Report Template

4 – Gaps in data and knowledge

4.1	What are the main gaps in information and understanding of the impact of your proposal?
4.1	When conducting your screening, you may have discovered gaps in data or knowledge that make it difficult to assess whether your proposal had a positive or negative impact on human rights/equalities. Please indicate actions you will take to resolve this gap. As your proposal progresses you may be able to resolve this knowledge gap –please indicate when it was resolved.
	Gaps in data or knowledge	Action to deal with this	Date resolved
	Limited equality monitoring information relating specifically to affected leaseholders	Continue direct engagement and identify individual requirements through negotiations.
	Future residents are not yet known	Continue to use housing needs and affordability evidence.
	Individual health, disability or support needs that may emerge during negotiations	Assess and respond on a case-by-case basis.

Step 5 - Maximising positive impacts

5.1

What has been done to optimise opportunities to advance equality / human rights or foster good relations?

· The Council continues to pursue voluntary acquisition and negotiated settlements as its preferred approach.

· Ongoing engagement has been undertaken with affected leaseholders.

· The proposal supports the delivery of 36 affordable homes and associated community benefits.

· Compensation and acquisition processes would be undertaken in accordance with statutory requirements.

· Individual circumstances and support needs of affected parties will continue to be considered throughout the process.

· Any future recommendation to make a CPO would be subject to further Executive approval and a detailed Statement of Reasons.

Step 6 – Recommendations and conclusions of the assessment

6.1	Having considered the potential or actual impacts you should be in a position to make an informed judgement on what should be done. In all cases, document your reasoning that justifies your decision.
	Important: If there are any adverse impacts you cannot mitigate, please provide a compelling reason in the justification column. There are four main options you can take:
	No major change to the proposal	The HREAT demonstrates the proposal is robust. There is no potential for unlawful discrimination or adverse impact and you have taken all opportunities to advance equality / human rights and foster good relations, subject to continuing monitor and review.
	Adjust the proposal	The HREAT identifies potential problems or missed opportunities. This involves taking steps to remove any barriers, to better advance quality or to foster good relations.
	Continue with the proposal (despite the potential for adverse impact)	You should clearly set out the justifications for doing this and how you believe the decision is compatible with our obligations
	Stop and remove the proposal	If there are adverse effects that are not justified and cannot be mitigated, you should consider stopping the proposal altogether. If a proposal leads to unlawful discrimination it should be removed or changed.

Option Selected

Conclusion / justifications

No major change to proposal.

The assessment identifies significant positive impacts for low-income households, households in housing need and the wider community through the delivery of affordable housing, environmental improvements and neighbourhood regeneration.

The proposal supports the Council's housing, affordability, health and regeneration objectives and promotes the human right to adequate housing.

Whilst a limited number of leasehold interests may be affected, the Council continues to prioritise voluntary acquisition, negotiation and reprovision where appropriate. Any future use of compulsory purchase powers would be subject to statutory safeguards, compensation rights and a further Executive decision. Therefore, the proposal is considered proportionate, justified and compatible with the Council's equality and human rights obligations.

Step 7 – Summary of agreed actions resulting from the assessment

7.1	What action, by whom, will be undertaken as a result of the impact assessment.
	List below the actions or mitigations that have been identified and who will be responsible to carrying them out. Add as many lines as you need.
	Impact / Issue	Actions to be taken	Person Responsible	Timescale
	acts	Continue negotiations and seek acquisition by agreement wherever possible	Head of Housing Delivery	Ongoing
	Individual support needs	Consider accessibility, communication and support requirements on a case-by-case basis	Housing Delivery Team	Ongoing
	Community engagement	Continue transparent communication with residents and stakeholders	Housing Delivery Team / Communications	Ongoing
	Equality monitoring	Review equality considerations if a future CPO report is brought to Executive	Housing Delivery Team	Prior to any future CPO decision

Step 8 - Monitor, review and improve

8.1

How will the impact of your proposal be monitored and improved upon going forward?

Consider how will you identify the impact of activities on protected characteristics, other marginalised groups and human rights going forward? How will any learning and enhancements be capitalised on and embedded?

The Council will continue to monitor equality and human rights impacts through ongoing engagement with affected leaseholders and stakeholders. Any equality concerns raised during negotiations will be recorded and addressed where appropriate.

