What is the purpose of this privacy notice?
Cheshire East Council uses Artificial Intelligence (AI) technologies to help protect, enhance and develop services for residents, businesses and visitors. AI technologies may be used to improve access to information, support customer services, increase efficiency and enable the Council to continue delivering high-quality services.
We remain committed to handling your personal information securely and in accordance with UK data protection legislation. This privacy notice explains what information we collect, why we collect it, how it is used and who it may be shared with.
As AI technologies continue to evolve, the Council may introduce new AI-enabled services and capabilities. This privacy notice will be reviewed and updated periodically to ensure it remains accurate, transparent and up to date.
Processing of information may occur within Council-managed systems, Council-approved cloud environments and approved AI technology platforms used on behalf of Cheshire East Council.
Cheshire East Council is the Data Controller for personal information processed as part of AI-enabled services.
Key information
- Cheshire East Council uses Artificial Intelligence technologies to support selected services.
- Personal information is processed in accordance with UK GDPR and Data Protection legislation.
- Microsoft Azure OpenAI services operate within Microsoft's UK and EU Data Zone.
- Information submitted to Council AI services is not used to train Microsoft's foundation AI models.
- Council officers remain responsible for decisions affecting residents and services.
How do we collect information from you?
Most information is collected directly from you when you:
- visit the Cheshire East Council website
- submit online forms
- use customer portals
- interact with digital assistants or chat services
- contact the council by email
- contact the council by telephone
- write to the council
- visit council offices or service locations
Some information may also be received from:
- government departments
- other local authorities
- NHS organisations
- partner organisations delivering services on behalf of the council
- educational establishments
- employers, landlords or financial institutions where appropriate
- law enforcement agencies
- other statutory organisations
What types of information do we collect from you?
Depending upon the service being provided, information processed may include:
- name and personal details
- address information
- contact details
- date of birth
- financial information
- council service records
- customer enquiries and correspondence
- information submitted through forms and applications
- information generated during interactions with council services
- usage information relating to council digital services
Some services may require the processing of special category information, including health, care, safeguarding, equality and other sensitive personal information where a lawful basis exists.
Where special category or sensitive personal information is processed using AI-enabled services, additional technical, organisational and governance controls are applied to protect that information and ensure compliance with data protection legislation.
What is the lawful basis?
The lawful basis for processing information using AI technologies will depend upon the service being delivered and may include:
- Article 6(1)(b) UK GDPR – Contract
- Article 6(1)(c) UK GDPR – Legal Obligation
- Article 6(1)(e) UK GDPR – Public Task
- Article 6(1)(f) UK GDPR – Legitimate Interests, where appropriate
Where special category information is processed, the council may rely upon:
- Article 9(2)(b) – Employment and Social Protection
- Article 9(2)(f) – Legal Claims
- Article 9(2)(g) – Substantial Public Interest
- Article 9(2)(h) – Health and Social Care
Why will we use your information?
The council uses AI technologies as part of existing services and operations.
Information may be used for:
Development and testing
The council develops and implements AI technologies to improve service delivery, accessibility, efficiency and customer experience.
Benefits may include:
- automating routine tasks
- improving access to information
- supporting decision making
- reducing delays
- improving customer experience
- improving operational efficiency
- supporting innovation across council services
Operational use
Once deployed, AI technologies may support:
- website search and information retrieval
- digital assistants and chat services.
- customer service processes
- categorisation of enquiries
- routing requests to appropriate teams
- service improvement activities
- analytical and reporting capabilities
How is your information used?
Your information is used to:
- design, configure, test, evaluate and improve AI-enabled services
- deliver customer services
- assist customer communications
- improve digital services and customer experience
- improve operational processes
- support analytics, reporting and service planning
- support research, evaluation and service improvement activities where appropriate
Information submitted to council AI services is not used to train Microsoft's foundation AI models.
When interacting with AI-enabled services, responses may be assisted by artificial intelligence technology. AI-generated content may occasionally be inaccurate or incomplete and important decisions will continue to be subject to appropriate human review and oversight.
Research and statistics
Anonymised or pseudonymised information may be used for research, planning, analytics and statistical purposes where permitted by law.
Who has access to your information?
To provide AI-enabled services, Cheshire East Council works with approved data processors acting on the council's behalf. Appropriate contractual, confidentiality, security and data protection obligations are in place with all suppliers.
| Processor | Service Provided | Arrangement |
|---|---|---|
| Microsoft Corporation | Azure Cloud Services and Azure OpenAI Services | Microsoft Customer Agreement and Data Processing Terms |
| ICS.AI Ltd | AI Development Services | Call-Off Contract under the G-Cloud Framework |
| datatechfactory GmbH & Co. KG | Value Reseller for AudioCodes | Service Contract |
| AudioCodes | Cloud-based Audio Processing and Transcription Services | Service Contract |
The council does not sell personal information and does not share personal information for marketing purposes.
International data transfers
The council's core systems are primarily hosted within the United Kingdom.
Some approved technology suppliers supporting AI-enabled services may process information within the United Kingdom and European Union.
Where information is transferred outside the United Kingdom, appropriate safeguards are implemented in accordance with UK data protection legislation.
| Processor | Processing Location | Safeguard |
|---|---|---|
| Microsoft Azure OpenAI Service and Azure Cloud Services | United Kingdom and European Union (Microsoft Data Zone) | UK Adequacy Regulations and Contractual Safeguards |
| datatechfactory GmbH & Co. KG | Germany | UK Adequacy Regulations |
| AudioCodes | Netherlands | UK Adequacy Regulations |
Do we use automated decision making?
AI-enabled services may assist with:
- categorisation of enquiries
- prioritisation and triage
- information retrieval
- drafting responses to routine enquiries
- routing requests to appropriate services
Cheshire East Council does not currently use AI systems to make solely automated decisions that produce legal or similarly significant effects on individuals without appropriate human oversight.
Council officers remain responsible for decisions affecting services, outcomes and statutory responsibilities.
Where applicable, individuals may request human intervention and review in accordance with their rights under UK GDPR.
What are your rights in relation to the personal data we process?
Find out more about your data protection rights and how to exercise them in our Data and Information Rights guidance
How long will we keep your information for?
We will only retain your personal information for as long as necessary to fulfil the purposes for which it was collected or another lawful purpose.
Retention periods are defined within the council's Information Asset Register and Information Management policies.
When information is no longer required, it will be securely deleted or destroyed.
What security precautions are in place?
Appropriate physical, technical and organisational controls are in place to protect information against unauthorised access, loss, misuse, alteration and disclosure.
AI-enabled services used by the council are subject to security, privacy and governance reviews before deployment. Access to information is restricted to authorised personnel and monitored in accordance with council policies and procedures.
While every effort is made to secure information, no electronic system can ever be guaranteed to be completely secure.
Keeping your information up to date
Cheshire East Council aims to ensure that personal information held is accurate, complete and kept up to date.
Please notify us if your personal information changes so that our records can be updated where appropriate.
Changes to this privacy notice
This privacy notice will be reviewed periodically and updated where necessary to reflect changes in legislation, technology, suppliers, AI capabilities or council services.
The latest version of this notice will always be available on the Cheshire East Council website.