PITSTONE PARISH COUNCIL

9 Warwick Road, Pitstone, Beds, LU7 9FE
Tel: 01296 767261.  Email: parishclerk@pitstone.co.uk
Facebook: “Pitstone Parish Council” and “Pitstone Youth”
Twitter: @pitstone_pc    Web: www.pitstone.co.uk
______________________________________________________________________________

Information & Data Protection Policy

Introduction

In order to conduct its business, services and duties, Pitstone Parish Council processes a wide range of data, relating to its own operations and some which it handles on behalf of partners. In broad terms, this data can be classified as:

•	Data shared in the public arena about the services it offers, its mode of operations and other information it is required to make available to the public.
•	Confidential information and data not yet in the public arena such as ideas or policies that are being worked up.
•	Confidential information about other organisations because of commercial sensitivity.
•	Personal data concerning its current, past and potential employees, Councillors, and volunteers. 
•	Personal data concerning individuals who contact it for information, to access its services or facilities or to make a complaint.

Pitstone Parish Council will adopt procedures and manage responsibly, all data which it handles and will respect the confidentiality of both its own data and that belonging to partner organisations it works with and members of the public. In some cases, it will have contractual obligations towards confidential data, but in addition will have specific legal responsibilities for personal and sensitive information under data protection legislation.  Parish Councils are subject to the Data Protection Act 2018, the Freedom of Information Act 2000 and the Environmental Information Regulations 2004 and complies with the requirements of this legislation.

The Parish Council will periodically review and revise this policy in the light of experience, comments from data subjects and guidance from the Information Commissioners Office.

The Council will be as transparent as possible about its operations and will work closely with public, community and voluntary organisations. Therefore, in the case of all information which is not personal or confidential, it will be prepared to make it available to partners and members of the community. Details of information which is routinely available is contained in the Council’s Publication Scheme which is based on the statutory model publication scheme for local councils.   
Many requests for information can be dealt with in the ordinary course of business and do not need to be processed under the above legislation.  If the information can be provided immediately, or can be made available routinely, then we will do this.  Please check on the website first to see if the information is available before making any request.  It is also worth looking at the Information Commissioners website at www.ico.org.uk which has guidance for the public on making requests.

Protecting Confidential or Sensitive Information

Pitstone Parish Council recognises it must at times, keep and process sensitive and personal information about both employees and the public, it has therefore adopted this policy not only to meet its legal obligations but to ensure high standards. 

The General Data Protection Regulation (GDPR) which became law on 25th May 2018 and like the Data Protection Act 1998 before them, seek to strike a balance between the rights of individuals and the sometimes, competing interests of those such as the Parish Council with legitimate reasons for using personal information.

The policy is based on the premise that Personal Data must be: 

• 	Processed fairly, lawfully and in a transparent manner in relation to the data subject. 
• 	Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. 
• 	Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. 
• 	Accurate and, where necessary, kept up to date. 
• 	Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. 
• 	Processed in a manner that ensures appropriate security of the personal data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Data Protection Terminology 

Data subject - means the person whose personal data is being processed. 
That may be an employee, prospective employee, associate or prospective associate of Pitstone Parish Council or someone transacting with it in some way, or an employee, Member or volunteer, resident, or persons transacting or contracting with one of our associated groups when we process data for them. 

Personal data - means any information relating to a natural person or data subject that can be used directly or indirectly to identify the person. 
It can be anything from a name, a photo, and an address, date of birth, an email address, bank details, and posts on social networking sites or a computer IP address. 

Sensitive personal data - includes information about racial or ethnic origin, political opinions, and religious or other beliefs, trade union membership, medical information, sexual orientation, genetic and biometric data or information related to offences or alleged offences where it is used to uniquely identify an individual.
 
Data controller - means a person who (either alone or jointly or in common with other persons) (e.g.  Town Council, employer, council) determines the purposes for which and the manner in which any personal data is to be processed. 

Data processor - in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller.

Processing information or data - means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including: 
• organising, adapting or altering it 
• retrieving, consulting or using the information or data 
• disclosing the information or data by transmission, dissemination or otherwise making it available 
• aligning, combining, blocking, erasing or destroying the information or data. regardless of the
   Technology used. 