Should officers seek authority to make a Compulsory Purchase Order in the future, the assessment will be reviewed and updated to reflect the latest information, engagement outcomes and identified impacts. The Council will continue to ensure equality, affordability, housing need and community wellbeing remain central considerations throughout project delivery.

Annex B: Data Protection Impact Assessment (DPIA)

Equity, Diversity & Inclusion (EDI): Protected characteristics

Under the public sector duties introduced by the Equality Act 2010 public bodies must have due regard for the need to:

· Eliminate unlawful discrimination, harassment and victimisation and other conduct prohibited by the act, such as the failure to make reasonable adjustments for disabled people

· Advance equality of opportunity between people who share a protected characteristic and those who do not

· Foster good relations between people who share a protected characteristic and those who do not

These duties relate to the nine protected characteristic groups defined by the Equality Act 2010 (outlined in the table below).

The Council recognises that a person’s socio-economic background and whether they live in a rural or urban location can be important factors in determining fair access to services, employment and treatment. When carrying out analysis, you must also consider socio-economic issues and rural / urban location issues. In addition to the nine protected characteristic the HREAT includes the following equality groups:

· Carers

Low income groups

· Veterans, armed forces community

· Experience of care/Other (other groups that are impacted)

Human rights differ from equalities in two main ways:

- First, human rights apply to everyone and not just groups with protected characteristics.

- Second, they allow for the balancing of rights, priorities, and risks. Many rights are not absolute and can be limited or qualified in particular circumstances.

The following guidance identifies which rights are most likely to be engaged by proposals in certain policy areas. This doesn’t mean that you should not consider whether other rights might be engaged.

There are three types of human rights in the Human Rights Act:

Absolute rights: Cannot be breached in any circumstances e.g. right to life and to protection from torture and inhuman or degrading treatment.

Limited rights: can only be restricted in specific situations e.g. a person can be deprived of their liberty if they are convicted of an offence and imprisoned.

Qualified rights: human rights can be restricted if it is in the interests of the wider community or to protect other people’s rights e.g. freedom of movement and assembly were restricted during the Covid-19 pandemic in the interests of public health.

As limited and qualified rights are not absolute, they sometimes have to be balanced in decision making. In Table 1, absolute rights are indicated with an *; limited rights with a **; and qualified rights with a ***.

Right

Description

Focus Area

Right to life

Nobody, including the Government, can take someone’s life away. Public authorities must take appropriate measures to safeguard life including by protecting people whose life might be in danger.

Public authorities should also consider the right to life when making decisions that might endanger or affect life expectancy.

When public officials may be involved in an instance when someone died, public authorities must investigate.

Benefits and money

Births, deaths and marriages

Children and families

Environment and animals

Health and social care

Housing

Planning and building

Waste and recycling

Right to liberty and security

It focuses on protecting individuals’ freedom from unreasonable detention, as opposed to protecting personal safety. However, there is case law from other jurisdictions where this right also covers personal safety in conditions other than detention.

