Data protection policy

Personal data will be lawfully processed by the Council at all times. There are six ways in which lawful processing can occur, however only five of these are available to the Council as a public authority in the performance of their public tasks.

The ways of lawful processing under Article 6(1) UK GDPR are:

1. the data subject consents to the processing for one or more specific purpose
2. in the performance of a contract to which the data subject is a party
3. in compliance with a legal obligation
4. it is necessary to protect the vital interests of the data subject
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of the official authority vested in the controller
6. processing is necessary for the purposes of the legitimate interests pursued by the controller of by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child

When Great Yarmouth Borough Council exercises its official obligation to provide services, the lawful ground generally used will be Article 6(1)(e).

Consent

The Council hereby acknowledges the Regulator's guidance on Consent which identifies that public authorities will rarely be able to use consent as their lawful processing ground. However, where consent is the lawful processing ground used this will be:

• clearly identified and sought in a transparent, plain and clear manner ensuring compliance with the ICO's guidance
• able to put individuals in control of their data, build trust and engagement and maintain the Council's high-standards.
• important in providing genuine choice and control. It will be an affirmative action and will not be deemed or gathered by pre-ticked or opt-out boxes
• as easy to withdraw as it was to provide consent; we will clearly explain how consent can be withdrawn and continue to do so in future interactions
• reviewed and refreshed regularly
• acted upon, ensuring that appropriate action is taken to prevent further processing where consent is withdrawn