(A PDF version of the document below is available via Privacy Notice )
Worcestershire Regulatory Services (WRS) is not a legal entity. It is part of the 6 district councils of Worcestershire (Bromsgrove District Council, Malvern Hills District Council, Redditch Borough Council, Worcester City Council, Wychavon District Council and Wyre Forest District Council,) who decided to work in partnership to deliver their Environmental Health and Licensing functions. These 6 partners are the Data Controllers for the purposes of the new General Data Protection Regulation with respect to the data they hold about you, including data held by WRS. All of them are committed to protecting your privacy when you use council services, including the services of WRS.
The Privacy Notice below explains how WRS uses information about you on behalf of the 6 partner authorities and the ways in which we protect your privacy.
Environmental Health and Licensing services discharge a range of legal duties that the Councils are required to undertake relating to Food law enforcement, Health and Safety at Work law enforcement, Environmental Protection law enforcement and the Licensing of various activities and the enforcement of associated conditions required either in law or by policy. Much of the law relating to Environmental Health involves the enforcement of criminal sanctions. A full list of the legislation currently enforced by WRS on behalf of the 6 partners can be made available on request to: email@example.com
What is Personal Data?
Personal data means data which relates to a living individual who can be identified from that data, or from that data and other information which is in the possession of, or is likely to come into the possession of the 6 partners through the activities of WRS.
What are your rights?
You have the right to request the following from the partner councils and this will include anything relevant held at WRS via our partner authorities. The relevant partner council will consider any request inline with the current regulations.
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
Why we use personal information and what level of information do we process?
The six partner councils may need to use some information about you to:
- deliver services and support to you;
- manage services;
- train workers;
- help investigate any worries or complaints you have about your services;
- keep track of spending on services;
- check the quality of services; and
- help with research and planning of new services.
WRS collects personal information in order to perform the services which we provide on behalf of the 6 partner councils as part of their statutory functions. Where services are not part of these functions, WRS may seek your consent to collect and process your personal information.
What type of information will we keep about you?
At WRS, if you are a member of the public and you contact us we will use your information to create a case record for you and we are responsible in law for decisions relating to the security and use of your personal information.
The things we will need to record to either assist you or to investigate the matter that you wish to bring to our attention are likely to include:
- Details about you such as your full name and date of birth,
- Contact details such as address, telephone number, and e-mail address where available;
- Information relevant to the services being provided, for instance details about your complaint or the incident that you wish to bring to our attention including;
- The dates and location of relevant events,
- The names and addresses of any perpetrators,
- A description of the impact this incident has had on you including any personal injuries you may have suffered if, for example, the incident related to an accident at work,
- Any symptoms you may have, for example in relation to a food poisoning allegation
- Any financial loss you may have suffered due to the incident you are raising.
If you are a business that we regulate on behalf of the 6 partners, WRS may hold a record of your business activities and what you do, which may include personal information about you or people you may employ including:
- Your name and address
- If your company is a limited company, the name of our contact and/ or the names and addresses of the company’s Directors
- The names and addresses of relevant people in your business, for example the Designated Premises Supervisor for the license to supply alcohol
- Images of you, for instance if you are a licensed taxi driver
- Incidents reported to us by members of the public involving your business activities or the conduct of your business
Generally speaking, we will not use your information without your permission for purposes not directly related to the statutory functions we provide on behalf of the 6 partners. If your information is to be used for purposes such as training or planning and improving services, your information will be anonymised.
It might be necessary to share your information for a purpose not related to the services if:
- In a non-work related situation, your health or safety, or that of others, is at risk;
- We wish to prevent, or have information that could assist with the investigation of a crime;
- We need to comply with any other legal obligation.
How can you access the information we hold about you?
You have the right to ask for all the information that the partner Councils have about you and, if you are a sole trader in business, your services. When they receive a request from you in writing, the 6 partners must normally give you access to everything they have recorded about you including materials held by WRS.
However, the partners and WRS will not let you see any parts of your record which contain:
- Confidential information about other people; or
- Information a care professional thinks will cause serious harm to your or someone else's physical or mental well-being; or
- If we think that providing you with the information will prevent or hinder the investigation of a crime; or reveal investigative techniques that could undermine future regulatory or enforcement activity.
Where the processing of your data is carried out by automated means, you can ask for your personal data to be supplied in a commonly used format. This may be particularly relevant you want to send it to another organisation.
How can you request correction of inaccurate information?