Right to liberty and security

Freedom from torture and inhuman or degrading treatment	Torture consists in causing very serious and cruel physical or mental pain or suffering. Inhuman treatment or punishment is treatment which causes intense physical or mental suffering. Degrading treatment means treatment that is extremely humiliating and undignified. Inhuman or degrading treatment could include: serious physical assault; very severe detention conditions or restraints; serious physical or psychological abuse in a health or care setting.	Children and families Health and social care
Right to marry and start a family	Right of men and women of marriageable age to marry and to start a family.	Births, deaths and marriages
Prohibition of slavery and forced labour	Slavery is when someone owns someone else like a piece of property. Servitude is when someone provides services to a person for no reward and is unable to stop due to coercion. Forced or compulsory labour is when someone is forced to do work to which they have not agreed to, under the threat of punishment.	Children and families Jobs, training and volunteering People and communities
Right to a fair trial	This right is triggered when someone is charged with a criminal offence and have to go to court, or a public authority is making a decision that has an impact on someone’s civil rights or obligations.	Environment and animals Health and social care People and communities Streets, roads and pavements
No punishment without law	No one can be charged with a criminal offence for an action that was not a crime when it was committed. Public authorities must explain clearly what counts as a criminal offence so that people know when they are breaking the law.	Environment and animals People and communities Streets, roads and pavements
Right to property	No public authority, without very good reason can take away one’s property, which may include things like land, houses, objects, shares, licences, leases, patents, money, pensions and certain types of welfare benefits. This right applies to companies as well as individuals.	Benefits and money Business Council tax Environment and animals Housing Planning and building Travel and transport Streets, roads & pavements Waste and recycling
Right to private and family life, home and correspondence	This includes one’s right to determine their sexual orientation, lifestyle, and the way one looks and dresses. It also includes the right to control who sees and touches one’s body. It further covers one’s right to develop their personal identity and to forge friendships and other relationships, the right to participate in essential economic, social, cultural and leisure activities. In some circumstances, public authorities may need to facilitate the enjoyment of one’s right to a private life, including their ability to participate in society. It also means that personal information about anyone (including official records, photographs, letters, diaries and medical records) should be kept securely and not shared without their permission, except in certain circumstances.	Benefits and money Births, deaths and marriages Children and families Health and social care Jobs, training and volunteering Parking and permits Planning and building Schools and education Sports and leisure
Right to free elections	Public authorities must support the right to free expression by holding free elections at reasonable intervals. These elections must enable anyone to vote in secret.	Births, deaths and marriages People and communities
Freedom of thought, conscience and belief	This may include the right to change religion or beliefs, the right to put one’s thoughts and beliefs into action, for example by exercising the right to wear religious clothing, the right to talk about one’s own beliefs or take part in religious worship. Public authorities cannot stop anyone from practising their religion, without very good reason. This right protects a wide range of non-religious beliefs including atheism, agnosticism, veganism and pacifism. This includes the right to express views aloud (for example through public protest and demonstrations) or through published articles, books or leaflets, television or radio broadcasting, works of art, the internet and social media. It further protects the right to receive information from other people by, for example, being part of an audience or reading a magazine.	Business Schools and education
Freedom of expression	This includes the right to express views aloud (for example through public protest and demonstrations) or through published articles, books or leaflets, television or radio broadcasting, works of art, the internet and social media. It further protects the right to receive information from other people by, for example, being part of an audience or reading a magazine.	Business Environment and animals People and communities Schools and education Sports and leisure
Freedom of assembly and association	This encompasses the right to form and be part of a trade union, a political party or any another association or voluntary group. Nobody has the right to force anyone to join a protest, trade union, political party or another association.	Environment and animals Jobs, training and volunteering People and communities Travel and transport Streets, roads and pavements
Right to education	This right protects one’s right to an effective education within the UK's existing educational institutions. It relates to primary, secondary, and higher education. Parents have a right to ensure that their religious and philosophical beliefs are respected during their children’s education.	Children and families Environment and animals Jobs, training and volunteering People and communities Schools and education Sports and leisure
Right to housing	Adequate housing must provide more than four walls and a roof. For housing to be adequate, it must, at a minimum, meet the following criteria: Security of tenure, that is legal protection against forced evictions, harassment and other threats; availability of services, materials, facilities and infrastructure; affordability, which means that housing is not adequate if its cost threatens or compromises the occupants’ enjoyment of other human rights; Habitability, which relates to physical safety or adequate space, as well as protection against the cold, damp, heat, rain, wind, other threats to health and structural hazards; accessibility, in that it must accommodate the specific needs of disadvantaged and marginalised groups; location, which means that it must not be cut off from employment opportunities, health-care services, schools, childcare centres and other social facilities, or it must not be located in polluted or dangerous areas; cultural adequacy, which means that it must respect and take into account the expression of cultural identity.	Benefits and money Housing People and communities Planning and building Waste and recycling

Data Protection Impact Assessment (DPIA)

Reference Number (if applicable)
Lead/contact name:	Zoe Dunn
Directorate:	City Development
Service Area:	Housing Delivery
Data controller details:	City of York Council
Data processor details:	City of York Council and any appointed land referencing consultants, property advisors or legal advisors (where applicable)
Information Asset Owner: (All systems/assets must have an Information Asset Owner (IAO). Intranet \| Information on the roles of SIRO, IAO, IAA, DPO and CG (york.gov.uk)	Head of Housing Delivery
Information Asset Administrator: (All systems / assets usually have an Information Asset Administrator (IAA) who reports the IAO as stated above. Intranet \| Information on the roles of SIRO, IAO, IAA, DPO and CG (york.gov.uk)	Housing Delivery Team
Customers and stakeholders: Please list all involved including both internal and external parties	· Leaseholders of affected garages and storage units / parties with legal interests in the land · Housing Delivery Team · Legal Services / Appointed Legal Team · Appointed land referencing consultants · Executive Members and relevant stakeholders

Step 1 – Identify the need for a DPIA

Hints and tips to complete this section:

Refer to the completed DPIA screening questions

It was identified that a DPIA would be needed ***.

