How we use your information - Privacy notice for Licensing
The proper handling of personal information by Denbighshire County Council is very important to the delivery of our services and maintaining public confidence.
Personal data is any information that relates to a person who can be directly or indirectly identified from the information. The terms ‘information’ and ‘personal data’ are used throughout this privacy notice and have the same meaning.
To ensure that the Council treats personal information correctly, we seek to adhere in full to the requirements of Data Protection legislation.
This privacy notice has therefore been produced to explain as clearly as possible what we do with your personal data.
The purposes for which we use your personal data
The information we collect about you is used to:
- Process and decide on licence/permit applications
- Process notices
- Provide public register information
- Investigate complaints
- Conduct regulatory enforcement activity, including with partner agencies
The legal basis for the processing of your information is to comply with our legal obligations under the following:
- Licensing Act 2003
- Gambling Act 2005
- Local Government (Miscellaneous Provisions) Act 1976
- Town Police Clauses Act 1847
- Local Government (Miscellaneous Provisions) Act 1982
- House to House Collections Act 1939
- Police, Factories etc. (Miscellaneous Provisions) Act 1916
- Hypnotism Act 1952
If you do not give us the information we need when we ask for it, this may result in the Council being unable to determine your licence or permit application, process your notice or comply with our statutory obligations.
What type of information do we use?
We collect the following types of personal data about you to deliver this service, depending on your circumstances:
- Name
- Address
- Date of birth
- Gender
- Unique reference number
- Telephone number
- Email address
- Bank/payment details
- Employment and education details
- National Insurance details
- Images/photographs
- Vehicle registration number
- Information about your health
- Your racial or ethnic origin
- Criminal convictions and offences
Do we use information received from other sources?
To provide this service, we collect information directly from you but also receive information from the following external sources, depending on the type of licence:
- The Fire and Rescue Service
- The Police
- Disclosure and Barring Services
- NHS local health boards
- Immigration services
- Foreign Embassies if you are a foreign national or have lived abroad
- National Fraud Initiative
- National Register of Taxi Drivers
- Department for Work and Pensions
- HM Revenue and Customs
- DVLA
- Other local authorities
We also receive information from the following Council services:
- Environmental Health
- Trading Standards
- Planning
- Children’s Services
- Resources
- Highways
- Events Safety Advisory Group
- Chief Executive’s department
- Legal Services
Transferring your information abroad
Your information will not be transferred outside the United Kingdom.
Who has access to your information?
We share your information with the following recipients depending on your circumstances:
- The Fire and Rescue Service
- The Police
- Disclosure and Barring Services
- NHS local health boards
- Immigration services
- Foreign Embassies if you are a foreign national or have lived abroad
- National Fraud Initiative
- National Register of Taxi Drivers
- Department for Work and Pensions
- HM Revenue and Customs
- DVLA
- Other local authorities
Where an application or issue has to be considered by the Council’s Licensing Committee or a sub-committee information about you will be heard in public.
There are also other specific situations where we may be required to disclose information about you, such as:
- Where the Council is required to provide the information by law
- Where disclosing the information is required to prevent or detect a crime
- Where disclosure is in the vital interests of the person concerned
How long we will keep your information
We will keep your information for as long as the licence exists or up to 6 years after registration or entitlement lapses or in the case of authorisations for larger events we may keep the information for up to 20 years, in accordance with the Council’s Retention Guidelines.
Your Data Protection rights
You have the right to:
- Obtain access to the personal data that the Council is processing about you
- Have any inaccurate or incomplete information rectified (corrected)
- Withdraw your consent to processing, where this is the only basis for the processing
- Make a complaint to the Information Commissioner’s Office (ICO), the independent body in the UK which protects information rights
In some circumstances, you may have the right to:
- Object to the processing of your personal information
- The erasure of your personal data
- Restrict the processing of your personal information
- Data portability
Contact details
For more information regarding this privacy notice and your rights, please contact:
Data Protection Officer
Denbighshire County Council
PO Box 62
Ruthin
Denbighshire
LL15 9AZ
Email: dataprotection@denbighshire.gov.uk
Phone: 01824 706000
Contact details for the Information Commissioner’s Office (ICO) along with further guidance on Data Protection legislation can be found on the ICO website (external website).
