City of York Council (CYC) complies with the UK General Data Protection Regulations (UK GDPR) and the Data Protection Act 2018, and is registered with the Information Commissioner’s Office (ICO), reference: Z5809563.
We regularly review this privacy notice, and it was last updated in July 2024.
CYC is committed to ensuring that information is handled in accordance with the principles set out in data protection legislation and guidance from the Information Commissioner’s Office (ICO).
This Privacy Notice explains how and why we process your information, under Part 3 of the Data Protection Act 2018 for law enforcement purposes and the steps we take to keep your information safe.
CYC is the controller for the personal data we process, unless otherwise stated. You can contact the council’s Data Protection Officer at:
West OfficesStation Rise
York
YO1 6GA
Telephone: 01904 554145.
Email: information.governance@york.gov.uk.
You can find more information about the role of the Data Protection Officer in our Data Protection Policy Statement.
This privacy notice should be read in conjunction with other relevant specific privacy notices that are available in our Privacy Notice.
When appropriate we will provide a ‘just in time’ notice to cover any additional processing activities not mentioned in this privacy notice.
- How we collect your information
- What personal data we process and why
- Automated decision-making
- Collecting information automatically
- Children's information
- Lawful basis for processing your personal data
- How long we keep your personal data
- Data sharing
- Data processors and/or third parties
- Transfers of personal data
- How we protect your information
- Your rights in relation to this processing
How we collect your information
We get information about you in a variety of ways dependent upon the level of services that you are accessing such as:
- directly from you
- from other agencies such as schools, health services, police, probation, courts, other councils, and other teams in City of York Council
What personal data we process and why
We process your personal data, special categories of personal data and/or criminal offence data such as:
- your name
- age
- date of birth
- address
- ethnicity
- school
- who is important to you
We try to get to know you well and will ask you questions about your life, your health, your family, your friends, how you feel, what is happening now and in the past and what you like doing.
We will ask for information about the people you live with now or have lived with in the past – information like their names, dates of birth, relationship to you and previous/current addresses.
We will also ask for information relating to family support needs including vulnerable children, health issues, disability or special educational needs, employment, educational attendance and behaviour, involvement with the police, anti-social behaviour, social care, violence in the home, substance misuse.
The YJS uses information about young people who have committed a criminal offence to assist professionals in the management of the work they do to help reduce re-offending. YJS works with:
- young people who have been referred to us by either the Court or the Police
- young people and their families or carers to support young people in changing their behaviour and not getting in trouble with the Police or Courts
The YJS includes people from a lot of different backgrounds. We have staff based with us from the Police, Social Care, the NHS, Education, Probation, the Council, and charities we work with.
We also work with Tees, Esk & Wear Valleys NHS Foundation Trust (TEWV) to provide CAMHS Practitioner support with a focus on both statutory provision and early intervention and to ensure that groups of vulnerable children and young people have access to mental health advice and support. This includes
- providing mental health assessments
- brief psychotherapeutic interventions
- assisting in navigating local mental health systems for children and young people who are involved with the YJS
- providing advice, training, and consultation to other members of YJS, parent (s) / carer (s) and other agencies
All information collected will be used, shared, and held by YJS to provide assessments, comply with court orders, to manage risk and to assist us to support you and your family.
The information we collect from you is needed to enable us to manage children and young people subject to involvement with the YJS who undertake interventions as part of either a voluntary arrangement or statutory order.
You are entitled to withdraw consent from voluntary interventions or any surveys undertaken. To withdraw consent, you must contact your Youth Justice Service worker, or alternately you can email ysjbusinesssupport@york.gov.uk.
Automated decision-making
We do not carry out any automated decision-making in YJS.
Collecting information automatically
Please see our cookies page for further information about the information we collect automatically when you use our website.
Children’s information
Where we provide services directly to children or young people, the information in the relevant parts of this notice applies to children and young people, as well as adults.
Lawful basis for processing your personal data
Any personal data including special category data and criminal offence data that we process about individuals is done so in accordance with Article 6, Article 9 and Article 10 of the UK GDPR and Schedule 1 of the Data Protection Act 2018 (DPA 2018).
The legal basis for processing your information is in accordance with the following:
Article 6(1)
- (a) Consent: the individual has given clear consent for the council to process their personal data for a specific purpose.
- (c) Legal obligation: the processing is necessary for the council to comply with the law (not including contractual obligations).
- (e) Public task: the processing is necessary for the council to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.
- (f) Legitimate interests: the processing is necessary for the council’s legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)
Article 9(2)
- (a) Explicit consent
- (b) Employment, social security, and social protection (if authorised by law)
- (g) Reasons of substantial public interest (with a basis in law)
Article 10 - under the control of official authority or when the processing is authorised by law providing for appropriate safeguards for the rights and freedoms of data subjects.