The purposes of the proposed, new or change in process, service, technology, or project are ****this could be copies of extracts from or links to project docs, business cases etc****

The above will realise several benefits including: *** e.g. what are the expected benefits for individuals/the council etc

See customers and stakeholders above and/or describe when and how you will seek individuals’ views – or the reasons it’s not appropriate to do so and/or refer to the equalities impact assessment Intranet | Equalities and human rights (york.gov.uk)

If you need to describe “purposes” because there are no other documents, consider the below points

· what do you want to achieve

· what is the intended effect and/or outcome for individuals, the council etc

· are there any unintended effects and/or outcomes for individuals, the council etc

The proposal seeks approval in principle to prepare for the potential use of compulsory purchase powers under Section 17 of the Housing Act 1985 to support delivery of the Willow House affordable housing scheme.

To enable preparation of any future Compulsory Purchase Order, the Council will undertake land referencing activities and maintain records relating to individuals and organisations with legal interests in land required for the development. This will include ownership information, leaseholder information and correspondence records required to support negotiations and statutory processes.

The purpose of the processing is to:

Identify persons with a legal interest in land.
Facilitate ongoing negotiations and voluntary acquisition where possible.
Enable preparation of statutory notices and supporting CPO documentation if required.
Ensure the Council can comply with legal obligations associated with any future compulsory purchase process.

The expected benefits include:

Accurate identification of affected parties.
Effective communication and engagement with leaseholders.
Compliance with statutory CPO requirements.
Support for delivery of 36 affordable homes and associated regeneration benefits.
Stakeholder engagement has been undertaken through direct correspondence, meetings and negotiations with affected leaseholders and interested parties

Step 2 – Describe the information flow

Hints and tips to complete this section:

The collection, use and deletion of information should be described here.

It may be useful to use a flow diagram or another visual way or data map/flow/list to explain information flows.

If there will be any card payments taken as part of the processing, need to confirm if online and/or card machine and which “system” is used to process the payments taken

HM Land Registry.
Existing Council records.
Direct contact with affected leaseholders.
Professional property advisers and land referencing consultants.
Legal representatives acting on behalf of affected parties.

Information will be stored within Council systems and shared only with officers and professional advisers involved in land assembly, negotiations and any future CPO process. Information will be retained in accordance with Council retention schedules and securely deleted when no longer required.

Provide details of personal, special category and criminal offence data being processed by checking all options that apply. Add any additional items and their description, in the ‘other’ option.
Personal data
Name	☒	NHS Number	☐
Address	☒	NI Number	☐
Post Code	☒	IP Address	☐
Date of Birth/Age/Age group	☐	Photograph	☐
Telephone Number(s)	☒	Email Address	☒
Other: Please describe	☒	Land ownership details, Leasehold interest details, Compensation negotiation records, Property title information, Correspondence records
Special Category Data
Religion	☐	Ethnicity	☐
Health Information	☐	Trade Union Membership	☐
Political Opinions	☐	Sexual Orientation	☐
Biometric Data	☐	Other: Please describe e.g. Carer	☐
Criminal offence and/or history data
Please describe:			☐

Provide details of data subjects - checking all that apply. Add any additional items in the ‘other’ option.
Residents	☒	Customers/Clients/Citizens	☒
Children/young people	☐	Vulnerable people/groups	☐
Staff/employees/agency staff	☐	Volunteers	☐
Other: Please describe	☒	Leaseholders, Property Owners, Land interest holders, Occupiers where relevant

Step 3a – Identifying risks & solutions

The following questions will highlight any risks associated with the principles of the UK General Data Protection Legislation (UK GDPR) and Data Protection Act 2018 (DPA) and other privacy legislation Where a risk is identified, it should be carried forward to the table in Step 3b below, where mitigation and evaluation should be recorded. Suggestions/hints/tips are shown in italics
Data protection/ privacy Issue	Response	Risk (Yes/No)
/IAA?	Head of Housing Delivery and relevant Housing Delivery officer	No
How many individuals affected?	Small number of leaseholders and land interest holders	No
Nature of relationship	Statutory land assembly and property negotiations	No
How is information collected?	Land Registry, Council records and direct engagement	No
Who has access?	Housing Delivery, Legal Services and appointed consultants	No
Is any information shared within CYC?	Yes, where necessary to progress the project	No
Is any information shared externally with other organisations?	Potentially with appointed land referencing consultants, valuers and legal advisers under contract	No

