Privacy

Privacy notice for councillor correspondence

Members at Devon County Council (DCC) may be given personal data about their local constituents during the course of their regular constituency correspondence. In such circumstances, the local member will be processing this personal data in their capacity as a controller under data protection legislation.

There may be occasions where a local member may have to share the information that they have been given by their constituents, with Devon County Council officers for the purposes of helping them to respond to the query they have received. In such circumstances Devon County Council will process this personal data via our Members Portal in our capacity as a Controller under Data Protection Legislation. The council’s ICO registration number is Z6475582.

This privacy notice concerns the processing of any personal data that is handled by DCC and our members for the purposes of responding to enquiries to our local Members.

This notice explains what information we collect, why we collect it and how we keep it secure. It also explains your rights and our legal obligation. Should you wish to find out more about Devon County Council’s data protection policies please contact our Data Protection Officer.

We will notify you of any changes to this privacy notice

This privacy notice was last updated 24/04/2025. If we use your personal data for any new purposes, updates will be made to the policy information and changes communicated, where necessary in accordance with current data protection legislation. Any queries relating to this privacy notice please contact the Data Protection Officer.

What information are we processing?

When constituents ask for their Councillor’s help with something, the Councillor will need to collect some information from them. This will generally include personal data such as;

  • Name
  • Address
  • Contact information
  • Details of the problem or concern

The Councillor may also require personal information known as ‘special category’ information. This data requires more protection due to its sensitivity. This information consists of racial or ethnic origin, sexual orientation and sexual life, religious or philosophical beliefs, trade union membership, political opinions, genetic data, bio-metric data, physical or mental health and criminal convictions and offences.
It will only be necessary for Councillors to collect this type of information where it is of relevance to the request the constituent is making.

Purpose of collecting or processing your personal data

Councillors may collect and share personal data provided to them for the purposes of responding to their constituents. At times local Councillors may require support from officers within the council. In such cases, the member may share information about their constituents with the council via our Member Portal.

The legal basis for us collecting your personal data

The legal basis a Councillor will primarily rely on for processing the personal information when dealing with requests from constituents could be one of the following:

  • consent or explicit consent;
  • necessary in pursuit of their legitimate interests as an elected representative and those of constituents (and where it is assessed these interests override any privacy intrusion involved in processing personal data about other individuals), or
  • in their performance of a public task as an elected representative for the purpose of responding to requests from you where this is permissible

The Councillor may also lawfully process a constituent’s data where:

  • it is in the vital interests of a data subject or of another natural person (where processing of the personal data is done to protect someone’s life)
  • if the Councillor needs to process your special category data, to assist you, the legal basis the Councillor will rely on is substantial public interest

If a Councillor provides personal data about a constituent to DCC for the purposes of helping them to respond to the matter raised by a constituent, DCC relies upon the following:

  • the processing is necessary in pursuit of their legitimate interests as an elected representative and those of constituents (and where it is assessed these interests override any privacy intrusion involved in processing personal data about other individuals), or
  • the processing is in their performance of a public task as an elected representative for the purpose of responding to requests from you where this is permissible

Recipients or categories of recipients that we may share your personal data with

Councillors may need to pass on a constituent’s personal details and the circumstances of their query/complaint to Council officers to allow the Council to look into the issue.

If you have contacted your Councillor about a personal or policy issue, your personal data may be passed on to a 3rd party in the course of dealing with your request or query, such as other local authorities, government agencies, public bodies, health trusts and regulators. They may also need to share your information with the other Councillors in the electoral ward so that they are aware that the matter you have raised is being dealt with.

Any third parties with whom data is shared are obliged to keep these details securely, and to only use the data for purposes already communicated.

In any event, Councillors will not use constituents’ personal data in a way that goes beyond reasonable expectations.

Constituents can specifically ask their Councillor to not disclose information identifying them to other third parties However, please be aware that it may not be possible to progress a matter for you on an anonymous basis.

Councillors will never sell constituent’s data onto third parties.

International transfers

Neither DCC nor its Councillors intend to transfer personal data provided for the purposes of a Councillor enquiry, to countries outside of the scope of UK data protection laws. However, if such a transfer should become necessary at some point, we will ensure that one or more of the following safeguards are put in place;

  • The country that data is being transferred to is the subject of an adequacy decision
  • A legally binding and enforceable instrument between public authorities or bodies is in place with the body receiving this information
  • Binding corporate rules are put in place in accordance with Article 47
  • Standard data protection clauses adopted ICO in accordance with the examination procedure referred to in Article 93(2) of the UK GDPR
  • Standard data protection clauses adopted by the ICO pursuant to the examination procedure referred to in Article 93(2) of the UK GDPR
  • An approved code of conduct pursuant to Article 40 of the UK GDPR is in place together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights; or
  • An approved certification mechanism pursuant to Article 42 of the UK GDPR is in place together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights.

How long will we hold your personal data?

Councillors will process personal data until the issue is resolved and store electronic data and paper records for a minimum of 4 years. This is to allow for a build-up of case histories and to be able to return to records when further matters arise.

If personal data is shared with DCC this information will be stored in the DCC Members Portal and will be stored in identifiable form for 4 years, after which identifying personal data will be removed. A record of correspondence may be retained after 4 years for reporting purposes.

Your data protection rights

Under Data Protection Legislation, you have the right to obtain a copy of their personal records held by us, this is called a Subject Access Request (SAR).

Details of how to make a request can be found here.

Further details on your rights under data protection legislation and how to exercise them, are available here.

Complaints

If you have any comments, queries or complaints about this privacy notice or the processing of your personal data please contact our Data Protection Officer.  If you after complaining to DCC you remain dissatisfied with the response you have received, you have the right to refer a complaint to the Information Commissioner’s Office (ICO).  Details of how to make a complaint to the ICO are available from their website at https://ico.org.uk/make-a-complaint/data-protection-complaints/.

Automated decisions

Devon County Council does not propose to make automated decisions using your personal data for any of the purposes outlined in this notice.