Policy for Denbighshire County Council in respect of requests for information, disclosure of information, and use of information as a result of an entry on NR3
In this policy, the ‘first authority’ refers to a licensing authority which made a specific entry onto the National Register of Refusals and Revocations; the ‘second authority’ refers to a licensing authority which is seeking more detailed information about the entry.
Overarching principles
This policy covers the use that Denbighshire County Council (the “authority) will make of the ability to access and use information contained on the National Register of Taxi Licence Revocations and Refusals (NR3). The NR3 contains information relating to any refusal to grant, or revocation of, a taxi drivers’ licence. Throughout this policy reference is made to ‘taxi driver’s licence.’ This generic term covers a hackney carriage driver’s licence, a private hire driver’s licence and a combined/dual licence.
This information is important in the context of a subsequent application to another authority for a drivers’ licence by a person who has had their licence refused or revoked in the past.
This authority has signed up to the NR3. This means that when an application for a taxi drivers’ licence is refused, or when an existing taxi drivers’ licence is revoked, that information will be placed upon the register.
When an application for a new drivers’ licence, or renewal of an existing drivers’ licence is received, this authority will make a search of the NR3. The search will only be made by an officer who has been trained in the use of the NR3 and who is acting in accordance with this policy. If details are found that appear to relate to the applicant, a request will be made to the authority that entered that information for further details.
Any information that is received from any other authority in relation to an application will only be used in relation to that application, and the determination of it, and will not be used for any other purpose. Any data that is received will only be kept for as long as is necessary in relation to the determination of that application. This will include the period of processing that application, making a decision, notifying the applicant of the outcome of that decision, and the appeal processes.
For the avoidance of doubt, any such data will be kept for a period of no more than 35 days from the date of the service of the written notification of the determination of the application.
The appeal period is 21 days from the date on which the written notification of the decision was received by the applicant/licensee. An appeal must be lodged within that time period, and no extension of that period is permissible (see Stockton-on-Tees Borough Council v Latif [2009] LLR 374). However, to ensure that the information is available if an appeal is lodged and there is a dispute over time periods, a period of 35 days is specified.
Where an appeal to the magistrates’ court is made, the data will be retained until that appeal is determined or abandoned. Where the appeal is determined by the magistrates’ court, there is a further right of appeal to the Crown Court. In these circumstances, the data will be retained for a period of no more than 35 days from the date of the decision of the magistrates’ court. If an appeal is made to the Crown Court, the data will be retained until that appeal is determined or abandoned. Where the appeal is determined by the magistrates’ court or the Crown Court, it is possible to appeal the decision by way of case stated.
Any appeal by way of case stated must be lodged within 21 days of the decision of either the magistrates’ court or the Crown Court (see The Criminal Procedure Rules R35.2). To ensure that the information is available if an appeal is lodged by way of case stated and there is a dispute over time periods, a period of 35 days is specified.
Accordingly, the data will be retained for a period of no more than 35 days from the date of the decision of the Crown Court (if the decision was made by the magistrates’ court, the retention period has already been addressed). If an appeal by way of case stated is made, the data will be retained until all court proceedings relating to that appeal by way of case stated (which will include potential appeals to the Court of Appeal and Supreme Court) have been determined.
Decisions of the local authority, magistrates’ Court and Crown Court are also susceptible to judicial review. Generally any right of appeal should be exercised in preference to judicial review, but there are occasions when leave has been granted for judicial review in the circumstances. Any application for judicial review must be made “promptly; and in any event not later than 3 months after the grounds to make the claim 1st arose” (see The Civil Procedure Rules R54.5). If an application for judicial review is made after any relevant data has been destroyed, this authority will request the information again and then retain that information until all court proceedings relating to that judicial review (which will include potential appeals to the Court of Appeal and Supreme Court) have been determined.
The data will be held securely in accordance with this authority’s general policy on the secure retention of personal data. At the end of the retention period, the data will be erased and/or destroyed in accordance with this authority’s general policy on the erasure and destruction of personal data.
Making a request for further information regarding an entry on NR3
This section relates to the submission of a request by the second authority.
When an application is made to this authority for the grant of a new, or renewal of, a taxi driver’s licence, this authority will check the NR3.