What is the lawful basis for processing personal data?	Article 6 (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.	No
What is the lawful basis for processing special categories of personal data	Article 9 (g) Reasons of substantial public interest (with a basis in law)	No
What is the lawful basis for processing criminal conviction or offences including past criminal convictions or offences	Article 10	No
Will information be processed in a way that goes beyond an individual’s reasonable expectations?	No. Individuals would reasonably expect the Council to process ownership and contact details in connection with land acquisition and statutory processes.	No
Do we have any previous experience of this type of processing?	Yes. The Council has previous experience of land acquisition, regeneration schemes and associated property negotiations.	No
How will you tell the individuals about the use of their information?	This will be included in the PN	No
Does the privacy notice cover the processing activities, or does it need amending?	The Council's existing privacy notices relating to property and land management functions are likely to cover much of the proposed processing. A review will be undertaken before commencement of formal land referencing activity to ensure processing associated with any future compulsory purchase process is adequately covered	Low
If you are relying on consent to process personal information, how will this be collected and what will you do if it is not given or withdrawn?	The processing is not reliant upon consent. Processing is undertaken under the Council's statutory functions and legal obligations. Consent is therefore not the lawful basis being relied upon.	No
Purpose Limitation
Have you identified all the purposes at Step 1 for which you will use information?	Yes. The purposes include land referencing, ownership verification, engagement with affected parties, acquisition negotiations, compensation assessment, preparation of statutory documentation and compliance with compulsory purchase legislation.	No
Does the processing achieve your purpose(s)?	Yes. The processing is necessary to identify land interests, communicate with affected parties and ensure compliance with legal requirements relating to potential compulsory purchase activity.	No
Is there another way to achieve the same outcome?	No practical alternative exists. Identification of legal interests and communication with affected parties is a legal requirement and essential precursor to any potential compulsory purchase process.	No
How will you ensure data minimisation i.e. only collecting/processing the minimum amount for the purpose(s)?	Only information required to identify legal interests, communicate with affected parties and satisfy legal or statutory requirements will be collected and retained. Unnecessary personal information will not be requested or stored.	No
How will you ensure there is no “function” or processing creep?	Information will only be used for purposes directly connected to land assembly, negotiations, compensation matters and statutory processes associated with the Willow House development. Any proposed secondary use would require separate assessment and governance approval.	No

Can you ensure that the data collected is good enough for the intended purpose?	Yes. Information requirements are well established through statutory land acquisition and property practices. Collection will be limited to information required to identify affected parties and administer the process.	No
Is there any information that could be removed or anonymised without compromising the purpose(s) set out at Step 1?	Some reporting and monitoring information may be anonymised where personal identification is not required. However, ownership and contact details cannot be anonymised during active negotiations and statutory processes because the identity of parties must be known.	No
Accuracy
Can the information be amended and/or deleted if required?	Yes. Information can be updated, corrected or deleted in accordance with Council procedures, legal requirements and data subject rights where applicable.	No
How will you ensure information used will be accurate and up to date?	Information will be verified through Land Registry records, legal documentation, direct correspondence and periodic review during negotiations. Updates received from individuals or their professional representatives will be incorporated as necessary.	Low

