Portsmouth City Council corporate privacy notice

Portsmouth City Council (“the Council”, “we”, “us”) is the data controller for the personal information described in this notice. We are registered with the Information Commissioner’s Office (ICO).

• What personal information we collect
• Why we use it and our lawful bases
• Who we share it with
• How long we keep it
• How we keep it secure
• Your rights and how to contact us

This is a corporate (general) notice. Many Council services also publish service-specific privacy notices that provide additional detail for particular services.

• Data Controller: Portsmouth City Council (Registration Number Z5578313)
• Address: Civic Offices, Portsmouth, PO1 2AL
• Data Protection Officer (DPO) Email: DataProtection@portsmouthcc.gov.uk
• Telephone: 023 9282 2251

If you have questions about this notice, or want to exercise your rights, contact the DPO using the details above.

This notice applies to personal information in accordance with data protection law. It covers information we collect and process about:

• People who use our services or request a service from us
• People who register for council tax
• People who apply for a grant, planning permission, parking permit, or school place
• Business customers
• Complainants and other individuals in relation to a complaint or query
• Job applicants and our current and former employees
• Visitors to our websites

• Identity and contact details (name, address, email, telephone)
• Household and family information (where relevant)
• Financial information (payments, benefits, grants, council tax, invoices)
• Identifiers and records related to service requests, applications, and case management
• Communications with us (emails, webforms, letters, call recordings)
• Online identifiers and website usage data (cookies)
• Employment and recruitment information (applications, references, employment records)
• Images and video (e.g., CCTV)

Special Category and Criminal Offence Data: Some Council services process “special category” personal data (e.g., health or social care information) and/or criminal offence data. We only process this information where the law allows and with appropriate safeguards.

• Directly from you (forms, telephone, email, in-person, online accounts)
• From other Council services
• From partner organizations (e.g., NHS bodies, police, government departments)
• From publicly available sources (where relevant and lawful)

• Deliver services and support to residents and businesses
• Investigate and respond to concerns, queries, and complaints
• Plan and manage council services and spending
• Carry out regulatory, licensing, and enforcement functions
• Process payments, grants, benefits, and other financial transactions
• Verify identity and entitlement
• Carry out research, consultation, and statistical analysis
• Meet statutory obligations, including safeguarding

Lawful Bases under UK GDPR

Most Council services are carried out under the lawful bases of public task and legal obligation. Consent is used only in limited circumstances, such as optional subscriptions and certain cookies. Where consent is relied upon, this will be made clear at the point personal data is collected.

Special Category Data (Article 9 UK GDPR)

• Substantial public interest
• Health or social care purposes
• Public health
• Employment and social protection law
• Archiving, research, and consultation

Information about joint commissioning arrangements between Portsmouth City Council and Hampshire and Isle of Wight Integrated Care Board, including how personal data is shared and the controller roles.

Details are held for people who request or receive services to provide those services and manage related processes. Information is also used for research, planning, statistical purposes, and measuring service quality.

Telephone calls may be recorded for staff training, record keeping, and crime prevention. Notification of call recording will be provided. Services include Next Generation Text Services (NGT Lite) and third-party telephone interpretation.

Emails and attachments may be monitored for security and compliance. Monitoring, blocking, and filtering software may be used. Secure email services and online forms are provided for sending personal data.

The Council uses Granicus govDelivery to manage email subscriptions. Email addresses are only used for providing the service and will not be passed on for promotional purposes. Subscribers can choose topics and unsubscribe at any time.

Read the Granicus Privacy Shield statement online.

Social media is used to publish Council news, receive feedback, and interact with residents. Information provided via social media is also subject to the privacy policies of the service providers.

Complaints generate a file containing details of the issue and individuals involved. Information is used to investigate, respond, and improve services. Identity may be disclosed if necessary. Complaint records are kept for up to 7 years.

Information supplied by job applicants is used for recruitment and monitoring statistics. References and DBS checks are conducted where relevant. Unsuccessful candidate information is held for 6 months; employment records are managed according to the retention schedule.

Website visitors’ technical and usage information is collected if analytical cookies are accepted. Data is used for website improvement and is processed to prevent identification. Google Analytics is used for analysis.

Read our Cookies Policy.

• Within the Council to coordinate services
• Organizations that provide services on our behalf
• Partner organizations (NHS bodies, police, emergency services, public authorities)
• Government departments and agencies
• Courts and tribunals

No personal data is shared for marketing by third parties. Information sharing agreements are used where appropriate.

Suppliers who process personal data on behalf of the Council act only on instructions, keep information secure, assist with data protection obligations, and delete or return information at the end of service.

Where personal data is transferred outside the UK, appropriate safeguards are in place in line with UK GDPR.

Personal data is only kept as long as necessary for its purpose, in line with our corporate retention schedule.

Technical and organizational measures are used to protect personal information, including access controls, staff training, secure storage, and contractual controls with suppliers.

• Access (subject access request)
• Rectification
• Erasure (in limited circumstances)
• Restriction
• Objection
• Data portability (in limited circumstances)
• Rights related to automated decision-making and profiling

Right to object: You have the right to object to processing carried out under public task or legitimate interests, in certain circumstances. You can exercise this right by contacting the Data Protection Officer.

Where consent is relied on, you can withdraw it at any time. Automated decisions are not generally made; if they are, you will be informed.

Requests for information can be made in writing or by other means. We may ask for further information to help us locate your records and confirm your identity. Forms and identification may be required. Corrections to records can be requested. Access to CCTV images is available via subject access request.

Request forms are available to print and complete:

• For access to Children’s Social Care records, please complete the Access to personal records form.
• For access to Adult Social Care records, please refer to the privacy statement for Adult Social Care which explains how you can access your personal information.
• For access to records relating to any other service, please complete the Data subject access request form.

If you are unhappy with how your information is used, contact the Data Protection Officer or the Information Commissioner’s Office (ICO).

The Council’s website may contain links to other websites. This privacy notice does not cover those sites. Please read the privacy statements on any websites you visit.

Data Protection Officer
Portsmouth City Council
Civic Offices,
Portsmouth,
PO1 2AL

Email: DataProtection@portsmouthcc.gov.uk

Telephone: 023 9282 2251

Additional privacy notices apply to council services: View all service specific privacy notices.