Dorset Council criminal records checking privacy notice
Dorset Council as a registered body for processing DBS applications is the data controller for the information you provide during the criminal records checking process unless otherwise stated. If you have any queries about the process or how we handle your information, please contact us at HRDBSTeam@dorsetcouncil.gov.uk
Dorset Council as an umbrella body sometimes undertakes DBS checks on behalf of customer organisations.
For these checks, the relevant customer organisation is the data controller responsible for determining the means and purposes for which your personal data is used.
Cantium Business Solutions Ltd is the data processor of the Employment Check online system for Disclosure and Barring Service (DBS) checks, which is used by Dorset Council.
Dorset Council and Cantium Business Solutions Ltd are both data processors when Dorset Council undertakes DBS checks on behalf of a customer organisation.
What will we do with the information you provide to us?
The information you provide during the process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary.
We will not share any of the information you provide during the application process with any third parties for marketing purposes, or store any of your information outside of the European Economic Area. We will however, need to share your information with data processors – for more information refer to the table below. The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format.
We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your application.
What information do we ask for, and why?
The table set out below summarises the information we collect and hold for this service, how and why we do so, how we use it and with whom it may be shared. All elements of the listed information may be required to enable a criminal records check to be carried out and collection of the appropriate data will be governed by system controls as the application process is undertaken.
We seek to ensure that our information collection and processing is always proportionate. We will notify you of any changes to information we collect or to the purposes for which we collect and process it.
|
How we collect the information |
Why we collect the information |
How we use and share the information |
|
|
Your identity data including title, name(s), date of birth, NI number, nationality, address history and place of birth |
You will provide this as part of the application process |
To comply with our legal obligations To perform the criminal records check Legitimate interest: to verify your identity |
To comply with application requirements in order to submit your application to the DBS To enable validation of your identity as part of your application To complete barred list checks where required Information shared with the DBS, the Police and other regulatory authorities as required Information shared with Compliance Assist for external ID validation if required (where you are unable to provide sufficient evidence to meet DBS requirements) |
|
Information from your ID documents (for a full list of relevant documents) |
From you and the ID verifier who has checked your ID documents |
To perform the criminal records check To comply with our legal obligations Legitimate interest: to verify your identity
|
To comply with DBS application requirements in order to submit your application to the DBS To enable validation of your identity as part of your application Information shared with the DBS, the Police and other regulatory authorities as required Information shared with Compliance Assist for external ID validation if required (where you are unable to provide sufficient evidence to meet DBS requirements) |
|
Your contact details including email address, telephone number(s) and postal address |
You will provide this as part of the application process |
To perform the criminal records check Legitimate interests: to progress your application and keep you informed of progress and outcomes |
To enable us to keep you informed of the progress of your application and outcome Information shared with the DBS, the Police and other regulatory authorities as required Information shared with Compliance Assist for external ID validation if required (where you are unable to provide sufficient evidence to meet DBS requirements) |
|
ID verifier / manager name and email address |
From the individual requesting the disclosure |
To perform the criminal records check Legitimate interests: to progress your application and inform nominated individuals of disclosure outcomes |
To enable us to keep ID verifiers / managers informed of the progress of an application and outcome |
|
Your declaration of whether you have any convictions, cautions, reprimands or warnings |
From you |
To comply with our legal obligations To perform the criminal records check Legitimate interests: · For reasons of substantial public interest (protecting the public against dishonesty, safeguarding children and individuals at risk) · Your consent |
To comply with DBS application requirements in order to submit your application to the DBS. Information shared with the DBS, the Police and other regulatory authorities as required For further information see below* |
|
The outcome of your external ID validation check (pass/fail) |
From Compliance Assist |
To perform the criminal records check To comply with our legal obligations Legitimate interest: to verify your identity |
To comply with DBS application requirements in order to submit your application to the DBS To enable validation of your identity as part of your application Information shared with the DBS |
|
Your disclosure certificate information |
From the DBS |
To perform the criminal records check To comply with our legal obligations Legitimate interest: to verify the criminal records information provided by you Legitimate interest: · to confirm DCC as a registered body has undertaken a check on the applicant and complete re-checks in line with DCC policy (Disclosure Certificate number and Disclosure Certificate issue date only) · For reasons of substantial public interest (protecting the public against dishonesty, safeguarding children and individuals at risk) · Your consent |
To enable an informed recruitment / retention / engagement decision To carry out statutory checks Information shared with DBS, the Police and other regulatory authorities as required Information shared with the nominated manager and any other person/body who would need to be involved in making an informed recruitment / engagement / retention decision Certificate number and date of issue information may be shared with other organisations for the purpose of validating that DCC as a registered body has undertaken a check on you For further information see below* |
We will comply with the additional conditions set out in the Data Protection Act 2018 which relate to criminal convictions and other special categories of personal data (sensitive personal information). We may use your criminal information less frequently for legal claims, where required to do so by a Court or where you have made the information public.