Have you established retention periods for the information?	Yes. Information will be retained in accordance with the Council's records management and retention schedules applicable to land acquisition, legal and property records.	No
Does the new processing/system allow you to delete information in line with the retention periods?	Yes. Information held within Council systems can be managed and deleted in line with agreed retention schedules.	No
If there is a business need to retain information beyond the retention period, e.g. historical trend analysis, can the data be anonymised at this point?	Not anticipated. Where legal or audit requirements necessitate extended retention, records management procedures will be followed and anonymisation considered where appropriate.	No
Have you checked if there is there a legal or other requirement to transfer the data at the end of the retention period for permanent preservation e.g. City or National Archives? If there is, how will this be done?	Not anticipated	Low
How will it be destroyed/deleted or transferred?	Information will be securely deleted from electronic systems and confidentially destroyed where held in paper format, in accordance with Council records management procedures.	No
Security
If required, has the information security technical checks/questions been completed and approved by ICT/ICT security? OR has it identified any risks?	No new systems to be procured as part of this proposal.	No
Where will the information be stored?	Information will be stored within secure Council electronic document management systems, restricted-access project folders and approved corporate systems. Any external providers will be required to maintain equivalent security standards.	Low
Does the new or current system/ procedure/processing provide adequate protection against security risks?	Yes. Existing Council ICT controls, access restrictions, encryption, authentication measures and information governance procedures provide appropriate protection for the nature and scale of processing proposed.	Low
What is the current state of technology in this area and/or are there any relevant advances in technology or security?	The proposed processing utilises established property, legal and records management systems already used by the Council. Personal data will be stored within secure Council systems with role-based access controls, multifactor authentication and cyber security protections. No novel technology, AI solutions or automated decision-making tools are proposed. Current security arrangements are considered proportionate to the scale and sensitivity of the processing activity.	No
What training and guidance is or will be given to staff?	All CYC staff are required to complete regular mandatory DP and information security training – MyLo All CYC staff with access to NHS system are required to complete NHS eLearning dp/ig training	No
What data protection training has been undertaken by staff?		No
If a third party is being used, what is the data protection relationship e.g. independent controllers, joint controllers, controller / processor, or processor/controller?	N/A
If a third party is being used, is there a contract in place with the appropriate UK GDPR/DPA 2018 clauses and schedule if needed?	N/A
If a third party is being used, how have you checked that their processes are UK GDPR/DPA 2018 compliant?	N/A
Is the third party signed up to any approved code of conduct or certification scheme e.g.,	N/A
International Transfers
Will you transfer information outside of the EEA?	No	No
If transferring data outside of the EEA, does the country/ organisation demonstrate an adequate level of data protection?	N/A
If transferring information outside of the EEA, how will you ensure that the information is transferred securely?	N/A
Will you be using ‘Cloud Based’ systems to store or transfer information? If so, where is the geographical location of the server and does the system demonstrate and adequate level of data protection?	Information will primarily be stored within existing Council-approved systems and secure corporate storage environments. Any cloud-based services used by the Council are managed in accordance with corporate ICT and information governance requirements. No additional cloud platform is proposed as part of this project.	No
Rights of the Data Subject
How will you manage rights of individuals requests e.g. Subject Access Requests (SARs), request to rectify data, request to be forgotten, objection to processing, restriction?	In accordance with CYC policies and procedures	No
Does the system involve automated decision making? If so, do you have a process in place to facilitate human intervention?	No	No
Accountability
As a result of this new or change to processing, do you need to update entries in the Information Asset Register (IAR)/ROPA etc?	A review will be undertaken to confirm whether the processing activity is already captured within existing property and regeneration information assets. Updates to be made if required.	Low
As a result of this new or change to processing, do you need to update any Policies or Procedures?	None anticipated. Existing information governance, records management and property acquisition procedures are expected to provide an appropriate framework for the processing activity.	No
As a result of this new or change to processing, do you need to consider any Codes of Practice, regulatory guidance etc?	Yes. The processing should continue to comply with: UK GDPR. Data Protection Act 2018. Information Commissioner's Office guidance. Council Information Governance policies. MHCLG guidance relating to compulsory purchase procedures. Relevant records management and retention requirements.	No

