Transport Projects privacy notice

About this privacy notice

The council is the data controller for purposes of the Data Protection Act (2018) and The General Data Protection Regulation (EU) 2016/679 ("GDPR") and is registered as a data controller with the Information Commissioner’s Office (ICO).

Brighton & Hove City Council is committed to protecting your personal information. As a data controller, we have a responsibility to make sure you know why and how your personal information is being collected in accordance with relevant data protection laws.

The primary laws which govern how Brighton & Hove City Council collects and uses personal information (known as “Data”) about you are:

• General Data Protection Regulation (GDPR)
• Data Protection Act (DPA) (2018)

However, City Transport is also subject to specific other laws which define when and for what purposes it can use your personal data.

Purposes and lawful basis of processing

The engagement process will help inform detailed design and levels of support for projects carried out by the Brighton & Hove City Council Transport Projects team. 

We're collecting your data to monitor: 

• geographic response levels
• multiple submissions by individuals
• that a cross-section of views are considered

We have a lawful basis for processing your data: GDPR Art.6 (1) (c) compliance with a legal obligation under S.3 Local Government Act 1999 and GDPR Art.9 (2) (g) substantial public interest under Data protection Act 2018 schedule 1 Part 2 (8) (1) equality of opportunity or treatment and under Section 1 (1) Equality Act 2010.

The data we may collect

We may collect Personal Data or Special Category Data.

The type of personal information collected from you is as follows.

Personal data

This could include:

• contact details, including:
  • name
  • address
  • email address
  • phone number
• IP address 

Special category data

We may also collect Special Category of personal data that may include:

• physical or mental health details
• racial or ethnic origin
• gender and sexual orientation

Who we will share your data with

Your information will not be shared with any other third party unless we're under a legal obligation to do.

How long we will hold your data (retention)

The principles we will use to determine how long your data will be kept include:

• what type of services you received and whether you're still receiving them
• whether we are still under a legal obligation either to you or under UK Law
• any standards and guidance set out by the various regulators for our functions
• whether you have expressed a preference that your data be retained, such as exercising a right to restrict processing

How your data will be stored

Your information will be stored in:

• electronic databases
• document management systems
• paper records

Who can access your data

We'll only make your information available to those who need to know to perform their council role.

How do we protect your data

Examples of the security measures we use are given below.

We provide training for our staff making them aware of:

• how to handle information securely
• how and when to report when something goes wrong

We use encryption when data is being sent, meaning that information is scrambled so that it cannot be read without access to an unlock key. The hidden information is said to then be ‘encrypted’.

Where possible, data will be pseudonymised, meaning that your identity will be removed, so that work can be done without your identity being known by the people doing that work.

We control access to systems and networks, which allows us to stop people who are not allowed to view your personal information from getting access to it.

We carry out regular testing of our technology and ways of working including keeping up to date on the latest security updates (commonly called patches).

Transferring data outside the European Economic Area

Your information is not processed outside of the European Economic Area.

Automated decision-making and profiling

We'll tell you if we make an automated decision, including profiling, with your personal information. If we do this you have the right to ask us to make this decision manually instead.