Xantura privacy notice
We keep this privacy notice under regular review and it was last updated on 12 June 2023.
Kent County Council respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you.
Who we are
Kent County Council collects, uses and is responsible for certain personal information about you. When we do so we are regulated under the United Kingdom General Data Protection Regulation (‘UK GDPR’) and the Data Protection Act 2018. We are responsible as ‘controller’ of that personal information. Our Data Protection Officer is Benjamin Watts.
In support of our statutory obligations relating to social care and improving how we work with other Kent local authorities to deliver services, in particular identifying people at risk of financial exclusion and homelessness, we are piloting the use of Xantura’s ‘OneView’ data sharing platform. In order to pilot Xantura’s system within Kent, we share de-identified, pseudonymised data with them which is then surfaced (viewable in identifiable form) to council officers who have legitimate need to see this information.
Personal information we collect and use
Information collected by us
In the course of delivering vital services to you, including early identification of vulnerable individuals and those at risk of crisis using Xantura’s system, we collect the following personal information when you provide it to us:
- Personal information such as name, date of birth, marital status, national insurance number or unique system identifier (for example ASCH database record number).
- Contact details such as address, telephone number and email address.
We also collect the following ‘special category data’ (personal data which is more sensitive and is treated with extra care and protection) when you provide it to us. This data is de-identified using a pseudonymisation process before it is passed to Xantura:
- Information relating to health such as physical and mental health records, information relating to disabilities and health conditions sourced from social care client systems.
We also obtain personal information from other sources. This data is de-identified using a pseudonymisation process before it is passed to Xantura:
- Educational information such as school attended, number of sessions, exclusions and alternative provision, qualifications, currently in education or further education. Sourced from school census files and Kent County Council social care case notes.
- Employment information such as employment status. Employment information may be included in revenues and benefits data structured fields. Case notes may also include unstructured information on employment.
- Financial information such as savings, debt, income and outgoing costs. Financial data such as income, savings, benefit receipts and additional payments may be collected as part of revenues and benefits data and housing provision. Adult Social Care financial assessment information may be available. Case notes may also include unstructured information on financial situation.
- Contractual Information such as employment contracts, services or products provided to individuals and how often services are used. All services information and interventions recorded within adult social care, children’s social care, housing, revenues and benefits and debt management will be processed. This data will also be used to understand progression of need and vulnerability and to help understand how risk factors relate to service provision and escalation of need.
- Technical (assistive technology) - where recorded in adult social care systems, the use of assistive technology will be used and evaluated as part of all other service provision. Assistive technology may also indicate where there are additional needs such as hearing loss or disabilities.
- Social relationships such as marital status, dependents, next of kin, other family, household composition and carers information. This will be used in order to understand the network of support people have and how this impacts on their needs. Sourced from adult social care, children’s social care, housing and revenues and benefits systems.
- Open data and public records such as ONS data, electoral register and information about individuals that is openly available on the internet.
- Personal history such as immigration status, information about children, information about families of children and carers of children. All personal history data will be captured from the various source systems where it is contained as both structured and unstructured data (adult/children’s social care, revenues and benefits, housing and debt management systems). If recorded in the case notes, this will be because of a relevant and related concern and may impact on their needs as a service user.
- Housing situation such as rented accommodation, children’s home and temporary accommodation. Housing situation will be captured from both Kent County Council and district council systems and will be both structured and unstructured data. Individuals’ housing situation will be used in analysis of risk for individuals and to identify how best to support them.
How we use your personal information
We use your personal information for:
Prevention and support
The ability to provide more tailored debt support, maximise benefit entitlement and prevent worsening social and financial outcomes. Prevention and support is the primary purpose behind the council’s use of Xantura’s system, and this shall initially be focussed towards homelessness prevention and its associated causes and challenges.
Supporting more informed discussions and conversations with residents
Enabling council officers to see a joined-up view of debt and vulnerability in one place for when people contact the council or district to discuss their situation. A joined-up view of household debts and vulnerabilities is expected to be developed and provided to staff with legitimate basis to see this information.
Reasons we can collect and use your personal information
When we collect your personal data, we rely on the following legal bases:
- Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
When we collect your ‘special categories of personal data’ (such as health information), we rely on the following legal bases:
- Article (9)(2)(g) - processing is necessary for reasons of substantial public interest (statutory and government purposes).
