Introduction
This privacy notice is intended to provide information about how Rhondda Cynon Taf County Borough Council (referred to as ‘RCTCBC’, ‘Council’, ‘Local Authority’, ‘we’) will use (or ‘process’) personal data about individuals for the purpose of managing and handling insurance and compensation claims.
Whilst we have tried to make this privacy notice as clear and concise as possible, the categories of personal data we process may vary depending on the nature of the claim and the circumstances of each case. Should you require further information relating to a specific claim please do not hesitate to contact us using the contact information below.
This notice should be read in conjunction with the Council’s main privacy notice.
The Data Controller
The Council is the data controller for the personal data processed for the purposes of managing and handling insurance and compensation claims.
The Council is registered with the Information Commissioner’s Office (ICO) as a controller under reference Z4870100.
Queries relating to this privacy notice
If you have any questions or queries relating to this privacy notice please contact the Insurance Service;
By email : RCTInsurance@rctcbc.gov.uk
In writing : Rhondda Cynon Taf County Borough Council, Legal Services – Insurance Section
2 Llys Cadwyn, Taff Street, Pontypridd, RCT, CF37 4TH
Who we are what we do
The Council’s Insurance Services support the management of insurance and compensation claims made against the Council. This includes investigating claims, assessing liability, managing claims on behalf of the Council, and working with relevant internal teams and external organisations where necessary to progress, defend, or settle claims.
Whose personal data we process
We may process personal data relating to the following individuals to manage and handle insurance and compensation claims;
- individuals who make a claim for compensation against the Council
- individuals who are involved in, or affected by, an incident giving rise to a claim
- Council employees, contractors, witnesses, or other individuals whose information is relevant to the investigation or management of a claim
The categories of personal data we process
We may process the following categories of personal data to manage and handle insurance and compensation claims;
- personal details (such as name, address, date of birth and contact details)
- information relating to the claim or incident (including descriptions of events, correspondence, photographs, CCTV footage, and witness statements)
- special category data where relevant and necessary, such as health information in relation to personal injury claims
Why we process the personal data
We process the personal data to manage and handle insurance and compensation claims. This may include but is not limited to the following activities;
- investigating claims and assessing liability
- managing, defending, settling, or responding to claims for compensation
- preventing and detecting fraud and complying with legal and regulatory obligations
Our lawful basis for processing the personal data
Under the General Data Protection Regulation (GDPR), our lawful basis for processing the personal data to manage and handle insurance and compensation claims is;
- Legal Obligation (c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
- Public Task – Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Substantial public interest – Article 9 (2) (g) – processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
- Data Protection Act 2018, Schedule 1, Part 2, paragraph 6 – statutory and government purposes.
The primary legislation, regulations and guidance that supports this includes, but is not limited to;
- Local Government Act 1972
- Civil Procedure Rules
Who or where we get the personal data from
We may receive the personal data from the following categories of individuals or organisations;
- the individual making a claim for compensation against the Council
- other individuals involved in, or affected by, the incident giving rise to a claim (such as witnesses, representatives, or family members)
- Council departments and services involved in investigating the incident or claim
- organisations that support the Council in managing claims, such as claims handling providers, legal advisers, insurers (where applicable), and investigators
- courts or tribunals if the claim becomes part of a legal process
Who we share personal data with
We may share the personal data with the following key organisations to manage and handle insurance and compensation claims.
When sharing personal data, we only share the minimum amount necessary for the purpose. The information shared and who it is shared with will depend on the nature and circumstances of the claim and how it is progressed.
Where a claim is made against the Council, we do not rely on an individual’s consent to share personal data for the purposes of investigating, managing, defending, or settling the claim. Information is shared where it is necessary and proportionate to fulfil these purposes.
|
Who
|
Purpose
|
|
Internal Council departments and services
|
To investigate what happened and gather relevant information. For example, this may include asking a service area for records, reports, or staff statements relating to the incident.
|
|
Claims handling providers
|
Sometimes the Council may appoint a claims handler to manage a claim on its behalf. Where this happens, we will share relevant information with them so they can help the Council deal with the claim and communicate with the person making the claim. The Council currently uses claims handling providers such as Risk Management Partners and Gallagher Bassett.
|
|
Legal advisers and representatives
|
To obtain legal advice and support the defence, response, or settlement of a claim. For example, solicitors may be asked to advise on legal risk or represent the Council if proceedings are issued.
|
|
Insurers (where applicable)
|
Where a claim is covered by an insurance policy, information may be shared so the insurer can consider indemnity and manage the insured element of the claim. Not all claims involve an external insurer. The Council currently holds insurance with providers such as QBE and Chubb.
|
|
Investigators and professional advisers
|
To help establish the facts or assess specific aspects of a claim. For example, this may include obtaining expert reports, site inspections, or medical evidence in injury claims.
|
|
Courts or tribunals
|
If the claim becomes part of a legal process. For example, information may be disclosed as part of court proceedings or in response to directions from a judge or tribunal.
|
Data Processors
A data processor is a company or organisation that processes personal data on our behalf. Our data processors act only upon our instruction. They cannot do anything with the personal data unless we instruct them to do so. They will not share the personal data with any organisation apart from us or use it for their own purposes. They will hold it securely and retain it for the period we instruct.
The categories of data processors we use for the purpose of managing and handling insurance and compensation claims may include organisations that provide case management systems and other technical or administrative support services to the Council.
How long we retain the personal data
We retain the personal data contained within insurance and compensation claim records for:
|
Length of time
|
Reason
|
|
7 years from the date the claim is closed
|
To meet legal, regulatory, audit, and evidential requirements, including the management and defence of legal claims.
In some cases, particularly where personal injury claims, claims involving children, or long‑term liability issues arise, records may be retained for longer where this is necessary for legal or evidential purposes
|
In keeping with the General Data Protection Regulation storage limitation principle, records are periodically reviewed. Not all personal data is retained. Only personal data that is relevant to the claim record is retained for the entire retention period (for example, documents that evidence decisions, outcomes, or actions taken). Information that has no long‑term or evidential value is routinely destroyed in the normal course of business.
Your data protection rights
The General Data Protection Regulation (GDPR) gives individuals important rights, including the right of access to the personal data that the Council holds about you.
Click here for further information on your information rights and how to exercise them.
Your right to make a data protection complaint to the Council
You have the right to complain to the Council if you believe we have not handled your personal data responsibly and in line with good practice.
You can do this by contacting the Insurance Service directly via one of the following communication methods. Most concerns can be resolved relatively quickly through a simple phone call or email;
- Email: RCTInsurance@rctcbc.gov.uk
- In writing: Rhondda Cynon Taf County Borough Council, Legal Services – Insurance Section, 2 Llys Cadwyn, Taff Street, Pontypridd, RCT, CF37 4TH
Alternatively, you can raise a formal complaint via the Council’s Customer Feedback Scheme using the following link (Make a comment, compliment or complaint online) or you can contact the Council’s Data Protection Officer at Information.management@rctcbc.gov.uk.
Your right to make a data protection complaint to the ICO
You also have the right to complain to the ICO if you are unhappy with how we have used your data. However, we encourage you to contact us first and provide us with an opportunity to look into your concern and put things right.
The ICO can be contacted:
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline number: 0303 123 1113
- Website: https://www.ico.org.uk