Step 3b – Identifying risks & solutions

What are the risks and mitigations about data processing? Required information: privacy risks identified, mitigation/solution, evaluation (i.e. is the risk eliminated/reduced/accepted). Treat this in the same way as defining project risks but look at it from a customer and data point of view. It is good practice to include the risks identified here in the project or service area risk register so that they are monitored throughout the lifecycle of the project and/or service provision. Transfer any risks identified in Step 3a above into the below table, i.e. all those where Risk is Yes.
Risk	Mitigation / Solution(s)	Evaluation Is the risk eliminated, reduced, or accepted?
Personal/special categories data/criminal offence data transfer · More than is necessary · Not accurate / up to date · Not by secure methods	Information collected will be limited to that required for land referencing, negotiation and statutory purposes. Quality assurance checks will be undertaken before information is shared. Secure Council email systems, approved file transfer methods and restricted-access folders will be used. Land Registry and legal title information will be verified before use.	Reduced and accepted
Individuals/data subjects are not informed or can access their rights	· Privacy notices will be reviewed and updated where necessary. · Individuals will receive information through project correspondence and statutory notices. · Existing Council Subject Access Request and Information Rights processes will apply.	Reduced and accepted
Data breaches: Personal information may be exposed, leading to identity theft or fraud, financial fraud, physical harm, or other forms of malicious use e.g.	The risk is low. The following will be implemented: · Existing Council cyber security controls. · Role-based access permissions. · Secure storage arrangements. · Staff data protection training ongoing. · Information governance oversight. · Data sharing limited to those with a legitimate business need.	Reduced and accepted
Breach notification obligations to ICO/NHS etc: If a data breach occurs due to insufficient security, the organisation may fail to meet its obligation to promptly notify affected individuals and relevant authorities.	· Utilising CYC ICT, information governance team oversight, policies and procedures · Established ICO reporting and escalation processes.	Reduced and accepted
Information could be accessed or shared without individuals' consent, violating their right to privacy.	· CYC ICT, HR, information governance policies and procedures · Use of passwords and logins to system(s) · Carry out staff training	Reduced and accepted
Non-compliance with data protection and privacy legislation/regulations resulting in regulator action/sanctions including potential fines and legal action.	· Completion of DPIA · DSA where needed · Privacy notices to be drafted/ reviewed · Compliance monitoring e.g. through internal audits etc	Reduced and accepted
Improper system /records access	CYC organisational and technical measures such as · User designation and password approval, · user permissions limited based on access requirements for role · password protection	Reduced and accepted
Unlocked device with unauthorised access to system	CYC organisational and technical measures such as · Standard work policy to lock device when leaving desk. · Autolock · Rolling password changes	Reduced and accepted
Privacy notice does not reflect processing activity	Privacy notice will be drafted or reviewed, then approved and published	Reduced and accepted
Retention periods are not adhered to	· Apply Council retention schedules. · Periodic records review. · Secure deletion and disposal procedures.	Reduced and accepted
IAR/ROPA is not up to date	IAR/ROPA will be updated to include all new and updated assets and new processing activities	Reduced and accepted
Policies and procedures do not reflect new project/new or change to processing	· Review existing procedures. · Seek Information Governance advice where necessary.	Reduced and accepted
Regulatory investigations from concerns/complaints being raised to them and/or through their monitoring of all data controllers e.g. audit, inspect or investigate the council’s DP/IG and ICT security practices, resulting in reputational damage and possible penalties for non-compliance.	· CYC ICT, information governance policies and procedures · Compliance with UK GDPR and Data Protection Act 2018. · Adherance to Council information governance procedures. · DPIA review and governance oversight.	Reduced and accepted
Financial loss from breaches and subsequent legal action and/or insurance claims from individuals could result in financial losses, including legal fees, fines, and compensation to affected individuals	· CYC ICT, information governance policies and procedures · Existing ICT security controls. · Information governance compliance.	Reduced and accepted
inability to access services or opportunities	· Accessible communication methods. · Direct engagement with affected parties. · Reasonable adjustments considered where required.	Reduced and accepted
loss of control over the use of information;	· Restricted access permissions. · Secure storage. · Controlled information sharing. · Governance oversight.	Reduced and accepted
discrimination	· Equality Impact Assessment completed. · Individual circumstances considered. · Consistent application of statutory processes. · Reasonable adjustments where required.	Reduced and accepted
re-identification of pseudonymised data	Not considered a significant risk as pseudonymisation is not expected to be used within the process. Where reporting information is anonymised, disclosure controls will be applied.	Risk is low and accepted
loss of confidentiality	3) Confidential handling procedures. · Access restrictions. · Professional confidentiality obligations. · Secure file sharing methods.	Reduced and accepted
any other significant economic or social disadvantage	· Continued negotiation and engagement with affected leaseholders. · Fair compensation in accordance with statutory requirements. · Access to professional advice through the statutory process. · Consideration of individual circumstances where relevant.	Reduced and accepted

Some other examples of actions that can reduce risks are

· taking additional technological security measures; or using a different technology; training staff to ensure risks are anticipated and managed.

· anonymising or pseudonymising data where possible.

· writing internal guidance or processes to avoid risks.

· putting clear data-sharing agreements into place with all partners.

