Privacy and Data Protection

The General Data Protection Regulation (GDPR) provides you with the right to access information held by public authorities about you. 

Upon receipt of a valid request the council will:

  • provide you with a response within one month
  • let you know if your request is subject to an extension
  • make reasonable efforts to comply with your the format of your request
  • inform you if your request is going to be refused or a charge is payable

    If the council has doubts about your identity we can ask you for more information. We will only request information necessary to confirm who you are if we cannot identify you using internal council systems. 

    We will let you know if we need to confirm your identity prior to processing your request. The deadline for responding to your request will start when you have provided the additional information. 

    To ensure that we can deal with your request as efficiently as possible you will need to include:

    • your current name (or any previous names)
    • your address (or previous addresses)
    • as much detail as possible regarding your request so that we can identify any information we may hold about you i.e. previous name and address, date of birth, employee number, managers name, council services you receive.

    Any person, regardless of their age, can request information about themselves so long as it is supported with appropriate photo identification if required, e.g. passport, driving license, and they have the capacity to understand the information provided. 

    Yes. There is no minimum age requirement for applicants. Children can apply for access to their own records provided they are capable of understanding the nature of the request and the information content disclosed.

    You only have right of access to your own personal data. You do not have right of access to personal data about any other individual, e.g. your family, friends or neighbours, except in the following circumstances:


    • you are a parent requesting information about a child under 16, but there is no automatic right to the data. If a child is old enough to give informed consent and understands the contents of the information, the council will be guided by their wishes. In most cases children aged 12 and above are regarded as having sufficient maturity to respond to such requests but each case will be judged on its own merits. In all cases disclosure would only occur if it is in the best interests of the child
    • a solicitor is requesting information on behalf of a client - a signed authority form from the person concerned is required
    • an agent or family person has written authorisation to act on behalf of a person


    A friend, relative or solicitor may request information on your behalf but they must have obtained written authorisation from you to do this.  The council will require documentation to verify this.

    You can submit a subject access request in the following ways:


    Online:            Make a request online form
    Post:                Information Governance Team, Cumbria County Council, 1st Floor, Cumbria

                            House, 117 Botchergate, Carlisle Cumbria CA1 1RD

    By Phone:        01228 221234


    If you need assistance with submitting your request please contact the Information Governance Team on 01228 221234.

    In addition to your right of access the General Data Protection Regulations (GDPR) also gives you the following rights:

    • the right to be informed via the council's Privacy Notice
    • the right to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point
    • the right of rectification, we must correct inaccurate or incomplete data within one month
    • the right to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information
    • the right to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future
    • the right to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked
    • the right to object. You can object to your personal data being used for profiling, direct marketing or research purposes
    • you have rights in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

    If you want to exercise any of these rights then you can do so by contacting the Data Protection Officer.


    Post:       Information Governance Team, 1st Floor, Cumbria House, 117 Botchergate, Carlisle CA1 1RD

    Notification is a statutory requirement and every organisation that processes personal information must notify the Information Commissioner's Office (ICO), unless they are exempt. Failure to notify is a criminal offence.


    The principal purpose of having notification and the public register is transparency and openness. It is a basic principle of data protection that the public should know (or should be able to find out) who is carrying out the processing of personal information, as well as other details about the processing (such as for what reason it is being carried out).


    The council renews its registration annually.  The council's registration number is 'Z5623112' and it can be used to view the notification on the Information Commissioner's website via the Register of Data Controllers.


    As a public authority we are required to have a Data Protection Officer who is responsible for:

    • monitoring the council's compliance with the GDPR and other data protection laws. Monitoring our data protection policies, awareness-raising, training, and audits
    • advising the council in respect to their data protection obligations
    • provide advice and monitor the Data Protection Impact Assessment process
    • acts as a point of contact for the Information Commissioner's Office (ICO) and members of public on any matter relating to Data Protection.


    If you need to contact the Data Protection Officer their details 

    Being transparent and providing accessible information to individuals about how we use personal information is a key element of the General Data Protection Regulation (GDPR). The most common way to provide this information is in a privacy notice.  The council's Privacy Notice combines general and service specific information.

    Why does the council operate CCTV?


    A CCTV system has been installed at Cumbria County Council's new build (Cumbria House) for the following purpose: 


    • assisting with the prevention and detection crime and disorder i.e. burglary, damage to property, arson


    This purpose is reflected in the council's entry on the Information Commissioner's Register of Data Controllers.  


    Civil Enforcement Officers (CEOs) employed by Cumbria County Council, who undertake the enforcement of parking restrictions, are each equipped with a Body Worn Video Device (BWVD) which has both video and audio recording capability. During their work the CEOs are vulnerable to verbal and physical abuse. 


    The BWVDs can act as a deterrent to abusive and aggressive behaviour and prevent a situation escalating and the recording can also be used as evidence in cases where a CEO has been assaulted or abused. It can also be used to investigate complaints about a CEO. 


    The Council's Body Worn Video Device and Hand Held Unit Policy (PDF 417kb) details the operational procedures for using the devices, data storage and requests for access to footage. 


    Where does the council operate CCTV?


    Cumbria County Council operates a CCTV system at Cumbria House, 117 Botchergate, Carlisle CA1 1RD.  The system covers the exterior of the building (including rear car park), entrance/exit points and reception area.  The CCTV System is programmed to block out windows - a privacy zone (a black block) will remain on the windows.  All cameras that overlook residential premises are also programmed with privacy zones. 


    How do I make a request?


    You have the right to request CCTV footage of yourself.  To do this you must submit a request in writing preferably using the council's online make a request form.  This allows for the identification and handling of requests for CCTV footage. Contact details can be found on this page or on signage displayed on the exterior of the building.


    When submitting your request you should provide the following details to allow for accurate identification of relevant footage: 

    • specific date(s)/time
    • proof of your identity
    • a description of yourself
    • a description of the incident


    What does the council have to provide?


    The council must provide a copy of the footage that you can be seen in within one month.  Images that identify other people will be blurred out or redacted.  Any redactions will be explained at the point of disclosure.  If your request is unclear or further detail is required the council will contact you as soon as possible.


    How will the council respond?  


    The council's preferred method of response is in writing.  A permanent copy of the images or footage will be provided to you by secure email or recorded delivery.  If this is not possible an appointment will be made for you to view the footage on council premises.  


    Can the council refuse my request?


    The council can refuse your request if sharing the footage will put a criminal investigation at risk. 


    Who can I contact for advice?


    If you would like advice on CCTV or submitting a request please contact:


    Post:               Information Governance Team, Cumbria County Council, Cumbria House, 117 Botchergate Carlisle CA1 1RD


    Telephone:     01228 221234