Libraries privacy notice

What is the lawful basis for collection and processing of personal and special category data?

Ealing Council is legally required to provide a library service under the Public Libraries and Museums Act 1964.  To provide this service efficiently and carry out this public task, we need your consent to hold and process your data. If you do not provide this we will be unable to provide a library service to you. We have a legitimate interest in holding your data for audit and quality control and to enable the handling of enquiries and complaints.

What kind of information does Ealing Council have about me?

We would need to collect and process personal information for adults and children such as name, date of birth, address, email address, gender, and special category information such as ethnicity, disability and/or special educational needs, and religion (optional).

What do you do with information about me?

You are providing your information to Ealing Council, contact details The council’s data protection officer can be contacted by emailing or phone 020 8825 5124.

Your information is collected for the purpose of providing access to a comprehensive public library service as required to fulfil the council’s duties under the following legislation, statutory or contractual requirement or obligation.

Your information will be shared with the following organisations:



Library Management System

Personal information to provide access to library resources

Debt vollection

Contact and finance information will be shared for debt collection

Online resource providers

Name and library card number to provide access to Ealing purchased licences.

Other Local Authority members of the London Libraries Consortium

All data as part of London wide library provision, allowing access to libraries where you live, study and work without the need to duplicate input.

Other Ealing Council departments

Contact and personal information in relation to safeguarding issues


Contact and personal information, on request.

The council obtains information from the following sources:



Other Local Authority members of the London Libraries Consortium

All data as part of London wide library provision, allowing access to libraries where you live, study and work without the need to duplicate input.

Once your information has been collected by the council, it may be used by other local authority members of the London Libraries Consortium, where necessary, to provide a complete service to you across London as part of the London Libraries Consortium. This will save you providing the information multiple times if you live, study or work across London.

Ealing Council does not process your information with third countries outside of the UK or EU zone without the safeguards being in place that are equivalent to the General Data Protection Regulation/ Data Protection Act 2018.

Your information shall be processed for seven years from last use where debt is involved or two years if no debt is outstanding.

Information will be obtained by consent of a parent or legal guardian for children under the age of 16. This consent maybe withdrawn at any time.

If you fail to provide the personal data, you will be unable to access computers in the library, make use of lending facilities or attend library events.

Ealing Council shall process your information in adherence to your information rights under the General Data Protection Regulation/ Data Protection Act 2018.

Ealing Council is required by law to protect the public funds it administers. We may use any of the information you provide to us for the prevention and detection of crime. We may also share this information with other bodies that are responsible for auditing or administering public funds including the Public Sector Audit Appointments Ltd, National Audit Office, Financial Reporting Council, Cabinet Office, the Department for Work and Pensions, and other local authorities, HM Revenue and Customs, and the Police.

In addition to undertaking our own data matching to identify errors and potential frauds we are required to take part in national data matching exercises undertaken by the National Fraud Initiative. The use of data by the National Fraud Initiative in a data matching exercise is carried out under its powers in Part 2A of the Audit Commission Act 1998. It does not require the consent of the individuals concerned.

If you are dissatisfied with the processing of your information, you can raise your concern with the council’s data protection officer. You have a right to lodge a complaint with the Information Commissioner’s Office (

How do I know the information about me is kept safely?

All the information we collect is stored securely on our IT systems and manual filing systems. We have strict procedures for the way this is done. Any and all information about you is treated as confidential and with respect. There are also clear rules and guidance about storing, recording and sharing information which staff receive training on.

We take information sharing very seriously. Appropriate council and health staff are DBS (disclosure and barring service) checked. Any member of staff who is found to be breaking the rules will be dealt with through appropriate disciplinary procedures.

Are the records confidential?

All Ealing Council employees have a duty of care in accordance with our data protection policy. This includes respecting that right to confidentiality.

How long are records held?

There are different rules for different documents and/or information kept by the council. We are required by law to keep records for varying lengths of time depending on individual circumstances.

Don't you need my permission to keep and share information about me?

We would need your consent if the local authority's legal basis for collecting and processing your personal information is consent.

Although your information is confidential, we may have to share information about you/your family without your permission. These reasons are:

  • To protect you from harm, neglect, abuse or significant threat
  • When you may need urgent medical treatment
  • To prevent or detect a crime
  • To comply with a legal obligation

You can withdraw your consent by contacting

Are there any laws applicable in the processing and protection of my information?

There are a number of laws which allow for the protection, collection and processing of your personal information for this purpose, such as:

  • Public Libraries and Museum Act 1964
  • The General Data Protection Regulations and The Data Protection Act 2018
  • Children’s Act 2004
  • Childcare Act 2006 as amended Section 9 of the Apprenticeships, Skills, Children and Learning Act 2009.
  • The Common Law Duty of Confidence
  • The Human Rights Act 1998
  • NHS Guidelines - Caldicott Principles, which govern the sharing of patient identifiable information

Can I see the information you have collected about me/my family?

Yes, you can request a copy of the information held. This is called a subject access request under the General Data Protection Regulation/ Data Protection Act 2018 which contain certain rights of individuals and their personal data. For more information regarding your rights, please see the privacy notice

Who should I contact if I want further information or to complain about the use of my personal information?

Please see the privacy notice for more information on how we use your information.

The council’s data protection officer is Mrs L. Cox, email or telephone 020 8825 5124 during office hours.