The services process personal data to manage insurance claims made against Worcestershire County Council either directly or jointly with partners and commissioned private and third sector providers. This includes:

• to receive, log and assess claims made against the Council
• to gather evidence, verify facts and determine liability
• to prepare for potential litigation or legal defence
• to determine appropriate settlement offers or rejections
• to communicate with solicitors, insurers or courts
• to identify and investigate potentially fraudulent claims
• to assess insurance coverage needs and policy adjustments
• to inform risk assessments and future claims mitigation strategies
• for reinsurance and premium calculation where third-party insurers are involved

The service processes personal data which is relevant to individual cases which may include, but is not limited to, the following personal data:

• personal details - e.g. name / age / family details / national insurance number
• contact information - e.g. telephone number / address / email address
• claim specific details - e.g. nature and date of incident / location of incident / claim reference or policy number / supporting evidence (e.g. photographs or witness statements)
• financial and bank details - e.g. bank account number / invoices, receipts or estimates for damaged items
• employment information - e.g. occupation and employer details / time off work or sick leave records / employment injury or workplace-related claim details
• vehicle registration and insurance details
• details of damage to property assets

We may also process some special category (sensitive) data, which is relevant to individual cases and may include some of the following but is not limited to:

• medical / health information
• criminal offence data (if relevant to a fraud investigation)

The legal bases for processing this personal data are:

• Legal obligation (UK GDPR Article 6 (1)(c)) - processing is necessary to comply with the law
• Public task (UK GDPR Article 6 (1)(e)) - processing is necessary to perform a task in the public interest

The special category conditions for processing are:

• Legal claims and judicial acts (UK GDPR Article 9 (2)(f)) - processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
• Reasons of substantial public interest (UK GDPR Article 9 (2)(g)) - processing is necessary for preventing or detecting unlawful acts (condition 10 of Schedule 1 of the DPA 2018), preventing fraud (condition 14 of Schedule 1 of the DPA 2018) and insurance (condition 20 of Schedule 1 of the DPA 2018)

We may need to share the personal information you have given to us or we’ve collected about you with partner organisations where relevant to the individual and/or their care provision. These include but are not limited to:

• police
• local authorities
• Worcestershire County Council’s insurance company, brokers and associated partners, such as loss adjusters, claims handlers and solicitors
• claims handling software provider

Information will only ever be shared when it is strictly necessary to help us provide effective services and you may have the right to refuse. We will not pass it onto any other parties unless required to do so by law or in all reasonable circumstances the disclosure is fair and warranted for the purposes of processing or subject to a data protection exemption.

We have specific data sharing agreements in place with local agencies and sometimes the law requires that we may have to pass your details on to a third party, for example, to prevent crime.

We will only keep your information for the minimum period necessary. The standard record retention for insurance claims made by adults is 6 years after the closure of the claim. All information will be held securely and destroyed under confidential conditions. More information about our retention periods can be found in our Disposal Schedule.

Please note stated retention periods may be subject to any legal holds imposed under the Inquiries Act 2005 that may concern the information and override standard retention periods.

You are entitled to a copy, or a description, of the personal data we hold that relates to you, subject to lawful restrictions. Please go to our Make a Data Protection Request webpage to find out how to make a request.

You may be entitled to rectification, restriction, objection, and erasure of your personal information depending on the service and legal basis. Please in the first instance contact the Insurance Team at wccinsurance@worcestershire.gov.uk

You can also contact the Corporate Information Governance Team (CIGT) at Worcestershire County Council by calling 01905 845571 or emailing dataprotection@worcestershire.gov.uk to exercise these Information Rights or call the main Worcestershire County Council contact telephone number of 01905 765765.

Please see our overarching Privacy Notice for further contact details and if you have a complaint about your information rights.