We take the following appropriate safeguards in respect of your special category data when relying on the conditions above:
- This pilot project has a bespoke Appropriate Policy for Lawful Processing which explains how the data protection principles are secured when using special category information. This policy is retained throughout the time we use your data and for six months after we cease to use it. This policy, and those which supplement it, are viewable upon request.
- We have a retention schedule which explains how long data is retained.
- We maintain a record of our processing in our ‘Record of Processing Activities’ and record in it any reasons for deviating from the periods in our retention schedule.
How long your personal data will be kept
As Xantura’s system is only used to share, rather than store, data contained within a local record, the retention of data is set by individual partners (such as Kent local authorities).
For data relating to adult social care, we will only hold your personal information for as long as necessary. To work out how long we need to keep your information for we use our retention schedule (see sections AS1 – 6 (excluding AS2.1, AS2.2, AS4.4, AS4.5, AS4.9, AS4.10, AS4.11, AS4.12.15, AS4.12.16, AS4.13, AS5.2, AS6.1) which provides a breakdown of the retention periods relied on by adult services).
For data related to children’s social care, this will be kept for:
| Category | Retention period |
|---|---|
| Adoption | Date of birth +100 years |
| Private fostering arrangements | Date of birth +75 years |
| Private foster parents where parents made their own arrangements for the child to be fostered | Last contact with the private foster parent +10 years, or date of death of private foster parent + 2 years |
| All other records relating to children and young people who don’t fall into any of the above categories, including Children in Need, and general papers where a file has not been opened | Date of birth +25 years |
| Register of persons posing a risk to children and those cautioned or convicted of offences against children | 75 years from the date of the caution or conviction |
| Recording of incoming phone calls to front door | Date of call + 3 months |
Who we share your personal information with
In order to pilot Xantura’s system within Kent, we share de-identified, pseudonymised data with them which is then presented (viewable in identifiable form) to council officers who have legitimate need to see this information.
In the course of working with you, we may collect information from, or share it, with some of the following third parties (non-exhaustive list):
- Ashford Borough Council
- Canterbury City Council
- Dartford Borough Council
- Dover District Council
- Folkestone and Hythe District Council
- Gravesham Borough Council
- Maidstone Borough Council
- Sevenoaks District Council
- Swale Borough Council
- Thanet District Council
- Tonbridge and Malling Borough Council
- Tunbridge Wells Borough Council
- Housing associations and landlords
- Health colleagues/NHS
- Internal teams, such as case management and finance
Each third party listed above will ensure they have the relevant agreements and impact assessments in place to be able to process your personal information.
This data sharing enables early identification of households at risk of crisis (for example homelessness), thereby giving frontline support teams the ability to intervene.
We have a data sharing agreement in place between all Kent local authorities who are each signatories of the Kent and Medway Information Sharing Agreement (the KMISA) and a record of processing is kept for this sharing.
We have a data processing agreement in place with Xantura who process your data on our behalf.
We will share personal information with law enforcement or other authorities if required by applicable law or in connection with legal proceedings.
We will share personal information with our legal and professional advisers in the event of a dispute, complaint or claim. We rely on Article 9(2)(f) where the processing of special category data is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
Your rights
Under the UK GDPR you have rights which you can exercise free of charge which allow you to:
- know what we are doing with your information and why we are doing it
- ask to see what information we hold about you (subject access request)
- ask us to correct any mistakes in the information we hold about you
- object to direct marketing
- make a complaint to the Information Commissioner's Office.
Depending on our reason for using your information you may also be entitled to:
- object to how we are using your information
- ask us to delete information we hold about you
- have your information transferred electronically to you or to another organisation
- object to decisions being made that significantly affect you
- stop us using your information in certain ways.
We will always seek to comply with your request however we may be required to hold or use your information to comply with legal duties. Your request may delay or prevent us delivering a service to you.
For further information about your rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the United Kingdom General Data Protection Regulation.
If you would like to exercise a right, please contact the Information Resilience and Transparency Team at data.protection@kent.gov.uk.
Keeping your personal information secure
We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
Who to contact
Please contact the Information Resilience and Transparency Team at data.protection@kent.gov.uk to exercise any of your rights, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.
You can contact our Data Protection Officer, Benjamin Watts, at dpo@kent.gov.uk.
UK GDPR also gives you right to lodge a complaint with Information Commissioner, who may be contacted via the Information Commissioner's website or call 03031 231113.
Read our corporate privacy statement.