Advice Services privacy notice

Find out how Stirling Council uses personal data by checking the Council’s website at the following address:

https://www.stirling.gov.uk/privacy-statement/

Our website contains a Register of Data Processing which lists all the different ways
in which the Council uses personal data.

This Privacy Notice provides more information about just one of those processes.

The Council has a Data Protection Officer to make sure it is complying with data protection laws.

They can be contacted at:

Data Protection Officer
Stirling Council
Old Viewforth
14-20 Pitt Terrace
Stirling
FK8 2ET

Email: dataprotection@stirling.gov.uk
Telephone: 01786 404040

The Council processes personal data for Advice Services which include Advice Stirling (Money, Debt & Benefits Advice), Forth Valley Macmillan Money Matters Project, Digital Inclusion team and the Better Off Stirling Platform.

Personal data is collected and recorded to enable casework to be carried out and advice provided.  In addition, some personal data may be used to report to funders, apply for funding, and for audit purposes including the Scottish National Standards for Information and Advice Providers

Personal data of service users will include: Name, address, phone numbers, email address, marital status, ethnicity, sexual orientation, health conditions, disabilities, tenure, and financial information.  

We will also record details for partners, carers and children where relevant and appropriate

Some special category personal data (health conditions) may be processed.

UK GDPR:

Article 6(1)(a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.

Article 9(2)(a) - the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject.

The data can be provided by a number of sources including: referrers; clients; friends, family or carers of the client; medical professionals; creditors; local authorities, Scottish Social Security Agency, Department for Work and Pensions (DWP), HM Courts & Tribunal Service (HMCTS), Scottish Courts and Tribunals Service (SCTS), Experian and Equifax.  We will sometimes request information from other Council teams including: revenues & benefits; housing; and social work, but only with client consent.

We also receive information from other organisations: on our referral forms, by email or over the phone; or in written format or over the phone when we request this to enable us to accurately advise the client. 

The data is provided either face-to-face; over the phone; by email; or in written format.

Data is kept on our case management system called Advicepro.  This is a cloud based system and is hosted by ACM. ACM have confirmed that data is backed up on servers held in the UK. We hold some client information on our Advice Services shared drive and in email folders.

We also hold some paper files held in locked cabinets, and older paper files in storage with the Records Centre.

6 years from date of case closure, unless there are circumstances where we need to hold information for longer (e.g. if a client enters into the Debt Arrangement Scheme, we need to hold the data for the length of the DAS in case it needs to be varied at any stage).

Personal data is shared with creditors, funders, Experian, Equifax, HM Courts & Tribunal Service (HMCTS), Scottish Courts and Tribunals Service (SCTS) etc. but only with client consent, where a contract exists, or where we have a legal duty.

Internally with other departments in Stirling Council and other Local Authorities where there are concerns over child protection issues or benefit fraud.

We are also legally obliged to share certain data with other public bodies, such as DWP, HMRC & Police and will do so where the law requires this.  We will also generally comply with requests from specific information from other regulatory and law enforcement bodies where this is necessary and appropriate.

Your information is also analysed internally to help us improve our service.  This is covered in our Fraud Privacy Statement. 

You have the following rights under data protection laws. If you have a request under any of these rights, you can make a subject access request.

• The right of access – You have the right to request information we hold about you. This is known as a subject access request and is free of charge. We must respond within one month, although this can be extended to three months if the information is complex.
  
  
• The right to rectification - You are entitled to have your information rectified if it is factually inaccurate or incomplete. We must respond to your request within one month. If we decide to take no action, we will tell you why and let you know about your right of complaint to the UK Information Commissioner
  
  
• The right to erasure - You have the right to ask us to delete your information or stop using it. It will not always be possible for us to comply with your request, for example, if we have a legal obligation to keep the information. If we decide to take no action, we will tell you why and let you know about your right of complaint to the UK Information Commissioner.
  
  
• The right to restrict processing - You have the right to restrict how your data is processed in certain circumstances, for example, if the information is not accurate. If a restriction is applied, we can retain just enough information to ensure that the restriction is respected in future. We must tell you if we decide to lift a restriction on processing.
  
  
• The right to data portability – You have the right to object to processing, if we are processing your personal data with your consent, and it is held in a structured, commonly used, machine-readable form, you have a right to ask us to transmit it to another data controller so they can use it. This right does not apply if we process your personal data as part of our public task.
  
  
• The right to object - You can object to your information being used for profiling, direct marketing or research purposes.
  
  
• You have rights in relation to automated decision making and profiling - to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to complain about or comment on how we have processed your personal information, you should email dataprotection@stirling.gov.uk

If you are still unhappy with how the council handled your complaint, you can contact the UK Information Commissioner's Office at:

The Information Commissioner,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire SK9 5AF

Phone: 0303 123 1113

You can find further information on the Information Commissioners Office website.