Threatening and Abusive Behaviour (TAB) Register Privacy Notice

Service being provided

Maintaining the Threatening and Abusive Behaviour (TAB) Register to provide staff with relevant and proportionate information on service users to keep them safe whilst providing council services.

Categories of personal data we collect

• Name
• Postcode
• Gender

Special Category data we collecy

• Medical (where relevant)
• Information about behaviour, incidents, risks or reasonable adjustments, only where relevant to assessing and managing staff safety.

Source of data

We collect personal information:

• directly from you
• from managers or supervisors
• from incident or accident reports

In some cases, information may also be provided by emergency services, insurers, or other organisations involved in an incident.

Consequences of failing to provide personal data

This notice explains how we use personal information where it is necessary and proportionate to protect employees, contractors and others delivering council services from a reasonably foreseeable risk of harm. The register is not based on consent; where information is recorded, we will use the minimum information needed to assess and manage the risk.

Data Controller and Processors

The Data Controller is Worcester City Council. 

The Data Protection Officer for Worcester City Council can be contacted at This email address is being protected from spambots. You need JavaScript enabled to view it.  

Purpose of Processing 

• To allow authorised staff to check relevant locations, such as postcode or street name, before providing a service and identify whether there is a recorded and current risk associated with a service user or address.
• To allow adequate risk assessments to be carried out prior to service provision.
• To allow a continuation of service provision with appropriate measures in place.

Lawful basis for processing personal data

• Article 6(1)(e) – Public task, where processing is necessary for Worcester City Council to perform its official functions in delivering council services safely and managing risks to employees and others.
• Where a specific activity is not part of the Council’s public task, we may rely on Article 6(1)(f) – legitimate interests. In those cases, the legitimate interest is protecting employees and others from harm and we will complete and keep a legitimate interests assessment showing that the processing is necessary, proportionate and balanced against the individual’s rights and freedoms.

Lawful basis for processing special category data

• Article 9(2)(b) – employment, social security and social protection, where processing is necessary to meet legal obligations and exercise rights connected with employment and health and safety; and/or Article 9(2)(g) – substantial public interest, where applicable.
• Data Protection Act 2018, Schedule 1, Part 1, paragraph 1 – employment, social security and social protection; and, where relevant, Schedule 1, Part 2 conditions such as paragraph 18 – safeguarding of children and individuals at risk. We will maintain an appropriate policy document where required.

Who we share the information with

The TAB register is an internal only system. The information recorded in it is only shared on a need-to-know basis with internal teams where relevant to their role.

Access is restricted to authorised staff who need the information to assess and manage risk. We will not share more information than is necessary for the specific service interaction, and information will not be used for unrelated purposes.

Automated decision-making

We do not use automated decision-making or profiling in relation to this processing.

How long we hold your information

We will only keep your information for the minimum period necessary. The information outlined in this privacy notice will be kept in accordance with our retention schedule. Entries on the TAB register are kept for 3 years but can be removed earlier if circumstances change. All information will be held securely and destroyed under confidential conditions.

Entries will be reviewed regularly to ensure they remain accurate, relevant and necessary. Where the risk has reduced, the entry will be amended or removed. We will record the reason for adding, retaining, amending or removing an entry.

Your rights

You have rights under UK GDPR, including the right to:

• access your personal information
• ask us to correct incorrect or incomplete information
• ask for your information to be deleted (in certain circumstances)
• restrict how your information is used
• object to certain uses of your information
• request your information in a commonly used format (data portability)
• understand and challenge automated decisions and profiling.

We may not always be able to agree to a request if the law requires us to keep or use your information or we deem it as being captured as a legitimate interest for public safety.

If we restrict any right, we will explain why unless doing so would prejudice the purpose of the register or create a risk of harm. You may object to processing where we rely on legitimate interests or public task, and we will consider your objection in line with UK GDPR.

Complaints and further information

If you have questions or concerns about how your information is used, please contact the Data Protection Officer:

Email:        This email address is being protected from spambots. You need JavaScript enabled to view it. 
Phone:      01905 722233

Postal address:  

Data Protection Officer
Worcester City Council
The Guildhall
High Street
Worcester
WR1 2EY

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO):

Website:   https://www.ico.org.uk 

Phone:      0303 123 1113

Postal address:   

Information Commissioner's Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Changes to this notice

We may update this privacy notice from time to time. The latest version will always be available on our website.