As there is a statutory and contractual basis for collecting your personal data if you do not provide the following information or documentation we may be unable to progress your DBS disclosure application. This may affect your ability to commence/continue in a job role or voluntary position.
- Personal Data: Title, Name(s), Date of Birth, Address History, NI Number, Contact Details, Nationality, Gender, Town & Country of Birth, ID documents to verify your identity
- Personal Sensitive Data: If any Convictions, Cautions, Reprimands or Warnings
Data processors are third parties who provide elements of our criminal records checking service for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do so. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the relevant period.
Kent County Council is the data processor of the Employment Check online system for Disclosure and Barring Service (DBS) checks, which is used by Dorset Council.
How long is the information retained for?
We will hold your personal information for a period of up to 6 months following receipt of your disclosure and a recruitment (or other relevant) decision has been made and the application archived.
In very exceptional circumstances where it is considered necessary to keep Disclosure information for longer than six months, we will consult the DBS about this and give full consideration to the Data Protection of the individual subject before doing so.
The following information is retained for the purposes of disclosure renewals and portability requests where we are required to confirm that DC as the registered body has completed a disclosure check:
- Application ID
- Username
- Forename
- Surname
- ID Verifier Username
- DBS Vulnerable Adults checked
- DBS Children’s Barred List checked
- Position working with children or adults at the applicant’s home address
- Volunteer
- Workforce
- Type of check required
- DBS Application Reference
- Disclosure number
- Disclosure issue date
- Separate barred list check required?
- Recruitment decision
- Certificate of Good Conduct required?
- Certificate of Good Conduct received?
- Position for which certificate was requested
Upon expiry any personal data will be securely destroyed.
Who we share your personal information with
We will share personal information with law enforcement or other authorities if required by applicable law.
We will share your personal information with our professional advisers if required for the purposes of establishing, exercising or defending legal proceedings.
Our data processor engages the following third party providers, with whom data may be shared (only if required) to enable the delivery of this service:
UK Fast.Net Ltd (system hosting)
Access to data is only granted where authorised. System data is hosted within the UK by an ISO 27001 accredited supplier and supplier information security standards meet DBS requirements.
Where an external ID check is required in order to meet the DBS’s ID verification requirements we will share your personal data with Compliance Assist in order to undertake this check. When a search is made please be advised that:
Compliance Assist may check the details you supply, against any particulars on any database (public or otherwise) to which Compliance Assist has access in order to carry out the relevant verification service;
A specific (non-credit) footprint is left by Compliance Assist;
A record of the decision made is available for us (Compliance Assist’s Client) to retrieve for audit purposes.
Your rights
Under the General Data Protection Regulations 2018, you have rights as an individual which you can exercise in relation to the information we hold about you.
Complaints or queries
Dorset Council tries to meet the highest standards when collecting and using personal information For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate.
This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of Dorset Council’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.
If you want to make a complaint about the way we have processed your personal information, you can contact data.protection@dorsetcouncil.gov.uk
Consent - Withdrawal
In some circumstances where you have provided your consent for the processing of your criminal records information you have the right to withdraw your consent at any time by notifying us in writingvia email to HRDBSTeam@dorsetcouncil.gov.uk. On receipt of notification that you have withdrawn your consent we will no longer process your information for that purpose, unless we have another legitimate basis for doing so in law, or for legitimate business reasons.
Keeping your personal information secure
We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
Access to personal information
Dorset Council tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a ‘subject access request’ under the General Data Protection Regulations 2018. If we do hold information about you we will:
- give you a description of it;
- tell you why we are holding it;
- tell you who it could be disclosed to;
- let you have a copy of the information in an intelligible form
To make a request to the county council for any personal information we may hold you need to put the request in writing via email to our Data Protection team at data.protection@dorsetcouncil.gov.uk.
If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.
If we do hold information about you, you can ask us to correct any mistakes by contacting the Data Protection department.