Privacy and Data Protection

Notification is a statutory requirement and every organisation that processes personal information must notify the Information Commissioner's Office (ICO), unless they are exempt. Failure to notify is a criminal offence.

The principal purpose of having notification and the public register is transparency and openness. It is a basic principle of data protection that the public should know (or should be able to find out) who is carrying out the processing of personal information, as well as other details about the processing (such as for what reason it is being carried out).

The council renews its registration annually.  The council's registration number is 'Z5623112' and it can be used to view the notification on the Information Commissioner's website via the Register of Data Controllers.

Under the General Data Protection Regulations (GDPR) you have a right of access to any personal information the council holds about yourself. Please note that:

  • to request a copy of this information you must make a subject access request in writing;
  • you are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request;
  • if your request is complex then we can extend this period by a further two months, if we need to do this we will contact you.

You can submit a subject access request in the following ways:

Online:    Make a request online form
Post:       Information Governance Team, Cumbria County Council, 1st Floor, Cumbria House, 117 Botchergate, Carlisle Cumbria CA1 1RD

To ensure that we can deal with your request as efficiently as possible you will need to include:

  • your current name (or any previous names);
  • your address;
  • proof of identity (driving licence, passport or two different utility bills that display your name and address);
  • as much detail as possible regarding your request so that we can identify any information we may hold about you (this may include your previous name and address, date of birth and what council service you were involved with)

Cumbria County Council will not disclose personal data in circumstances where either your identity or address is unclear.  The council will contact you to request further documentation if required. 

The council will accept ONE of the following as proof of your identity:

  • Adoption Certificate [UK]
  • EU National Identity Card
  • HM Forces ID Card [UK]
  • Passport [any nationality]
  • Personnel Number
  • Travel Documents [Home Office or certificate of naturalisation or registration or Home Office standard acknowledgement Letter (SAL)]
  • UK Birth Certificate [full or short form acceptable]
  • UK- Issued Driving Licence [either photo card or paper, a photo card is only valid if the individual presents it with the counterpart licence] 

The council will accept ONE of the following as proof of your address:

  • Bank/Building Society Statement*
  • Benefit Statement e.g. child allowance*
  • Council Tax Statement (UK)**
  • Credit Card Statement*
  • Financial Statement*
  • Insurance Certificate**
  • Store Card Statement*
  • TV Licence**
  • Utility Bill*

(* Documents should be less than three months old) (** Issued within past 12 months)

Sending Your Documents

Documents should be posted double-enveloped by recorded delivery and the outer envelope addressed to:

Information Governance Team
Cumbria County Council
Cumbria House
117 Botchergate

The inner envelope should contain your documents and be marked Confidential - Information Governance Team.


The Information Governance Team does not keep copies of your identity documentation. Evidence of identity, name, address or relationship will be noted and documentation returned by recorded delivery.  No responsibility is accepted by the council for loss or theft of your documentation if the process described above is not followed.

Who is entitled to make a subject access request?

Any person, regardless of their age, can request information about themselves so long as it is supported with appropriate photo identification, e.g. passport, driving license, and they have the capacity to understand the information provided. 

Can a child make a request?

Yes. There is no minimum age requirement for applicants. Children can apply for access to their own records provided they are capable of understanding the nature of the request and the information content disclosed.

Can I access personal data about other people?

You only have right of access to your own personal data. You do not have right of access to personal data about any other individual, e.g. your family, friends or neighbours, except in the following circumstances:

  • You are a parent requesting information about a child under 16, but there is no automatic right to the data. If a child is old enough to give informed consent and understands the contents of the information, the council will be guided by their wishes. In most cases children aged 12 and above are regarded as having sufficient maturity to respond to such requests but each case will be judged on its own merits. In all cases disclosure would only occur if it is in the best interests of the child
  • A solicitor is requesting information on behalf of a client - a signed authority form from the person concerned is required
  • An agent or family person has written authorisation to act on behalf of a person

Can I arrange for someone to make a request on my behalf?

