Who will own my data once I submit it?
Knowsley Metropolitan Borough Council (KMBC) and Change Grow Live Services Ltd (CGL)
Why do you need my information?
KMBC has responsibility for improving the health of the local population under the Health and Social Care Act 2012 which requires them to commission services to deliver on a number of statutory duties and recommended services for adults and young people.
Responsibility for commissioning drug treatment services became the responsibility of Local Authority Directors of Public Health (DPH) from April 2013 following enactment of the Heath & Social Care Act 2012.
KMBC has a contract with (CGL) to provide the Integrated Drug and Alcohol Recovery Service. We jointly created this privacy notice in August 2024 and will regularly review it.
For the purposes of data protection legislation, KMBC and CGL are both independent Data Controllers and are separately responsible to you under the law for the processing of your information.
KMBC and CGL are both committed to ensuring that your information is handled in accordance with the principles set out in data protection legislation and guidance from the Information Commissioner’s Office (ICO).
In order to effectively deliver the Integrated Drug and Alcohol Recovery Service and ensure the best outcomes for service users are met we may get your information from one or more of the following sources:
- Directly from you.
- From third parties acting on your behalf such as family members, advocates.
- From other third parties or organisations such as:
- Your GP.
- Hospital records.
- Mental health services.
- Your social worker or other support professionals.
- Prison substance use treatment services.
- The Police.
- Probation Service.
We ask that you:
- Give us accurate information.
- Tells us as soon as possible about any changes.
- Tell us as soon as possible if you notice any mistakes in the information, we hold about you.;
What personal data will be processed?
We will only ask for the information that is necessary for the service that we are providing to you.
The types of personal data processed include, but not are limited to the following:
Service User Personal Data
- Name.
- Address.
- Date of birth.
- National Insurance (NI) number.
- Telephone number.
- Gender
- Description of life history.
- Personal preferences.
- Risks – where this may impact safety of others including staff.
- Benefits – details such as housing benefits may be requested if service user has a housing need or is being referred to inpatient detox or residential rehabilitation.
- General Practitioner (GP) details.
- Family / next of kin information (e.g. names, contact details etc).
- Photographs from events or promotion.
Non-service user personal information
Personal information may also be processed regarding staff at KMBC and CGL. This personal information includes, but is not necessarily restricted to, the following:
- Name (forename and surname).
- Job title.
- Contact details (emails address and contact telephone number).
- Location of employment.
Service User Special Category Personal Data
- Religion.
- Race/Ethnicity.
- Records of Care and / or care plans.
- Social Care and / or clinical observations in context of treatment and recovery.
- Health and medical Information.
- Current prescribed medication.
Criminal Offence Data (Service Users)
- Criminal offence data.
- Police records.
KMBC is authorised to process criminal offence data as the council is an official authority.
CGL processes criminal data in line with Article 10 of the UK GDPR and is authorised by domestic law to process criminal offence personal data through the use of a lawful condition under Schedule 1 of the Data Protection Act, for example paragraph 10, preventing or detecting unlawful acts.
For What Purposes Are You Using My Personal Data?
Personal data will be used for the following purposes:
- Help and support within treatment and recovery.
- To protect service user and others from harm.
- Where a crime has or may be committed.
- Where a child or adult may be at risk.
- Prescribing medication.
- Inform future service design and funding decisions.
- Examine the outcomes of aspects of the service and the characteristics of people accessing the service.
- Statistical Analysis.
- Statutory returns.
- Ensuring service delivery.
Additionally, Knowsley Council are required under the Public Records Act 1958 (as amended) to transfer records to the City or National Archives (TNA) for permanent preservation. Full consideration will be given to Data Protection and Freedom of Information legislation when making decisions about whether such records should be open to the public.
What allows you to use my information?
KMBC’s Public Health Service has responsibility for improving the health of the local population under the Health and Social Care Act 2012 which requires them to commission services to deliver on a number of statutory duties and recommendations for children and adults.
The conditions used to process the personal data under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 vary depending on purpose of the data share.
The relevant lawful bases for KMBC’s processing of personal data and special category personal data are as follows:
- Article 6(1)(e) Public task.
- Article 9(2)(g), Substantial public interest.
- Article 9(2)(h), Health or social care.
