Governance and scrutiny privacy notice

The data controller for the information we collect

This Privacy Notice is provided to meet the requirements of the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA) to explain how we process your personal data in delivering governance and scrutiny functions.

Leeds City Council is the data controller for the purposes of the Data Protection Act 2018 and other regulations, including the UK General Data Protection Regulation, which means it determines what your data is used for and why it is collected. The contact details of the data controller are Leeds City Council, Merrion House, 110 Merrion Way, Leeds, LS2 8BB.

The data we collect

The data we collect for the governance and scrutiny function is listed below:

  • name (names of elected members, partner organisation contacts, Leeds residents, Leeds City Council officers, independent remuneration panel)
  • address
  • contact details
  • date of birth
  • personal details

Special category (including finance data):

  • personal data revealing racial or ethnic origin
  • personal data revealing political affiliation
  • personal data revealing religious or philosophical beliefs
  • personal data revealing trade union membership
  • data concerning health

And criminal offence data, for example, DBS checks for elected members.

How we collect information about you

We collect information about you from you directly (for example, by asking you to complete one of our forms, via the telephone, through our contact centre, or face-to-face). In addition, information is collected in relation to evidence provided at committees, boards, and panels through webcasts and recording of minutes.

We may also obtain information about you from other sources, such as:

  • your family members, carers or other persons acting on your behalf
  • internal council departments
  • other public authorities
  • NHS trusts
  • government departments

Why we process your data

We use your information to facilitate the Council’s democratic process, for example:

  • scrutinise decisions of the executive under Local Government 2000
  • deal with complaints against councillors under the Members’ Code of Conduct
  • respond to requests for deputations and requests for scrutiny
  • respond to requests from the public
  • deliver service  
  • statutory requirements (for example, reporting to government)
  • register of interests

All the data collected will be treated in strict confidence and in accordance with the requirements of the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). The data provided by you will only be used for the purposes specified.

Lawful basis for processing

We will process your data in accordance with UK GDPR Article 6(1)(c), which allows us to process your data under the following UK GDPR provisions:

Article 6(1)(a): processing shall be lawful only if the data subject has given consent to the processing of his or her personal data for one or more specific purposes. We require your consent for processing data associated with the provision of a governance and scrutiny service. To enable allowances to be paid, to support the delivery of deputations to Council, requests for scrutiny, dealing with complaints under the members code of conduct and records relating to the register of interests.

Article 6(1)(c): processing is necessary for compliance with a legal obligation to enable us to process your data to provide an governance and scrutiny service under the legislation of The Local Government Act 2000.

Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This is supported under various UK laws, including but not limited to the legal framework:

  • The Local Government Act 2000
  • Council Procedure Rules
  • Scrutiny Board Procedure Rules
  • The Local Government Act 1972
  • The Localism Act 2011

We will process your special category data in accordance with UK GDPR Article 9(2). The processing shall be lawful only if and to the extent that the following applies:

9(2)(a): the data subject has given explicit consent to the processing of those personal data for one or more specified purposes;

9(2)(b): processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller

9(2)(g): Processing is necessary for reasons of substantial public interest.

The processing of special category data under Article 9 is further supported by Condition 6 in Schedule 1, statutory and government purposes (for example, Code of Conduct and register of interests)

All the listed conditions require an Appropriate Policy Document to be in place, which sets out and explains the procedures for securing compliance with the principles in Article 5 and policies regarding the retention and erasure of such personal data. The council’s Appropriate Policy Document provides further information about this processing and supplements this privacy notice.

Withdrawing your consent

You have the right to withdraw your consent from participating in the scheme / service at any time. Withdrawing your consent will not automatically affect any services or benefits you receive from the council.

Data retention, storage and destruction

Our data retention policies and procedures are designed to help ensure that we comply with our legal obligations in relation to the retention. This means that your information will be kept in most cases for a minimum of 6 years after we cease to provide a service to you, unless the law says that we need to hold it for longer or if there is a business requirement to do so. After this, your information will be deleted or archived. For more information about retention of the data we process, please contact us.

Who we share your data with

We share your data with agencies shown below as follows:

  • departments internal to the council who will use this information (for example, to administer the Members’ Allowance Scheme)
  • colleagues who administer the scheme will receive name, address, and relevant personal details

In addition, we will share your personal data:

  • where such disclosure is necessary for compliance with a legal obligation to which we are subject
  • in order to protect your vital interests or the vital interests of another natural person
  • for the purposes of security and prevention of fraud and other criminal activity
  • where such disclosure is necessary for the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure

Automated decision-making

Your data will not be used for any automated decision-making, including profiling.

Your rights

The following rights under data protection law are available under the UK GDPR:

  • the right to access (where you can ask for copies of your personal data)
  • the right to rectification (where you can ask us to rectify inaccurate personal data and to complete incomplete personal data)
  • the right to erasure (where you can ask us to erase your personal data)
  • the right to restrict processing (where you can ask us to restrict the processing of your personal data)
  • the right to data portability (where you can ask that we transfer your personal data to another organisation or to you)
  • the right to object to processing (where you can object to the processing of your personal data)
  • the right to complain to a supervisory authority (where you can complain about our processing of your personal data)
  • withdraw consent (to the extent that the legal basis of our processing of your personal data is consent, you can withdraw that consent)

All data rights apply where we process your information based on your consent.

Where we process your information under legal obligation, certain rights do not apply, such as:

  • erasure
  • data portability
  • objection to processing
  • the right to withdraw consent

Where we process your data under the public task basis, the following data rights do not apply: 

  • the right to erasure
  • the right to portability 
  • the right to withdraw consent

These rights are subject to certain limitations and exceptions. You can learn more about your rights and how to exercise them, with further details on the Information Commissioner’s Office website. You may exercise any of the above rights in relation to your personal data by writing to us using the contact details provided below.

If your data is sent to other countries

The information you provide will not be transferred to another country outside of the UK.

Contact us

Any queries in relation to this privacy notice should be forwarded to:

Rob Clayton

Email: robert.clayton@leeds.gov.uk 

Data Protection Officer

Aaron Linden
Head of Information Management and Governance - Data Protection Officer
Leeds City Council
Merrion House
110 Merrion Way
Leeds
LS2 8BB

DPO@leeds.gov.uk 

The council privacy notice is available online.

Complaints

If you are unhappy with the way in which your information has been handled, you should speak with the specific service in the first instance. 

Any data protection complaints about how the council has processed your personal data will be handled in accordance with the council’s complaints policy. You can find out how to submit a complaint.

You can refer to the Information Commissioner if you consider that there has been an infringement of data protection legislation. Further details can be found on the Information Commissioner’s website. 

Changes to this notice

We keep our privacy notice under regular review. We will notify you of significant changes to this notice by email or other means as appropriate. This privacy notice was last updated February 2025.