Pitstone Parish Council processes personal data in order to:

•	fulfil its duties as an employer by complying with the terms of contracts of employment, safeguarding the employee and maintaining information required by law.
•	pursue the legitimate interests of its business and its duties as a public body, by fulfilling contractual terms with other organisations, and maintaining information required by law.
•	monitor its activities including the equality and diversity of its activities
•	fulfil its duties in operating the business premises including security
•	assist regulatory and law enforcement agencies
•	process information including the recording and updating details about its Councillors, employees, partners and volunteers. 
•	process information including the recording and updating details about individuals who contact it for information, or to access a service, or make a complaint.
•	undertake surveys, censuses and questionnaires to fulfil the objectives and purposes of the Council.
•	undertake research, audit and quality improvement work to fulfil its objects and purposes.
•	carry out Council administration.

Where appropriate and governed by necessary safeguards we will carry out the above processing jointly with other appropriate bodies from time to time.

The Council will ensure that at least one of the following conditions is met for personal information to be considered fairly processed:

•	The individual has consented to the processing
•	Processing is necessary for the performance of a contract or agreement with the individual
•	Processing is required under a legal obligation
•	Processing is necessary to protect the vital interests of the individual
•	Processing is necessary to carry out public functions
•	Processing is necessary in order to pursue the legitimate interests of the data controller or third parties.

Particular attention is paid to the processing of any sensitive personal information and the Parish Council will ensure that at least one of the following conditions is met:

•	Explicit consent of the individual
•	Required by law to process the data for employment purposes
•	A requirement in order to protect the vital interests of the individual or another person

Who is responsible for protecting a person’s personal data? 

The Parish Council as a corporate body has ultimate responsibility for ensuring compliance with the Data Protection legislation. The Council has delegated this responsibility day to day to the Parish Clerk.
•	Email: parishclerk@pitstone.co.uk
•	Phone: 01296 767261
•	Correspondence: The Parish Clerk, 9 Warwick Road, Pitstone, Beds, LU7 9FE

Information provided to us

The information provided (personal information such as name, address, email address, phone number) will be processed and stored so that it is possible for us to contact, respond to or conduct the transaction requested by the individual.  By transacting with Pitstone Parish Council, individuals are deemed to be giving consent for their personal data provided to be used and transferred in accordance with this policy, however wherever possible specific written consent will be sought. It is the responsibility of those individuals to ensure that the Parish Council is able to keep their personal data accurate and up to date. The personal information will be not shared or provided to any other third party or be used for any purpose other than that for which it was provided.

The Councils Right to Process Information 

General Data Protection Regulations (and Data Protection Act) Article 6 (1) (a) (b) and (e)
Processing is with consent of the data subject, or Processing is necessary for compliance with a legal obligation.
Processing is necessary for the legitimate interests of the Council.

Information Security

The Parish Council cares to ensure the security of personal data. We make sure that your information is protected from unauthorised access, loss, manipulation, falsification, destruction or unauthorised disclosure. This is done through appropriate technical measures and appropriate policies. 
We will only keep your data for the purpose it was collected for and only for as long as is necessary, after which it will be deleted.

Children

We will not process any data relating to a child (under 13) without the express parental/guardian consent of the child concerned. 

Rights of a Data Subject
 
•	Access to Information: an individual has the right to request access to the information we have on them. They can do this by contacting our Parish Clerk.

•	Information Correction: If they believe that the information, we have about them is incorrect, they may contact us so that we can update it and keep their data accurate. Please contact our Parish Clerk.

•	Information Deletion: If the individual wishes the Parish Council to delete the information about them, they can do so by contacting the Parish Clerk. 

•	Right to Object: If an individual believes their data is not being processed for the purpose it has been collected for, they may object by contacting the Parish Clerk. 

•	The Council does not use automated decision making or profiling of individual personal data.

•	Complaints: If an individual has a complaint regarding the way their personal data has been processed, they may make a complaint to the Parish Clerk, or the Information Commissioners Office casework@ico.org.uk Tel: 0303 123 1113.

•	The Council will always give guidance on personnel data to employees through the Employee handbook.

•	The Council will ensure that individuals on whom personal information is kept are aware of their rights and have easy access to that information on request.

Making Information Available & Our Publication Scheme

The Publication Scheme is a means by which the Council can make a significant amount of information available routinely, without waiting for someone to specifically request it.  The scheme is intended to encourage local people to take an interest in the work of the Council and its role within the community. 
In accordance with the provisions of the Freedom of Information Act 2000, this Scheme specifies the classes of information which the Council publishes or intends to publish. It is supplemented with an Information Guide which will give greater detail of what the Council will make available and hopefully make it easier for people to access it.  This includes policies and procedures, minutes of meetings, annual reports and financial information.  This information is easily and quickly available.