This is supported by the following Schedule1 provisions of the Data Protection Act 2018 and legal framework
- Schedule 1 Part 2(6) - statutory functions incl. common law provided in the substantial public interest
- Schedule 1 Part 2(10): Preventing or detecting unlawful acts
- Schedule 1 Part 2(18) for safeguarding functions
- Working together to safeguard children 2015
- The Childcare Act 2006
- The Childcare Act 2016
- The Education Act 2011
- The Children’s Act 2006
- SEND Code of practice
- Early Years Statutory Framework
- Crime and Disorder Act 1998
- Offender Management Act 2007
- Domestic Violence, Crime and Victims Act 2004
Where we process personal data relating to criminal convictions and offences, this is also under Article 10 UK GDPR that covers processing in relation to criminal convictions and offences or related security measures. In addition, section 11(2) of the DPA 2018 specifically confirms that this includes personal data relating to the alleged commission of offences, or proceedings for an offence committed or alleged to have been committed, including sentencing.
Some of the Schedule 1 conditions for processing special category and criminal offence data require an Appropriate Policy Document (APD) to be in place, which sets out and explains the procedures for securing compliance with the principles in Article 5 and policies regarding the retention and erasure of such personal data. This document explains this processing and satisfies the requirements of Schedule 1, Part 4 of the DPA 2018 and supplements this privacy notice.
Our Appropriate Policy Document provides further information about this processing.
How long we keep your personal data
We are required by law to keep your information for varying lengths of time, which depends on the nature of our involvement and any offence committed, then we will securely and confidentially delete or destroy it. This information is set out in our retention schedule. More information can be given to you on request.
Data sharing
We may need to share some information about you with:
- other organisations, for example, health services, education, the Department of Work and Pensions, Probation, police, or care agencies and third parties, so we can all work together for your benefit
- other CYC services
- other organisations such as health, education, private and voluntary agencies, and support services so that they can help us to understand your needs and to provide you with the services you need
- other councils, partner organisations and the Government where appropriate for reporting purposes and to make the services of the YJS better e.g., Youth Justice Board, the Ministry of Justice, the Department for Education, the Department for Work and Pensions), ONS (Office for National Statistics)
In some circumstances, such as under a court order, court proceedings, criminal prosecutions or safeguarding, we are legally obliged to share information.
We will always satisfy ourselves that we have a lawful basis on which to share the information and document our decision-making.
Additionally, we are required under the Public Records Act 1958 (as amended) to transfer records to the City or National Archives (TNA) for permanent preservation. Full consideration will be given to Data Protection and Freedom of Information legislation when making decisions about whether such records should be open to the public.
Data processors and/or third parties
Where we have third parties providing parts or all of our services for us, we have contracts or agreements in place with them. These are listed below
- Tees Esk and Wear Valley NHS Foundation Trust (TEWV) – who provide the CAMHS practitioner
- Childview is our case management system where information regarding young people working with the YJS is stored
If we use WhatsApp to contact you etc, you can find out how they use your information at their Privacy Policy.
If we use Microsoft Teams, to contact you, to gather information from you, or if we are recording or transcribing our discussion or meeting with you, we will let you know. You can find more details about this in the City of York Council Microsoft Office 365 (MS365) Teams Meeting recording and transcription privacy notice.
If we want to take photos, video or audio recordings we will always get your prior permission or consent from you or your parents/carer and you can find out more about this at our Communications Team including photos, filming and recording privacy notice.
When we use SurveyMonkey for our surveys or consultation etc you can find out how they use your information at their Privacy Notice.
Transfers of personal data
We don’t routinely transfer personal data outside of the UK but when this is necessary we ensure that we have appropriate safeguards in place and that is done in accordance with the UK data protection and privacy legislation.
How we protect your information
We're committed to keeping your information safe and secure. There are several ways we do this, such as:
- IT security safeguards such as firewalls, encryption, and anti-virus software
- on-site security safeguards to protect physical files and electronic equipment
- training for all staff and elected councillors
- policies and procedures
Your rights in relation to this processing
To find out about your rights under data protection law, you can go to the Information Commissioner's Office website.
You can also find information about your rights in our Privacy Notice.
If you have any questions about this privacy notice, want to exercise your rights, or if you have a complaint about how your information has been used, please contact us on email: information.governance@york.gov.uk, or on telephone: 01904 554145, or write to:
Data Protection OfficerCity of York Council
West Offices
Station Rise
York YO1 6GA
We cannot give you any information about other people on your file - for example victims, people who offended with you, your own family members.
Also see
- Website terms and disclaimer
- Data Protection Policy Statement
- Accessibility statement
- Cookies policy
- Copyright statement