Privacy Notice for Information Security Audit survey This privacy notice was completed in December 2020 and will be regularly reviewed. When we use your personal data, CYC complies with data protection legislation and is the registered 'Controller'. Our data protection notification is registered with the Information Commissioner's Office (ICO) - reference **Z5809563**. 

 
Why is information being collected? Information remains one of the most valuable assets held by any organisation. Good information governance is essential for delivering high quality services. Failure to secure personal or commercially sensitive data may lead to breaches under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. These breaches can cause significant harm to individuals, reputational damage to the organisation and lead to potential financial penalties of up to €20 million. The Covid-19 outbreak has transformed the information governance environment for all organisations. Many of the measures adopted to prevent the spread of the virus have resulted in the creation and management of personal or sensitive data outside existing control systems. Nevertheless, the duty of organisations to still act with care when handling this data remains unchanged. As a high proportion of council staff continue to work remotely, additional work will be undertaken to review particular risks associated with remote-working, including the storage and disposal of printed information. 

What information will be collected? We are collecting  

- Your comments and your feedback 
- Your role  
- Team/service/directorate information 
Participation is voluntary and you can choose to not answer any of the questions. 

What will we do with the information? 

We are using the information you give us with your consent.  You can withdraw your consent at any time by contacting information.governance@york.gov.uk The information we collect will be included in presentations, statistics and reports. Any presentations, reports and statistics for publication or use outside of the authorised council staff, will be anonymised and cannot be linked back to you or individuals.   Reports containing anonymous information may also be shared with the general public and other organisations. 

We will protect it and make sure nobody has access to it who shouldn't and we will not keep it for longer than is necessary. Where we use Survey Monkey to process responses, you can find out how they use your information, at http://www.surveymonkey.com/mp/legal/privacypolicy/?ut_source=footer We will not use the information for any other purpose than set out in this privacy notice and will not disclose to a third party i.e. other companies or individuals, unless we are required to do so by law for the prevention of crime and detection of fraud, or, in some circumstances, when we feel that you or others are at risk. You can find out more about how the City of York Council uses your information at https://www.york.gov.uk/privacy Storage of information We will keep the information you give us in CYC's secure network drive and make sure it can only be accessed by authorised staff. 

How long will we keep the information? We will keep the information you give us for up to six years and then will securely and confidentially destroy it. Where required or appropriate, at the end of the retention period we will pass onto the City Archives any relevant information. Further processing If we wish to use your personal information for a new purpose, not covered by this Privacy Notice, we will provide you with a new notice explaining the purpose prior to commencing the processing and the processing conditions. Where and whenever necessary, we will seek your consent prior to the new processing. 

Your rights To find out about your rights under data protection law, you can go to the Information Commissioners Office (ICO): https://ico.org.uk/for-the-public/ You can also find information about your rights at https://www.york.gov.uk/privacy If you have any questions about this privacy notice, want to exercise your rights, or if you have a complaint about how your information has been used, please contact us at foi@york.gov.uk or on 01904 554145 or write to: Data Protection Officer, City of York Council, West Offices, Station Rise, York YO1 6GA.