What you can expect if you make a request to the Parish Council under the various legislation

Data Protection Act 2018
If the information you seek isn’t available and you make a request under the Data Protection Act, we will acknowledge receipt of the request for personal information as soon as possible.  We will provide a written response as soon as possible and, in any event, within one month of the receipt of the request.  The time period starts from the day after the request is received to the corresponding calendar date in the next month.   If the following month is shorter it is the last day of the following month.  If a corresponding day is a weekend or public holiday it is the next working day.
This period can be extended by a further two months for complex or numerous requests.
You have the right to be:
•	Told whether any personal data is being processed – so, if we hold no personal data about you, we must still let you know this;
•	Given a description of the personal data, the reasons it is being processed and whether it will be given to any other organisation or people; and
•	Given details of the source of data (if known).
Under the terms of the Data Protection Act 2018, we will provide you wish a statement or copies of data if:
•	It is ‘personal data’ as defined in the Data Protection Act 2018;
•	It is not exempt from disclosure (possible exemptions include (this list is not exhaustive) references given (not received), publicly available information, management information (such as restructuring or possible redundancies), negotiations with the requestor, legal advice & proceedings and third-party data);
•	We have been able to verify your identity; and
•	You have not repeatedly requested the information in a short space of time. The Data Protection Act 2018 allows some discretion when dealing with requests that are made at unreasonable intervals.  It says we are not obliged to comply with an identical or similar request to one that we have already dealt with, unless a reasonable interval has lapsed between the first request and any subsequent ones.  Although there is no statutory definition of a reasonable interval as it depends on factors such as how often the data is updated, we will generally consider a reasonable interval to be within the last 3 months.  A search of previous requests will be made to ensure that this is not a similar request to one made previously.  Legal advice will be sought if a request is to be refused.  The Data Protection Act 2018 also provides for refusing based on ‘manifestly unfounded or excessive’ requests (section 53).  The question is whether supplying a copy of the requested information in permanent form would result in so much work or expense as to outweigh the requester’s right of access to their personal data.
Freedom of Information Act 2000 (FOI)
We will respond to an FOI request in 20 working days counting the first working day after the request is received as the first working day.  An FOI request can be made by anyone, from anywhere, for any purpose.  It must be in writing and there must be a return address to send the information to.  We will confirm or deny whether we hold the information within 20 days.  If we do not hold the information we will explain why not.  We will let you know if we need longer than 20 days to apply the public interest test and we will tell you at that point what exemptions we are looking at and how long we think we need.  If we do need more time to apply the public interest test this will be up to a maximum of a further 20 working days so the total time will be a maximum of 40 working days.
We may refuse a request if we consider that:
•	It is vexatious (designed to cause disruption or annoyance rather than having a serious purpose)
•	To comply would exceed the statutory cost limit (£450 with staff time charged at £25 per hour which is the statutory rate).  If we believe it will exceed the cost limit, we will issue a refusal notice and invite the applicant, if possible, to revise the request to make it less expensive.
•	If it falls within an exemption under the legislation.  All except Section 21 are qualified exemptions requiring the application of the public interest test.  This means weighing up whether the public interest is best served by disclosing the information, or not disclosing it.  The most common exemptions are:
o	Section 21 – information reasonably accessible to the applicant by other means.  There is a duty to confirm or deny whether we hold it and to tell the requestor where they can find it.  This is an absolute exemption which means the public interest test does not need to be applied.
o	Section 22 – information intended for future publication.  This means it is in draft, still being worked on but when completed, or approved, it will be published.  The public interest test must be applied here.
o	Section 31 – prejudicial to law enforcement (preventing crime, collecting tax).
o	Section 36 – prejudicial to the effective conduct of public affairs.
o	Section 40 – personal data.
o	Section 42 – legal professional privilege.
o	Section 43 – commercial sensitivity.
We can charge for photocopying and disbursements and can request these fees in advance by issuing a fee notice within 20 working days of receipt of the request.  When the fees notice is issued the time limit for responding stops.  If we do not receive the fee within 3 months we are not obliged to comply with the request.
We can seek clarification about what is being requested.  The time limit for responding stops whilst we wait for a response to our request for clarification.
Environmental Information Regulations 2004 (EIR)
Environmental information broadly relates to:
•	Air, atmosphere, water, soil, land, landscape, plants, animals, biological diversity and genetically modified organisms;
•	Emissions, discharges, noise, energy, radiation, waste, recycling and pollution;
•	Measures and activities such as policies, plans and agreements;
•	Reports, cost benefit analysis and economic analysis; 
•	The state of human health and safety, contamination of the food chain;
•	Cultural sites and built structures (the effect of the environment on the human world);
•	Planning and development, building control, construction and renovation, floods and flooding issues, land use, traffic, parking, location of mobile phone masts and demolition of buildings.
It covers documents, photos or maps.  There is no distinction between formal approved documents and anything else.  The duty is to make the information available.  This is not the same as the duty to disclose under FOI.
There are 20 working days to respond to the request.  Unlike FOI there is no extension to the time limit for consideration of the public interest test.  A further 20 days is permitted though if the request is complex, or there is a large amount of information involved.  There is no right to charge for inspection.  Cost recovery is permitted provided the reasonable charges are published in advance.
There are exceptions to the requirement to disclose, these exceptions are subject to the public interest test like FOI.  The exceptions are:
•	Personal data;
•	Information not held when the request was made;
•	The request is manifestly unreasonable (similar to ‘vexatious’ under FOI.  The courts have treated both in the same way);
•	The request is too general;
•	Information is in draft or is unfinished;
•	Information is an internal communication;
•	Disclosure would adversely affect the course of justice o commercial confidentiality.
There is a lot of guidance, and case law, on the use of both FOI exemptions and EIR exceptions which can be found on the Information Commissioner’s website at www.ico.org.uk.

