Building access system privacy notice

Who will own my data once I submit it?

Knowsley Council

Why do you need my information?

Knowsley Council needs your personal information in order to fulfil the following purposes:

Building access control

To identify authorised individuals and enable them to gain access to council buildings, offices, secure areas and other controlled locations.

Maintaining the security of council premises

To protect council buildings, facilities, assets, equipment and information from unauthorised access, loss, theft, damage or misuse.

Protecting employees, elected members, contractors, visitors and the public

To support the safety and security of people working in, attending or visiting council premises.

Issuing and managing access credentials

To create, issue, activate, amend, suspend, replace and deactivate access cards, passes, fobs or other access credentials.

Managing individual access permissions

To determine which buildings, floors, rooms or restricted areas an individual is authorised to access according to their role or other authorised requirement.

Recording access to and from premises

To maintain appropriate records of access events, for example the use of a pass/card at a controlled door, where this is necessary for security and access-management purposes.

Preventing and detecting unauthorised access

To identify, investigate and respond to attempted or actual unauthorised access to council premises or restricted areas.

Investigating security incidents

To investigate suspected or actual breaches of physical security, including misuse of an access credential, theft, damage or other incidents affecting council premises, personnel or assets.

Health and safety

Where appropriate and necessary, to support the council's health and safety responsibilities in relation to people using or accessing its premises.

Administration of starters, movers and leavers

To ensure that access permissions are established, changed or withdrawn when an employee's, contractor's or other authorised person's role or relationship with the council changes.

Contractor and third-party access management

To provide and administer appropriate building access for contractors, agency workers, partners, suppliers and other authorised third parties.

Monitoring the operation and security of the access-control system

To ensure the system is operating correctly and securely, including identifying faults, inappropriate access permissions or other security problems.

System maintenance, support, testing and upgrades

To allow appropriately authorised council staff and contracted technical suppliers to maintain, troubleshoot, test, patch, upgrade and support the building access system. Where technicians require access to live personal information, that access should be limited to what is necessary for the particular task.

Data quality and system administration

To maintain accurate and up-to-date access records, remove obsolete permissions, prevent duplicate records and administer user/access profiles.

Audit and compliance

To maintain appropriate audit records and demonstrate compliance with the council's security, information governance, health and safety and data-protection requirements.

Establishment, exercise or defence of legal claims

Where necessary, relevant access records may be used to establish facts, respond to complaints or claims, or support legal proceedings.

Compliance with legal and regulatory requirements

To process and disclose relevant information where the council has a legal obligation or is otherwise lawfully required to do so.

Prevention and detection of crime

Where necessary and proportionate, access information may be processed to prevent or investigate suspected criminal activity affecting council premises, people or assets.

Responding to lawful requests from law-enforcement or other authorised bodies

Where there is an appropriate legal basis, relevant information may be disclosed in response to lawful requests.

What Personal Information do we collect?

Personal information that is collected includes, but is not restricted to the following:

Name (forename and surname)
Job title.
Council Service Area.
Team.
Organisation (if external partner / occupier).
Photograph.
Access permissions.
Key code.
Information on building access changes.
Event logs.

What allows you to use my information?

The Council processes personal data in line with Article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR), which states that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

It is necessary for a local authority to upgrade physical security and building access systems to manage its properties, protect staff and visitors, and perform it official tasks.

Who will my information be shared with?

Authorised council staff and departments.
The suppliers of the building access system and associated technicians and installers of the system for the purposes of upgrades etc.
Police and other Law enforcement authorities.
Regulatory, statutory or oversight bodies.
Legal advisers and insurers.
Other organisations occupying or managing Council premises.

Do I have to provide this information and what will happen if I don’t?

Personal information such as an individual's name, service or organisation, job title, photograph or other identifier, card or fob number, access permissions and access-event records for employees/contractors/building occupiers enables the Council to associate an access credential with an authorised person.

This allows the system to:

establish whether an individual is authorised to enter a building or secure area;
allocate appropriate access permissions;
prevent or restrict unauthorised entry;
issue, amend and deactivate access credentials;
protect employees, visitors, Council information and physical assets;
maintain appropriate security audit trails;
investigate security incidents and suspected misuse; and
remove or modify access when an employee or contractor leaves or changes role.

Without the required personal information, the Council would be unable to reliably identify authorised building users, associate access credentials with individuals, allocate appropriate access permissions, restrict access to secure areas, administer and deactivate access credentials, maintain appropriate security audit records, or effectively investigate unauthorised access and security incidents.

This would significantly impair the Council's ability to operate an effective building access control service and safeguard its premises, employees, visitors, information and assets.

How long will you keep this data for and why?

Information is retained in line with the Council’s Retention Schedule and Records Management Policy. Typically, we retain information for three years for audit purposes.

How will my information be stored?

Information will be stored on the Council’s secure door access system which is stored on the council’s server.

Will this information be used to take automated decisions about me?

Will my data be transferred abroad and why?

What rights do I have when it comes to my data?

Under the Data Protection Act (DPA) 2018/ UK General Data Protection Regulation (UK GDPR), you have the following rights with regards to your personal data: -

The right to subject access – you have the right to see a copy of the personal data that the council holds about you and find out what it is used for.
The right to rectification – you have the right to ask the council to correct or remove any inaccurate data that we hold about you.
The right to erasure (right to be forgotten) you have the right to ask the council to remove data that we hold about you.
The right to restriction – you have the right to ask for your information to be restricted (locked down) on council systems.
The right to data portability – you have the right to ask for your data to be transferred back to you or to a new provider at your request.
The right to object – you have the right to ask the council to stop using your personal data or to stop sending you marketing information, or complain about how your data is used.
The right to prevent automated decision making – you have the right to ask the council to stop using your data to make automated decisions about you or to stop profiling your behaviour (where applicable).

To find out more about your rights under the DPA 2018/UK GDPR, please visit the Information Commissioner’s website.

You can request a copy of your data or ask questions about how it is used by visiting our website here.

By email to: Inforights@knowsley.gov.uk

Or in writing to:

Data Protection Officer
Knowsley Council
Nutgrove Villa
Westmorland Road
Huyton
L36 6GA

Who can I complain to if I am unhappy about how my data is used?

You can complain directly to the Council’s Data Protection Team by writing to: -