· offering individuals the chance to opt out where appropriate; or

· implementing new systems to help individuals to exercise their rights

Step 5 – Record of outcomes and sign off

Please complete the sign off section below and email a copy of the full document to information.governance@york.gov.uk

Where it is identified that the processing is likely to result in a high risk to individuals, approval will need to be gained from the Senior Information Risk Owner and/or Chief Operating Officer and/or the Information Commissioner’s Office. Please see Do we need to consult the ICO? | ICO

	Yes/No	Date	Name	Position
Confirm ongoing or outstanding actions will be integrated to the project or service plan with date and name and position of who responsible	Yes	30 July 2026	Lisa Otter	Housing Delivery Manager
Residual risks approved:	Yes	30 July 2026	Lisa Otter	Housing Delivery Manager
DPO/Information Governance advice provided:
Summary of DPO/ Information Governance advice:
DPO/Information Governance advice accepted.
If not accepted, please explain the reasons:

Project/Process Sponsor
Name	Garry Taylor
Job Title	Director of City Development
Signature
Date

Information Asset Owner
Name
Job Title
Signature
Date

Data protection/information governance
Name
Job Title
Signature
Date

Annex C: CPO Boundary Plan

Directorate		Housing & Communities / City Development
Service Area		Housing Delivery Programme (HDP) / Development and regeneration
Name of proposal		Preparation for Potential Use of Compulsory Purchase Powers at Willow House to Support Delivery of Affordable Housing
Lead Officer		Zoe Dunn, Head of Housing Delivery
Date Assessment Started		July 2026
Date Assessment Completed		July 2026
Names of those who contributed to the assessment
Name	Job Title		Organisation	Area of Expertise
Zoe Dunn	Head of Housing Delivery		CYC	Housing delivery and regeneration
Lisa Otter	Housing Development Manager		CYC	Housing delivery and regeneration

3.1	What sources of data, evidence and consultation feedback have you used to help understand the impact of the proposal on equality rights and human rights?
	Please consider a range of sources, including consultation exercises, surveys, feedback from staff, stakeholders, participants, research reports, the views of equality groups, as well your own experience of working in this area etc.
	Source of data / supporting evidence	Reason for using this source
	Planning application and supporting assessments	Provides evidence relating to scheme impacts and benefits.
	Leaseholder engagement and negotiations	Identifies impacts on directly affected parties.
	Community consultation undertaken between 2021 and 2026	Provides local stakeholder feedback and concerns.
	Housing need and affordability evidence	Demonstrates need for affordable housing provision.
	Officer knowledge and experience	Informs understanding of likely equalities impacts.

Characteristic or Human Right affected	Positive or Negative impact	Impact Description	Evaluation or Justification
Age	Positive	Delivery of 36 warm, energy‑efficient homes with a high proportion of accessible/adaptable homes will form part of the contractual requirements.	The 36 homes at Willow House includes the delivery of high-quality, low carbon homes, as well as promoting accessibility and affordability. This is expected to have a positive impact by enabling the delivery of much needed genuinely affordable housing, supporting a wide range of residents, including those with protected characteristics.
Disability	Positive	Delivery of 4 M43 dedicated accessible/adaptable homes designed to Nationally Described Space Standards and Healthy Homes standard, with step‑free routes and inclusive design principles.	As above
Pregnancy / Maternity	Positive	Safe, healthy living conditions; proximity to services.	As above
Race / Religion / Sexual orientation / Gender reassignment	Positive	Inclusive design along with ongoing open and meaningful community engagement. CYC will follow fair allocations policies for the new affordable homes.	As above
Carers / Low-income households	Positive	Affordable rents, lower running costs, improved stability; social values commitments on the contractor to create employment/skills pathways.	As above
Right to Property	Positive and Negative (mitigated)	Possible compulsory acquisition (and where possible with a choice of reprovision) for a store or garage for a small number of individuals. This is mitigated by enabling the development of 36 homes for social rent and shared ownership which will allow more individuals to have access to property.	The 36 homes at Willow House includes the delivery of high-quality, low carbon homes, as well as promoting accessibility and affordability. This is expected to have a positive impact by enabling the delivery of much needed genuinely affordable housing, supporting a wide range of residents, including those with protected characteristics. Any interference would be lawful, proportionate, justified in the public interest and accompanied by statutory compensation rights. The Council will continue negotiations as its preferred approach.
Human rights (housing, private/family life)	Positive	Increased access to adequate, secure, energy efficient housing.	As above