Wrthi'n llwytho
Does dim crynodeb o'r cyfarfod hwn eto. Caiff un ei ysgrifennu pan fydd y cyngor yn cyhoeddi'r cofnodion. Mae'r agenda a'r papurau isod.
Response by Head of Service: Further to the response published on 16 August, please see below the remaining responses to the four outstanding questions. The questions are repeated. What agreements or contracts are in place with third-party suppliers who provide the Wi-Fi connection, ensuring they adhere to data protection standards? · Standard contracts are in place for companies procured by PCC and these cover Data Protection standards. Is there a process for users to access, rectify, or request the deletion of their personal data if needed? · Each individual town will sign a data sharing agreement and as data controller, they will provide an email address that individuals can contact regarding their personal data. Additionally, there is an opt out option on the splash page and on any email correspondence the user may receive after consenting to do so. How frequently is the data protection compliance of the Wi-Fi projects reviewed or audited? · The standard review for data protection compliance is 3 years. Can we also have a copy of the cabinet paper on when this project was presented and approved? · This project was a Shared Prosperity Fund (SPF) project and was not presented or approved via Cabinet. It was approved via the SPF Panel Board. Response published 16 August 2024. Please see below responses to your questions. We have provided a response to most of the questions raised, however there are 4 questions that we are awaiting officer responses from, who are currently on leave. The 4 remaining questions will be responded to by the 28th of August. Your questions are repeated for ease of reference. • Data Collection and Processing: • What specific personal data is collected from users when they connect to the public Wi-Fi? · A Device’s Media Access Control (MAC) Address (i.e., a MAC address identifies different devices using the same local network, such as computers, smartphones, etc. It’s a 12 digit hexadecimal number.) · Name (Forename and Surname) (only collected based upon an individual’s consent when signing up to marketing from the Town/Community Group.) · Email Address (Again collected based upon an individual’s consent when signing up to marketing from the Town/Community Group) Therefore, unless the individual chooses to provide their name and email address for the purposes of marketing, the only data collected will be the device’s Media Access Control address. o How is this data stored and secured during and after collection? · MAC Addresses: MAC Addresses are anonymised (using hashing & salting) and then deleted daily should a request for Wi-Fi not be made by the individual. · Name & email addresses: Names and email addresses are stored securely within an encrypted database for 12 months, but a user who originally provided consent can withdraw such consent at any point, at which point their name and address will be removed from the database. Should they then decide to reconnect to Wi-Fi, then the system will recognise them as a new user. · • Are there measures in place to anonymise or pseudonymize the collected data? · Yes, MAC Addresses are anonymised (using hashing & salting) and then deleted daily. • Consent and Transparency: • How is user consent obtained before collecting personal data? Is it explicit and informed? · Consent is obtained through a “Splash Page”, which is the initial page that presents itself on a user’s device when they try to connect to the free Wi-Fi system. User’s are provided with both the Terms and Conditions and Privacy Policy. • Can users easily withdraw their consent, and if so, how is this process managed? · Yes. User’s can withdraw their consent and opt-out of marketing at any point by pressing the unsubscribe button that presents itself with each communication. Once a user triggers this, then their information (name and email address) is removed from the secure database. • What methods are used to ensure users are aware of how their personal data will be used, including the privacy notice and terms presented on the Splash page? · Both the Terms of Conditions and Privacy Notice are presented (via a link) to the user on the Splash Page. • Can PCC make it clear if is it an opt-in system or will data be collected without consent and what the difference between the two systems of collecting data · PCC are not the controller for the collection of personal data in relation to free town Wi-Fi. Further information will follow. See response to previous questions • Data Retention and Deletion: • How long is personal data retained after it's collected, particularly for those who opt into marketing materials? · 24 hours (MAC Address) 12 months (Name & Email) • Are there automated processes in place to delete data after the retention period ends, or is this managed manually? • The system to delete data is managed automatically. • Data Access and Security: • Who has access to the aggregated statistics and analytics derived from the collected data? · Access to aggregated statistics and analytics (e.g., footfall, dwell time) can be accessed by anyone with a computer. There is no requirement to log into a dashboard. • What security measures are implemented to protect the data from unauthorised access or breaches? · With regards to MAC address details. This data is not classed as personal data so does not pose any security issue as it is anonymised on collection. With regards to personal data, names and email addresses are stored securely within an encrypted database for 12 months. This data can be accessed by the data controller for each of the towns. The controller must be registered with the ICO to access and use the data. An agreement between the data controller and the data processor will confirm this process. • Compliance and Oversight: • How does Powys County Council ensure that each Town Council or registered group complies with data protection regulations as controllers? · PCC are not responsible for ensuring each Town Council or registered group complies with data protection regulations. However, PCC recognise the importance of such obligation’s towns have as a controller, therefore PCC have undertaken due diligence to ensure the processing of personal data is secure as possible, by: o Undertaking a Data Protection Impact Assessment to support the initiatives. o Ensuring written agreements required under Data protection legislation, such as Data Processing Agreements are entered into by all parties. • What agreements or contracts are in place with third-party suppliers who provide the Wi-Fi connection, ensuring they adhere to data protection standards? · Standard contracts are in place for companies procured by PCC and these cover Data Protection standards – more information to follow • User Awareness and Control: • How are users informed about their rights regarding their personal data under data protection laws? · Privacy notice • Is there a process for users to access, rectify, or request the deletion of their personal data if needed? · Response to follow, however all data subjects have the right to contact the controller of their information to request such actions. • Monitoring and Accountability: • How frequently is the data protection compliance of the Wi-Fi projects reviewed or audited? · Response to follow • What steps are taken to address any breaches or complaints related to data protection? · Data protection complaints and personal data breach investigations would be the responsibility for controllers to undertake, though Powys County Councill will provide assistance. These questions should help clarify how personal data is handled, protected, and managed within the context of the community Wi-Fi projects, ensuring transparency and compliance with data protection regulations. In light of the complexity and legal impact of data handling are PCC taking responsibility or are they expecting the local organisation to take on the legal responsibility? If so this could put individuals and organisations at risk if any legal challenge is another concern raised. Can you confirm who will be legally responsible for this ? · Data Protection legislation determines the party with data protection responsibilities i.e. the controller, each town council/community is the party that determines the purpose for the processing of personal data for the provision of WIFI Services. Can we also have a copy of the cabinet paper on when this project was presented and approved? Response to follow
Rhaid i gynghorwyr ddweud pan fydd ganddyn nhw gysylltiad personol â rhywbeth sy'n cael ei drafod, fel swydd, eiddo neu aelod o'r teulu. Mae buddiant sy'n rhagfarnu yn ddigon cryf i'r cynghorydd adael yr ystafell fel arfer a pheidio â chymryd rhan.
Caiff datganiadau eu darllen o'r cofnodion unwaith y byddan nhw wedi'u cyhoeddi.
Dyw'r cyngor ddim wedi cofnodi presenoldeb ar gyfer y cyfarfod hwn.
Yn rhestru cynghorwyr presennol y cyngor yn unig. Nid yw aelodau cyfetholedig, swyddogion a chyn-gynghorwyr yn cael eu dangos.