- Article 9(2)(i), Public Health
The relevant lawful conditions under the Data Protection Act 2018 are as follows:
- Sch 1, P2 (6), Statutory and government purposes.
- Sch 1, P1 (2), Health and social care.
The legislation underpinning this processing is: Health and Social Care Act 2008 (Regulated Activities) Regulations 2014.
The lawful bases for CGL processing of personal, and special category personal data are as follows:
- Article 6(1)(f), Legitimate interests. CGL need to hold data on service users to provide support / treatment. CGL need to hold data on employees to employ them.
- Article 9(2)(a), Explicit consent.
- Article 9(2)(c), Vital interests. This will cover situations where an individual is at risk of immediate and serious harm.
- Article 9(2)(e), Personal data which are manifestly made public by the individual.
- Article 9(2)(f), Establishment, exercise or defence of legal claims.
- Article 9(2)(h), Processing of personal data for the purposes of preventative or occupational medicine, the provision of health or social care or treatment or the management of health or social care systems and services.
- Article 9(2)(i), Public interest in the area of public health.
- Article 9(2)(j), Research purposes.
The relevant lawful conditions under the Data Protection Act 2018 are as follows:
Who will my information be shared with?
If appropriate data may be shared with other organisations and services these include, but are not restricted to:
- National Drugs Treatment Monitoring System (NDTMS).
- John Moores University Services (JMUS) and Liverpool John Moores University (LJMU) for data collection and research purposes.
- Coroner.
- Police.
- GP.
- National Health Service (NHS).
- Prisons.
- Probation Service.
- Courts.
- Police and Crime Commissioner.
- Mental Health Services.
- Inpatient Detox Providers.
- Residential Rehabilitation Providers.
- Pharmacies.
Do I have to provide this information and what will happen if I don’t?
KMBC has a statutory duty to commission public health services. Engaging with the service provided by CGL is voluntary however failure to provide information may result in a delay in treatment, recovery, prescribing and appropriate referrals.
In some instances such as Alcohol Treatment Requirements (ATR’s) and Drug Rehabilitation requirements (DRR) set by the Probation Services, data is required to be shared.
How long will you keep this data for and why?
KMBC will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.
The retention of information, for legal or statutory purposes, is in line with The Records Management Code of Practice for Health and Social Care 2016, namely this is 8 years for adults and 25 to 26 years for children services.
CGL will retain service user records for 8 years from last engagement. CGL have an automated process in place to delete records once the retention period has ended.
How will my information be stored?
KMBC and CGL will process (store, share etc.) personal data using secure software and systems. Staff at both organisations complete mandatory data protection training on an annual basis.
Will this information be used to take automated decisions about me?
No
Will my data be transferred abroad and why?
No.
What rights do I have when it comes to my data?
Under the Data Protection Act (DPA) 2018/ UK General Data Protection Regulation (UK GDPR), you have the following rights with regards to your personal data: -
- The right to subject access – you have the right to see a copy of the personal data that the council holds about you and find out what it is used for
- The right to rectification – you have the right to ask the council to correct or remove any inaccurate data that we hold about you.
- The right to erasure (right to be forgotten) you have the right to ask the council to remove data that we hold about you
- The right to restriction – you have the right to ask for your information to be restricted (locked down) on council systems
- The right to data portability – you have the right to ask for your data to be transferred back to you or to a new provider at your request
- The right to object – you have the right to ask the council to stop using your personal data or to stop sending you marketing information, or complain about how your data is used
- The right to prevent automated decision making – you have the right to ask the council to stop using your data to make automated decisions about you or to stop profiling your behaviour (where applicable)
To find out more about your rights under the DPA 2018/UK GDPR, please visit the Information Commissioner’s website.
To request a copy of your data or ask questions about how it is used, please write to: -
Data Protection Officer
Knowsley Council
Municipal Building
Archway Road
Huyton
Liverpool
L36 9YU
Or email: Inforights@knowsley.gov.uk
Who can I complain to if I am unhappy about how my data is used?
You can complain directly to the Council’s Data Protection Team by writing to: -
Data Protection Officer
Knowsley Council
Municipal Building
Archway Road
Huyton
Liverpool
L36 9YU
Or email: data.protection.officer@knowsley.gov.uk
You also have the right to complain to the Information Commissioner’s Office using the following details:
The Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 08456 30 60 60 or 01625 54 57 45
Website: www.ico.org.uk