Attending our meetings and finding out what happened

All formal meetings of Council and its committees are subject to statutory notice being given on notice boards, our website and social media accounts. The Council publishes an annual programme once the meeting dates have been set, wherever possible. All formal meetings are open to the public and press and reports to those meetings and relevant background papers are available for the public to see. The Council welcomes public participation and has a public participation session on each Council and committee meeting. Details can be seen in the Council’s Standing Orders, which are available on our website.

Occasionally, Council or committees may need to consider matters in private. Examples of this are matters involving personal details of staff, or a particular member of the public, or where details of commercial/contractual sensitivity are to be discussed. This will only happen after a formal resolution has been passed to exclude the press and public and reasons for the decision are stated. Minutes from all formal meetings, including the confidential parts are public documents.

The Openness of Local Government Bodies Regulations 2014 requires written records to be made of certain decisions taken by officers under delegated powers. These are not routine operational and administrative decisions such as giving instructions to the workforce or paying an invoice approved by Council but would include urgent action taken after consultation with the Chairman/Councillors, such as responding to urgent correspondence in advance of Council. In other words, decisions which would have been made by Council or committee had the delegation not been in place.

The 2014 Regulations also amend the Public Bodies (Admission to Meetings) Act 1960 to allow the public or press to film, photograph or make an audio recording of council and committee meetings normally open to the public. The Council will where possible facilitate such recording unless it is being disruptive. It will also take steps to ensure that children, the vulnerable and members of the public who object to being filmed are protected without undermining the broader purpose of the meeting.

The Council will be pleased to make special arrangements on request for persons who do not have English as their first language or those with hearing or sight difficulties. 

Disclosure Information

The Council will as necessary undertake checks on both staff and Members with the the Disclosure and Barring Service and will comply with their Code of Conduct relating to the secure storage, handling, use, retention and disposal of Disclosures and Disclosure Information. It will include an appropriate operating procedure in its integrated quality management system. 

Data Transparency

The Council has resolved to act in accordance with the Code of Recommended Practice for Local Authorities on Data Transparency (September 2011). This sets out the key principles for local authorities in creating greater transparency through the publication of public data and is intended to help them meet obligations of the legislative framework concerning information.

“Public data” means the objective, factual data on which policy decisions are based and on which public services are assessed, or which is collected or generated in the course of public service delivery.

The Code will therefore underpin the Council’s decisions on the release of public data and ensure it is proactive in pursuing higher standards and responding to best practice as it develops.

The principles of the Code are:

•	Demand led: new technologies and publication of data should support transparency and accountability
•	Open: the provision of public data will be integral to the Council’s engagement with residents so that it drives accountability to them.
•	Timely: data will be published as soon as possible following production.