You should let the relevant partner Council know if you disagree with something written on your file. You may not always be able to change or remove the information. However, we will correct factual inaccuracies and may include your comments in the records. To make a request email the relevant partner local authority Data Protection Officer identified at the end of this notice. This will normally relate to the place you live or do business.
How can you request for your information to be erased?
If you want the partner Councils to stop processing and erase your information, you are entitled to request this under specific circumstances:
- Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
- When the individual withdraws consent (where consent was relied upon for the original processing).
- The personal data was unlawfully processed (i.e. otherwise in breach of the GDPR).
- The personal data has to be erased in order to comply with a legal obligation.
- The personal data is processed in relation to the offer of information society services to a child.
To make a request, email the relevant partner local authority identified at the end of this notice. This will normally relate to the place you live or do business.
How can you restrict processing of your information?
You can request for the processing of your personal information to be restricted under the following circumstances:
- Where you contest the accuracy of the information
- It was unlawfully processed but you do not want it to be deleted.
- It is due to be deleted but you require it kept because of a legal claim.
- You have objected to the processing of the data and you are waiting for a decision about the objection.
To make a request, email the relevant partner local authority identified at the end of this notice. This will normally relate to the place you live or do business.
How do we keep information secure?
WRS and the partner authorities will take appropriate steps to make sure we hold records about you (on paper and electronically) in a secure way and ensure they are up to date. We will only make them available to those who have a right to see them. In order to ensure that your information is used appropriately and that your privacy is respected, your personal information will be held and used in compliance with the requirements of all applicable legislation.
Our security measures include:
- Access controls on systems
- Security training for all staff
How long do we keep your personal information?
Worcestershire Regulatory Services keep personal information in line with our retention and disposal schedule.
You have the right to request that the partner Councils stop processing your personal data in relation to any council service including WRS. However, if this request is approved this may cause delays or prevent us delivering a service to you. Where possible we will seek to comply with your request but we may need to hold or process information in connection with one or more of the partner Councils statutory functions that we discharge.
Who will we share your personal information with?
The 6 partner councils use a number of commercial companies and partners to either store personal information or to manage it on their behalf. Where they have these arrangements there is always a contract, memorandum of understanding or information sharing protocol in place to ensure that the organisation complies with data protection law. Arrangements involving sensitive personal data will have been formally assessed in more detail for their compliance with the law.
WRS and the 6 partners may also share your personal information when we feel there is a good reason that is more important than protecting your confidentiality.
For WRS this is most likely to be for the detection and prevention of crime/fraudulent activity; or
- if there are serious risks to the public, our staff or to other professionals;
- to protect a child; or
- to protect adults who are thought to be at risk, for example if they are frail, confused or cannot understand what is happening to them.
- If the issue raised is a serious public health matter that presents a wider risk to the community
For all regulatory services, information and intelligence sharing is key to protecting the public in the modern trading environment. Criminals engaging in activities that fall within the WRS remit do not respect local authority borders nor do they limit the crimes they commit to one type of activity. To tackle these people, it is important that WRS shares intelligence with other enforcement bodies in Worcestershire like West Mercia Police, Hereford and Worcester Fire and Rescue Service and the other regulatory arms of the 6 partner Councils, plus national bodies like the Environment Agency and the Health and Safety Executive. We also share intelligence where it is relevant with our neighbouring local authority regulatory services and more widely with partners where this is relevant.
When using personal data for research purposes, the data will be anonymised to avoid the identification of an individual, unless consent has been given for the use of the personal data.
We do not sell personal information to any other organisation for the purposes of direct marketing.
WRS would not normally share your data beyond the UK border, however, if you are a sole trader in business engaging in business activities outside of the UK, for example, via your website and the service is contacted by non-UK government or non-UK local government regulators, WRS acting on behalf of the relevant partner will consider whether there is a suitable legal gateway to allow the sharing of information, particularly where the issues raised relate to criminal activities.
Such sharing of information is likely to be facilitated via the Competition and Markets Authority, the Food Standards Agency or similar national regulatory bodies.
Should the data we hold on you lead us to conclude that you may be involved in criminal activity WRS may look to create a profile of you by requesting information held by other law enforcement agencies to build on that held by the organisation. Profiling requests will only be done when authorised at a Tasking Meeting by an officer of the rank of Team Manager or above, in consultation with the service’s Intelligence Officer. Once a profile is created it will be designated Official Sensitive and it will only be seen by officers on a need to know basis. Profiles will only be shared with other criminal enforcement agencies where necessary for the prevention or detection of crime and when this is in the public interest. The Intelligence Officer will indicate on the completed profile, the list of partners who may have an interest in the intelligence contained in the profile. Data sharing will only occur once approved at a Tasking Meeting by an officer of the rank of Team Manager or above.