This authority will make and then retain a clear written record (this can be electronic, rather than “pen and paper” hard copy) of every search that is made of the register. This will detail:
- the date of the search
- the name or names searched
- the reason for the search (new application or renewal)
- the results of the search
- the use made of the results of the search (this information will be entered to the register at a later date)
This record will not be combined with any other records (i.e. combined with a register of licences granted) and will be retained for the retention period of 25 years.
If this authority discovers any match (i.e. there is an entry in the register for the same name and identifying details) a request will be made to the authority that entered those details (the first authority) for further information about that entry. That request will also include details of this authority’s data protection policy in relation to the use of any data that is obtained as a result of this process.
This request will be made in writing using an approved form. It will be posted or emailed to the contact address of the authority that entered those details (the first authority) which will be detailed in the register.
Responding to a request made for further information regarding an entry on NR3
This section of the template policy relates to the handling by the first authority of a request for information by the second authority.
When this authority receives a request for further information from another authority a clear written record will be made of the request having been received. This record will not be combined with any other records (i.e. combined with a register of licences granted) and will be retained for the retention period of 25 years. This record can be combined with the written record of the action taken as a result of the request.
This authority will then determine how to respond to the request. It is not lawful to simply provide information as a blanket response to every request.
This authority will conduct a Data Protection Impact Assessment. This will consider how the other authority (the second authority) will use the data, how it will store that data to prevent unauthorised disclosure, the retention period for that data, and the mechanism for erasure or destruction of the data at the end of that period. It is expected that if the second authority has adopted a policy similar to this, that should be a reasonably straightforward process.
If this authority is satisfied that the other authority’s (the 2nd authority) data protection procedures are satisfactory, consideration will then be given as to what information will be disclosed (if the 1st authority is not satisfied that the 2nd authority’s data protection policy is satisfactory, no disclosure can be made. In such circumstances it is essential that discussion takes place as a matter of urgency between the data protection officers of the 1st authority and the 2nd authority). This will be determined by an officer who has been trained to discharge this function.
Any disclosure must be considered and proportionate, taking into account the data subjects’ rights and the position and responsibilities of a taxi driver. Data is held on the NR3 register for a period of 25 years, but this authority (the 1st authority) will not disclose information relating to every entry. Each application will be considered on its own merits.
This authority will disclose information relating to a revocation or refusal to grant a drivers’ licence in accordance with the timescales contained within the Statement of Policy Regarding the Suitability of Applicants and Licensees in the Hackney and Private Hire Trades.
Licences, permits and Trading Standards policies
Where the reason for refusal to grant or revocation relates to a conviction (or similar as defined in the Policy) which is within the timescales determined in those guidelines, the information will be disclosed. Where the reason for refusal to grant or revocation relates to a conviction (or similar as defined in the Policy) which is outside the timescales determined in those guidelines, the information will not be disclosed. However, in every case, consideration will be given to the full circumstances of the decision and there may be occasions where information is provided other than in accordance with this policy.
Any information about convictions will be shared in accordance with this policy under part 2 of scheduled 1 to the Data Protection Act (DPA) 2018; that is, the processing is necessary for reasons of substantial public interest in connection with the exercise of a function conferred on the authority by an enactment or rule of law.
The officer will record what action was taken and why. This authority will make and then retain a clear written record (this can be electronic, rather than “pen and paper” hard copy) of every decision that is made as a result of a request from another authority. This will detail:
- the date the request was received
- how the data protection impact assessment was conducted and its conclusions
- the name or names searched
- whether any information was provided
- if information was provided, why it was provided (and details of any further advice obtained before the decision was made)
- if information was not provided, why it was not provided (and details of any further advice obtained before the decision was made)
- how and when the decision (and any information) was communicated to the requesting authority
This record will not be combined with any other records (i.e. combined with a register of licences granted) and will be retained for the retention period of 25 years
Using any information obtained as a result of a request to another authority
When this authority receives information as a result of a request that has been made to another authority, it will take that information into account when determining the application for the grant or renewal of a taxi drivers’ licence. This will be in accordance with the usual process for determining applications as outlined in the Statement of Policy Regarding the Suitability of Applicants and Licensees in the Hackney and Private Hire Trades.
This authority will make and then retain a clear written record of the use that is made of the results of the search (this information will be added to the register detailed above).
Information that is received may warrant significant weight being attached to it, but it will not be the sole basis for any decision that this authority will make in relation to the application.