Privacy notice relating to how we use Artificial Intelligence in the Council
Introduction
This privacy notice explains how Rhondda Cynon Taf County Borough Council (referred to as ‘RCTCBC’, ‘Council’, or ‘we’) uses Artificial Intelligence (AI) tools to support our work and improve services. The main AI tool we use is Microsoft 365 Copilot, which works within familiar Microsoft programs like Word, Outlook, and Teams. We chose Copilot because it helps staff work more efficiently while keeping your information safe and secure, in line with data protection laws.
This notice explains how personal data may be used when Council staff use AI tools such as Copilot and should be read alongside the Council’s data protection pages on our website:
Data Protection | Rhondda Cynon Taf County Borough Council
For information about how personal data is handled when Copilot is used to support meetings and visits, please refer to the separate Meeting Recording, Transcription and Copilot Privacy Notice, available on the Council’s website:
How we use your personal information - service privacy notices | Rhondda Cynon Taf County Borough Council
The Data Controller
The Council is the data controller for personal data processed through the use of AI tools including Copilot. We are registered with the Information Commissioner’s Office (ICO) under reference Z4870100.
Queries Relating to This Privacy Notice
If you have any questions about how your personal data is being used in relation to AI, please contact the relevant Council service.
For general questions about this privacy notice, or about how AI is being used within the Council, please contact the Digital Improvement Office at: digitalimprovement@rctcbc.gov.uk
What is Artificial Intelligence
Artificial Intelligence (AI) refers to computer systems that can perform tasks that usually require human thinking, like understanding language, summarising information, or making suggestions.
At Rhondda Cynon Taf Council, we use a tool called Microsoft 365 Copilot. It works within everyday software that many staff use at work, such as Microsoft Word (for documents), Excel (for spreadsheets), Outlook (for emails), and Teams (for online meetings and chats).
This tool helps Council staff work more efficiently, for example, by helping to write reports, summarise meeting notes, or organise information. It does not make decisions on its own and is always used to support, not replace, human judgment.
AI tools like Copilot are also used to support meetings and home visits, for example, by helping to summarise discussions or capture action points. These uses are explained in more detail in the Council’s separate privacy notice on meeting recording and transcription.
All AI tools are used within secure Council systems and follow strict data protection rules to keep your information safe.
Whose personal data we process
We may process personal data when our staff use AI tools to help them do their job and to support the Council in delivering its services. The type of personal data processed will depend on the task they are undertaking. This may include data relating to:
- Members of the public
- Service users
- Customers
- Residents
- Partner organisations
- Elected members
- Council staff
Example: If a staff member uses an AI tool to help draft a response to a resident’s enquiry, the tool may process the resident’s name, contact details, and the nature of their enquiry, based on information the Council already holds.
The categories of personal data we process
When staff use AI tools to support their work, the tools may use personal information that is already held in Council systems. The type of information involved can vary depending on the task being carried out. This may include:
- Names
- Contact details (such as phone numbers or email addresses)
- Addresses
- Case reference numbers
- Information about services received
- Notes or summaries from meetings or visits
- Health or care-related information
Example:
If a member of staff uses Copilot to help draft a response to a complaint, Copilot may use (process) personal data about the person who made the complaint, such as their name, contact details, and the nature of the issue raised.
If a social worker uses Copilot to help summarise a case file, the tool may process information about a child and their family, such as names, support needs, and key events based on records the Council already holds. This helps the worker prepare reports or assessments more efficiently, while still applying their professional judgment.
Why we process the personal data
We use AI tools such as Copilot to help Council staff do their jobs more effectively. This includes:
- Saving time on tasks like writing, summarising, or organising information
- Providing suggestions to help staff make informed decisions
- Making services more accessible for people who need extra support
- Improving how we deliver services to the public
Any content generated by AI is always reviewed by staff to make sure it is accurate, appropriate, and in line with Council policies.
Our lawful basis for processing the personal data
We do not collect new personal data when using AI tools. Instead, we use information the Council already holds to help staff carry out their work.
This means we rely on the original lawful basis under which the data was collected. In most cases, this will be:
- Article 6(1)(e) – Public Task – if it helps us carry out our public duties
- Article 6(1)(c) – where we have a legal obligation to use the information
- For more sensitive information (such as health or care needs), we rely on specific legal reasons that allow us to use it in the public interest (Article 9(2)(g))
If you would like to know more about the legal basis for using your personal, please refer to the privacy notice for the relevant Council service. These can be found on our website: RCT Service Privacy Notices.
Who or where we get the personal data from
AI tools like Copilot do not collect new personal data. They only work with information that the Council already holds in its secure systems. This information may come from:
- Individuals who have provided their details to the Council (for example, when applying for a service or making a complaint)
- Documents, emails, or records created by Council staff as part of their work
- Information shared with us by other organisations (such as schools, health services, or government bodies) as part of delivering services
When staff use AI tools, they can only access and process information they are already authorised to use.
Who we share personal data with
Any content generated by AI is used to support the work of staff and is not routinely shared outside of the Council. AI-generated outputs are treated the same as any other draft or working document created by a staff member.
Data Processors
We use Microsoft and other trusted IT providers to deliver and support the AI tools used by the Council, such as Copilot.
These companies act as data processors on behalf of the Council. This means they only use your personal data as instructed by us, and they are not allowed to use it for their own purposes. All processing is carried out under strict contracts and security standards to protect your information.
How long we retain the personal data
AI tools are used to support staff in completing their work, such as drafting documents or summarising information. Any personal data processed by AI is retained only as long as necessary for the task it supports.
Where AI is used to help create a document, email, or report, the final version is saved and kept in line with the Council’s normal retention policies. Temporary drafts or AI-generated suggestions are not kept unless they form part of the final record.
Your data protection rights
Under the UK General Data Protection Regulation (GDPR), you have important rights over your personal data. This includes the right to access any personal data the Council holds about you, including information captured in meeting recordings or transcripts.
Click here for further information on your information rights and how to exercise them.
Your right to make a data protection complaint to the Council
If you are concerned about how your personal data has been used, you have the right to raise a complaint with the Council.
We recommend contacting the relevant service area first, as many issues can be resolved quickly and informally. If you are not satisfied or would prefer to raise a formal complaint, you can do so through the Council’s Customer Feedback Scheme:
Make a comment, compliment or complaint online
You can also contact the Council’s Data Protection Officer at Information.management@rctcbc.gov.uk.
Your right to make a data protection complaint to the ICO
You also have the right to complain to the ICO if you are unhappy with how we have used your data. However, we encourage you to contact us first and provide us with an opportunity to look into your concern and put things right.
The ICO can be contacted:
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline number: 0303 123 1113
- Website: https://www.ico.org.uk