This form of profiling is not caught by the new provisions under the revised data protection regime as it is not automated. It is an essential part of modern crime fighting and necessary for the prevention and detection of criminal activity. However, WRS and the partners will ensure that controls are in place to prevent unnecessary intrusion into people’s private lives.
Data Protection Officer (DPO)
As a service operating on behalf of 6 partner authorities, WRS would direct any queries initially to the Data Protection Officer for the area where you live. The contact details for these are outlined below. Redditch/ Bromsgrove and Wychavon/ Malvern Hills have shared workforces so contacts for these partners are the same:
Redditch Borough Council and Bromsgrove District Council: contact Deborah Poole by emailing: firstname.lastname@example.org
Malvern Hills District Council and Wychavon District Council: contact Meesha Patel by emailing either: SAR@malvernhills.gov.uk or SAR@wychavon.gov.uk
Wyre Forest District Council: contact Mark Tipper by emailing email@example.com
Worcester City Council: contact Timothy O’Gara by emailing: firstname.lastname@example.org
Where can I get advice, or lodge a complaint?
For independent advice about data protection, privacy and data sharing issues, or to lodge a complaint if you think your data has been mishandled, you can contact the Information Commissioners Office (ICO) at:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number Alternatively, visit ico.org.uk or email email@example.com.
Cookies are pieces of data that are often created when you visit a website, and which are stored in the cookie directory of your computer. A number of cookies are created when you visit worcsregservices.gov.uk.
Cookies do not contain any personal information about you, and they cannot be used to identify an individual user.
You can set your browser not to accept cookies. If you do not know how to do this, contact us, giving details on the type of browser you are using, and we will do our best to help, or use the "How to control cookies" related link. Please note that if you do set your browser not to accept cookies many of the enhanced features may not work correctly.
Your browser accesses the cookie file again when you visit the website that created the cookie file. The browser uses the information stored in the cookie file. This is to help ease your navigation of the website, letting you log in automatically or remembering settings you selected during your earlier visits to the website.
Any particular website cannot access information on your computer other than the cookie it set on your computer. The cookie is not executable code so it doesn't have any “life” of its own other than being used by the website that created it. As explained above, such use is limited to helping your browser process the information located on the website.
Essentially this is the memory of your internet browser where you can find all your cookies stored in a format that facilitates easy retrieval by a browser.
The information generated by the cookies about your use of our website (including your IP address) will be transmitted to and stored by Google on servers in the United States.
Google will use this information for the purpose of evaluating your use of our website, compiling reports on website activity and providing other services relating to website activity and internet usage.
Google may also transfer this information to third parties when required to do so by law, or where such third parties process the information on Google's behalf.
Google undertakes not to associate your IP address with any other data held by Google. To opt out of being tracked by Google Analytics across all websites visit
Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, we would recommend looking at https://www.allaboutcookies.org.
The Council does not use Analytic cookies for any other purpose than reporting site use and does not share information with anyone outside of the Council.
Social Media Links
Links in the page footer pass temporary cookies to the social media sites (Facebook, Twitter etc.) which just include the address of the page you wish to share.
These cookies should not be saved to the computer as they are "cached" in the browser:
Cookie: Google Analytics Name: _utma , _utmb, _utmc, _utmz
Purpose: These cookies are used to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitor have come to the site from and the pages they visited.
More information: An overview of privacy at Google
You can stop cookies being downloaded on to your computer or other device by selecting the appropriate settings on your browser. If you do this, however, you may not be able to use the full functionality of this website.
There is more information about how to delete or stop using cookies on https://www.allaboutcookies.org/.
If you wish, you can also opt out of being tracked by Google Analytics. Further information on the use of personal information can be found at Information Commisioner website
Data Matching Exercises:
Fair Processing The local authorities that created WRS are required by law to protect the public funds they administer. They may share information provided to them with other bodies responsible for; auditing, or administering public funds, or where undertaking a public function, in order to prevent and detect fraud.
The Cabinet Office is responsible for carrying out data matching exercises.
Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.
Acting on behalf of its 6 partners, WRS participates in the Cabinet Office's National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise. The use of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under the Data Protection Act 1998.
Data matching by the Cabinet Office is subject to a Code of Practice. For further information please see the link to the Cabinet office website Cabinet office website
By emailing: firstname.lastname@example.org