A friend, relative or solicitor may request information on your behalf but they must have obtained written authorisation from you to do this.

In addition to your right of access the General Data Protection Regulations (GDPR) also gives you the following rights:

  • the right to be informed via the council's Privacy Notice
  • the right to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point
  • the right of rectification, we must correct inaccurate or incomplete data within one month
  • the right to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information
  • the right to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future
  • the right to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked
  • the right to object. You can object to your personal data being used for profiling, direct marketing or research purposes
  • you have rights in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting the Data Protection Officer.

Post:       Information Governance Team, 1st Floor, Cumbria House, 117 Botchergate, Carlisle CA1 1RD

Why does the council operate CCTV?

A CCTV system has been installed at Cumbria County Council's new build (Cumbria House) for the following purpose: 

  • assisting with the prevention and detection crime and disorder i.e. burglary, damage to property, arson

This purpose is reflected in the council's entry on the Information Commissioner's Register of Data Controllers.  

Where does the council operate CCTV?

Cumbria County Council operates a CCTV system at Cumbria House, 117 Botchergate, Carlisle CA1 1RD.  The system covers the exterior of the building (including rear car park), entrance/exit points and reception area.  The CCTV System is programmed to block out windows - a privacy zone (a black block) will remain on the windows.  All cameras that overlook residential premises are also programmed with privacy zones. 

How do I make a request?

You have the right to request CCTV footage of yourself.  To do this you must submit a request in writing preferably using the council's online make a request form.  This allows for the identification and handling of requests for CCTV footage. Contact details can be found on this page under the 'contact us' section or on signage displayed on the exterior of the building.

When submitting your request you should provide the following details to allow for accurate identification of relevant footage: 

  • specific date(s)/time
  • proof of your identity
  • a description of yourself
  • a description of the incident

What does the council have to provide?

The council must provide a copy of the footage that you can be seen in within one month.  Images that identify other people will be blurred out or redacted.  Any redactions will be explained at the point of disclosure.  If your request is unclear or further detail is required the council will contact you as soon as possible.

How will the council respond?  

The council's preferred method of response is in writing.  A permanent copy of the images or footage will be provided to you by secure email or recorded delivery.  If this is not possible an appointment will be made for you to view the footage on council premises.  

Can the council refuse my request?

The council can refuse your request if sharing the footage will put a criminal investigation at risk. 

Who can I contact for advice?

If you would like advice on CCTV or submitting a request please contact:

Information Governance Team
Cumbria County Council
Cumbria House
117 Botchergate

Telephone: 01228 221234

Civil Enforcement Officers (CEOs) employed by Cumbria County Council, who undertake the enforcement of parking restrictions, are each equipped with a Body Worn Video Device (BWVD) which has both video and audio recording capability. During their work the CEOs are vulnerable to verbal and physical abuse. 

The BWVDs can act as a deterrent to abusive and aggressive behaviour and prevent a situation escalating and the recording can also be used as evidence in cases where a CEO has been assaulted or abused. It can also be used to investigate complaints about a CEO. 

The Council's Body Worn Video Device and Hand Held Unit Policy (PDF 417kb) details the operational procedures for using the devices, data storage and requests for access to footage. 

Individuals can request a copy of the footage under the Data Protection Act using the council's online form.

As a public authority we are required to have a Data Protection Officer who is responsible for:

  • monitoring the council's compliance with the GDPR and other data protection laws. Monitoring our data protection policies, awareness-raising, training, and audits
  • advising the council in respect to their data protection obligations
  • provide advice and monitor the Data Protection Impact Assessment process
  • acts as a point of contact for the Information Commissioner's Office (ICO) and members of public on any matter relating to Data Protection.

If you need to contact the Data Protection Officer their details are: 

Being transparent and providing accessible information to individuals about how we use personal information is a key element of the General Data Protection Regulation (GDPR). The most common way to provide this information is in a privacy notice.

The council's Privacy Notice combines general and service specific information.