protection Regulation 2016 (GDPR) and supplemented by the Data Protection Act 2018.

What Personal Data will we collect from you?

We will only collect the personal information we need to provide you with relevant information, services and support or to progress investigations and enquiries. The personal data we will collect includes:

•  Name
•  Date and place of birth
•  Address
•  Land line telephone number
•  Mobile telephone number
•  Email
•  Gender
•  Health conditions (including disability)
•  Criminal convictions

How will we use your information?

We use your personal information to provide advice and guidance, conduct investigations and ensure compliance with the relevant laws. This includes:

•  Receiving and investigating consumer complaints
•  Responding to service requests from businesses and individuals
•  Monitoring, researching, analysing and reporting intelligence requirements
•  Ensuring compliance with legislation through a range of enforcement activities including visits, inspections and testing
•  Conducting investigations and enquiries into criminal offences and civil law breaches
•  Operating assurance schemes for businesses and referral agencies
•  Managing registration, certification and licensing.

What is the legal basis for using/sharing your information?

Under Article 6(1) (e) of the GDPR, the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. The main laws relating to Trading Standards are (this list is not exhaustive):

• The Consumer Rights Act 2015
•  The Enterprise Act 2002
•  The Weights and Measure Act 1985
•  A full list of Trading Standards legislation is available on request.

For some activities, we also need to process more sensitive personal information about you known as special category data, for example health information. Processing is necessary for reasons of substantial public interest as set out in Article 9(2) (g) of the GDPR and meets a condition in Part 2 of Schedule 1 of the Data Protection Act 2018.

Law Enforcement processing

When we are undertaking an investigation we are processing personal information under part three of the Data Protection Act 2018 which sets out the requirements for the processing of personal data for 'law enforcement purposes' (LEP).

The six law enforcement principles are broadly the same as those in the GDPR, and are compatible across the two regimes. Data subjects rights are similar to those found in the GDPR, however, the transparency requirements are not as strict, due to the potential to prejudice an ongoing investigation in certain circumstances.

When processing sensitive data (under the DPA) we must be able to demonstrate that the processing is strictly necessary and satisfies one of the conditions in Schedule 8 of the DPA or is based on consent.

Body Worn Personal Video Badge Cameras (Bodycams)

We will only collect the minimum amount of personal information we need to protect staff or where appropriate record evidence where an offence is suspected. The personal data we will collect includes:

• Video recording
• Audio recording
• Motor vehicle registration numbers

Body worn cameras may capture more sensitive information about individuals, including health details, race or ethnic origin and criminal behaviour.

How will we use your information collect by Bodycams?

The cameras will only be activated when there is a perceived threat to staff, to record evidence where we suspect an offence may be being committed or if there is a suspected breach of Health and Safety. You will be informed by the operator that the cameras are being activated.
The footage will be:

• use as evidence of harassment or abuse against our staff
• prevent or detect crime
• use as part of an investigation to take enforcement action in line with the regulatory areas we enforce (where necessary)

However, if an allegation of misconduct is made against a staff member, footage may be used in the investigation to provide a true and fair assessment of events

What is the legal basis for using/sharing your information captured by Bodycams?

The legal basis for processing this data is either to comply with our legal obligations under the Health and Safety at Work Act 1974 as per Article 6(1) (c) of the GDPR, or the processing is necessary for the performance of a task carried out in the public interest by the Council.

Local authorities such as South Ayrshire Council are authorised to employ the use of video recording to promote the prevention of crime or the welfare of victims of crime. This power is contained in section 163 of the Criminal Justice and Public Order Act 1994.

As stated, recordings may capture more sensitive information about people. We also need to process this more sensitive personal information about you for reasons of substantial public interest as set out in the Data Protection Act 2018. It is necessary for us to process it to carry out key functions as set out in law.

Who will we share your information with?

To assist with a resolution of the issue you told us about or to fulfil our Council and Trading Standards duties we will share information with:

•  any business,
•  trade association,
•  government department,
•  Council department,
•  other local authority or
•  other organisation
•  Our Insures
•  Third party insurers

When we are obliged to carry out our statutory duties/obligations and to ensure compliance with the law and legislation, for public safety interests and the prevention and detection of crime we will when considered necessary, share information and intelligence with:

•  Police
•  Other enforcement agencies
•  Local authorities
•  Members of the public

How long do we keep hold of your information?

Your information will be retained in line with our Corporate Records Retention Schedule. At present we will keep it for the current year plus five years unless there is a prescribed retention period for this information:

South Ayrshire Council's full Records Retention Schedule can be accessed here
https://www.southayrshire.gov.uk/documents/doc%2020170329%20scarrs%20schedule%20v2.0.pdf

What are your rights?

The lawful basis for processing/using your personal data directly impacts which rights are available to you. For example, some rights will not apply, if we are processing your data under public task (article 6 (1) (e)) we are not required to:

•  erase your personal information.
•  enable the right to data portability

However, you do have the following rights and can ask us to:

•  correct your personal information if it is inaccurate;
•  complete your personal information if it is incomplete;
•  restrict the processing of your personal information in certain circumstances

You also have the right to access your personal information.

However, the above rights do not apply to the processing of relevant personal information in the course of criminal investigation or proceedings.

What are the consequences of failing to provide personal information?

Where the provision of your information to the Council is a statutory requirement you are obliged to provide the information.

In other circumstances this may mean that we cannot provide a service for you.

What about Automated Decision-Making?

The Council does not use profiling or automated decision-making. Some processes are semi-automated (such as data matching for the prevention or detection of fraud), but an actual person will always be involved before any decision is reached affecting any individual.

Do you require this statement in a different format?

Please contact us if you require this information in an alternative format.

How can you get in touch with us?

If you wish to obtain any records held by the Council relating to you, or if you have any general data protection queries, please contact the Council's Data Protection Service at:

Data Protection Officer
South Ayrshire Council
County Buildings
Wellington Square
Ayr
KA7 1DR
Email: DataProtection@south-ayrshire.gov.uk
Telephone: 01292 612 223