Government has also issued a further Code of Recommended Practice on Transparency, compliance of which is compulsory for parish councils with turnover (gross income or gross expenditure) not exceeding £25,000 per annum. These councils will be exempt from the requirement to have an external audit from April 2017.  Pitstone Parish Council exceeds this turnover but will nevertheless ensure the following information is published on its Website for ease of access:

•	All financial transactions
•	End of year accounts
•	Annual Governance Statements
•	Internal Audit Reports
•	List of Councillor or Member responsibilities
•	Details of public land and building assets
•	Draft minutes of Council and committees within one month
•	Agendas and associated papers no later than three clear days before the meeting.

For full details, please refer to our Guide to Information Available on the website.

Vexatious Requests

Whilst the parish council wishes to be open and transparent and to provide as much information as possible about the work it does there are occasions when it might be necessary to decide that a request is vexatious within the meaning of the legislation.  There have been a number of legal cases which have helped to set out what is meant, legally, by vexatious, and which have confirmed that parish councils have limited resources and that their obligations under the legislation must be proportionate to those resources.

Public Authorities do not have to comply with vexatious requests.  There is no requirement to carry out a public interest test or to confirm or deny whether the requested information is held.

The key question is whether the request is likely to cause a disproportionate or unjustified level of disruption, irritation or distress.  There is no exhaustive list of circumstances.  Every case is unique and judged within the context and history of the specific situation.

Vexatious Indicators:

•	Abusive or aggressive language;
•	Burdon on the authority;
•	Personal grudges;
•	Unreasonable persistence;
•	Unfounded accusations;
•	Intransigence;
•	Frequent/overlapping requests;
•	Deliberate intention to cause annoyance;
•	Scattergun approach;
•	No obvious intent to obtain information;
•	Futile requests.

Process we will follow to determine if a request is vexatious

The parish clerk deals with all requests for information on behalf of the parish council.  If a request is considered to be potentially vexatious the clerk will prepare a summary setting out the context and history of the request.  This summary will be reviewed by the parish council.

The review will consider:

•	The purpose and value of the request;
•	Whether the purpose and value justify the impact on the public authority;
•	The context and history so, for example, if there has been a long and frequent series of requests the most recent request, though not obviously vexatious in itself, will contribute to the aggregated burden.
•	Have there been numerous follow-up enquiries not matter what is supplied?  This will be balanced against how clear our responses have been, has contradictory or inconsistent information been supplied or is a legitimate grievance being pursued?
•	Whether there are alternatives to the vexatious route.  If it is too expensive then section 12 (costs in excess of £450) will be used.  The Information Commissioner permits the total costs for all requests from one person (or several acting in concert) to be aggregated during a period of 60 days so long as they are requests for similar information.
•	Is this a round robin, a ‘fishing’ expedition or part of an orchestrated campaign?
•	None of these specifically make it vexatious but are factors.

Final warning

If having considered all the above, the parish council thinks there is a case for treating the request as vexatious then consideration will be given to a ‘final warning’.  This is a letter, or email, to the person making the request explaining the impact the request(s) are having and asking that their behaviour be moderated.  This ‘final’ warning will not be appropriate in all cases but, if it is possible that the person making the request has not appreciated the impact of what they are doing, then it may assist.

Advice and Assistance

In addition, the parish council may want to ask the person making the request whether advice and assistance would help in clarifying what exactly they wish the organisation to provide.  Again, this may not be appropriate in every circumstance but will be considered.

Report to the parish council

The history of the matter will go forward as part of a report to the parish council setting out the evidence and reasoning behind the recommendation to propose that the request be treated as vexatious.

The decision to declare a request vexatious will be taken by the parish council.  This decision should be taken within 20 working days of receipt of the request but as the parish council meets monthly, this time limit should be achievable in normal circumstances.  In a small parish, it may not be possible for there to be an internal review process once the parish council has reached the decision that the request is vexatious.

Under section 14(1) of the FOI Act the refusal notice will set out our internal review procedure (if one is available) and the right of appeal to the Information Commissioners Office.  However, under section 17(6) if the authority has issued a previous refusal notice for a vexatious request (and it would be unreasonable to provide another one) it is not necessary to do so.  This will be done where the complainant has already been warned that further requests on the same, or similar topics, will not receive any response.

Please note that if a request is found to be vexatious and further requests are received on the same topic no response will be provided.

Review

This Policy was adopted by Pitstone Parish Council on 

..............................................  minute reference ................................................ and will be 

reviewed on at least an annual basis.

Signed on behalf of Pitstone Parish Council by:

__________________________________________
Chairman