Privacy notices

Luton Borough Council – Children, Families & Education Directorate

Who we are

Luton Borough Council ('the council'), Town Hall, Upper George Street, Luton LU1 2BQ, is responsible for delivering services to children, young people and families. For this research project, the Council works in partnership with the University of Bedfordshire.

The council and the university may each act as data controllers, because each organisation decides what information it needs for the research and how it will be used. This is in line with the information sharing agreement for this project.

What this project is about

The What it Means to Me research project aims to understand the experiences, needs and perspectives of children and young people involved in the Violence and Exploitation Prevention Partnership.

The findings will help the council and partners improve support, services and safeguarding arrangements.

No decisions about you will be made based on this research. All final outputs will be anonymised.

What personal data we collect

If you choose to take part, the research team may access and collect the following information from your case file:

• personal data
  • date of birth
  • gender
• special category data (sensitive information):
  • ethnicity
  • religion
  • care status
  • health information

We only collect the information that is necessary for the research. If it is not listed above, it will not be used.

Where the information comes from

Information is taken from your Children’s Services case record held by the council.

The University of Bedfordshire researchers will have secure, time limited access to this information for up to six months, and will then create a final anonymised dataset.

Lawful basis for using your information

Because the council is a public authority, we process personal data for this research using:

• article 6(1)(e) UK GDPR – public task:
  • processing necessary for work carried out in the public interest

For special category information, the council relies on:

• article 9(2)(j) UK GDPR – research purposes
  • processing necessary for scientific or historical research with safeguards

Your consent

You will be asked whether you want to take part.

• If you take part, you (and your parent/carer where needed) will complete a consent form.
• You can change your mind and withdraw your consent within two weeks of receiving your consent form by telling your caseworker or contacting the research team.

Withdrawal only affects new use of your information; anything already anonymised cannot be undone.

How your information is used

Your information will only be used for this research project and only by trained researchers who are authorised to access it.
We apply strict research safeguards required under Article 89 UK GDPR, including:

• using the smallest amount of information needed
• restricting access to authorised researchers
• ensuring any publications are anonymous
• not using identifiable information for any decisions about you
• not using your information for any other purpose

Who your information is shared with

Your identifiable information is shared only with University of Bedfordshire (research team). They are also a data controller for the information they receive.

No information will be disclosed to any other organisation unless the law requires it.

How we keep your information safe

Both the council and the university must comply with:

• the Data Protection Act 2018
• the Common Law Duty of Confidence
• all relevant safeguarding, security and retention requirements

This means:

• information is stored on secure ICT systems
• sensitive data is not sent by unsecured email
• paper copies are not used
• data is destroyed securely when no longer needed
• only people who need access for the research can see identifiable information

If information needs to be transferred outside secure systems, it will be on an encry.