Privacy notice for criminal record information 

What do we use the information for?

We collect, process and hold your personal information in order to provide our services effectively. 

• To deal with associated payment of fees and queries on check progress 
• To produce reports to monitor the volumes of checks processed
• To recharge checks undertaken to the relevant service area, school or organisation.

We also use information to improve our services so that they are more appropriate to people’s requirements.  We recognise that your personal information is important to you, and we take our responsibilities for ensuring that we collect and manage it proportionately, correctly and safely very seriously.

By virtue of you seeking to be employed or volunteer in a role that legally requires a criminal record check, or where the council is allowed to undertake such a check, you are placing yourself under a statutory and/ or contractual obligation to provide your personal information to the council during the criminal record checking process in order to allow a check to be requested and undertaken. 

What information do we hold and use?

Where checks are undertaken for the council for prospective or current employees or volunteers, we  may be required to collect and process the following additional information:

• Copy disclosure certificates for a limited time period 
• Risk assessment forms completed to reach a suitability decision where applicable
• Details of membership of the DBS Update Service and records of online status checks 
• Records of reimbursements made of fees for the DBS Update Service.

For prospective foster carers and adopters or those currently fostering, the Council will also hold:

• Details of household members and regular visitors to assist Humberside Police.

On what grounds do we use the information?

We collect and lawfully process your personal information under the following: 

• Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975
• Police Act 1997 (Criminal Records) Regulations 2002
• Safeguarding Vulnerable Groups Act 2006. 

We process personal data for the following reasons:

• GDPR Article 6(1)(a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes
• GDPR Article 6(1)(b) – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• GDPR Article 6(1)(c) – processing is necessary for compliance with legal obligation to which the East Riding of Yorkshire Council is subject 
• GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest in the exercise of official authority vested in the controller. 

We process special category data for the following reason:

• GDPR Article 9(2)(a) - the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject.
• GDPR Article 9(2)(b) - processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.

How do we collect this information?

We may collect information in the following ways: 

• Paper, electronic or online forms (such as DBS application forms, risk assessments forms) 
• Email
• Telephone
• Letter
• Face to face, with one of our employees, or one of our partners
• Disclosure certificate.

Who do we share your information with?

We use a data processor to complete the DBS checks on our behalf and this is currently done by Complete Background Screening (CBS) Limited.  All relevant information required to process these requests will  be passed to CBS to enable them to do so.

Complete Background Screening Ltd (external website) 

Complete Background Screening Ltd Privacy Policy (external website) 

Where checks are undertaken for the council your information may be shared internally for the purposes of reaching a suitability decision. This includes people services staff, your manager or employing school, other senior managers in your service area/ directorate. 

We may disclose your information to others, but only where this is necessary either to comply with our legal obligations or as permitted by Data Protection legislation. We may share it with other public service bodies including the police and the Disclosure and Barring Service (DBS).

The reasons why we may share your data with other public bodies are as follows:

• To verify identity documents
• To protect vulnerable adults and children who may be at risk of harm or abuse
• To monitor and improve our performance and delivery of services
• For the prevention and or detection of crime
• Where necessary to protect individuals from the risk of harm or injury
• Where otherwise permitted under the General Data Protection legislation.

We will only disclose your sensitive or confidential information to a third party if we are legally required to do so, or where we have good reason to believe that failing to share the information would put you or someone else at risk of harm.

We will not pass your personal information to external organisations for marketing or sales purposes or for any commercial use without your prior expressed consent.

How long do we store it and is it secure?

We have a retention schedule in place to ensure that information is only held for as long as it is needed. We will not keep your information for longer than is required to by law. Your information will be disposed of in a controlled and secure manner in accordance with the council’s Records Management and Data Quality Policy. The council’s IT security and confidentiality policies ensure that your information is protected, and accessed only by staff directly involved in your case.  

For information on how long your information will be held, visit the retention page. 

What rights do you have?

The rights that you have depend on the grounds in which we collected your information.  All of the rights you could have are outlined on the data protection rights page. 

In most cases, people who have had a criminal records check undertaken for the council will have the following rights:

• The right of access – you are entitled to see the information that we hold about you.
• The right to rectification – we will amend information accordingly, if any information the service holds about you is incorrect.
• The right to restrict processing – you may wish to limit how we use your data.
• The right to object – in addition to the right to limit the use of your data, you also have a right to object to the use of you data for certain actions. 

To exercise any of your above rights, please visit the data protection rights pages for more information.

Where can I find out more?

If you would like to know more about how the council uses information, your rights or have a concern about the way we are collecting or using your personal data, we request that you raise your concerns with us in the first instance; contact details are available on the general privacy information page. 

Alternatively, you can contact the Information Commissioner's Office (ICO). The ICO is the UK’s independent authority set up to uphold information rights in the public interest and they handle public concerns regarding organisations information rights practices. 

Information Commissioner’s Office (external link)

When was this privacy notice last updated?

We will continually review and update this privacy notice to reflect any changes in our services, feedback from customers, and to comply with any changes in the law. 

This privacy notice was last updated on 28 March 2022.