We have briefly set out below the rights which individuals have in relation to their personal data, and how these can be exercised. Please note that each of the rights is subject to exemptions and not all of the rights will be exercisable in all circumstances.
We will usually respond to requests within one month of receipt; however we may extend this period by a further two months if the request is complex or if the individual has made a number of requests. We may request specific information to help us to confirm an individual's identity (e.g. a passport, etc.). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
We will not usually impose a charge for exercising these rights; however we may charge a reasonable fee for the administrative costs of complying with a request where it is manifestly unfounded or excessive, or where additional copies of information already provided are requested.
Our procedures for handling requests to exercise information rights are set out in our Data Protection Policy and more information on information rights can be obtained from the Information Commissioner's Office's website.
At the point when we collect your personal data we will provide you with a privacy notice containing various details about how we use your personal data, including our purpose for processing the personal data, the categories of people with whom we will share the information, and our lawful basis for processing the information.
You have the right to obtain from the council confirmation as to whether or not we are processing personal data concerning you, and where that is the case, access to that personal data and certain other details about our use of that personal data. You can make a subject access request online.
You can ask us to change your personal information if you think it is inaccurate. We may not always be able to change or remove that information, but we will correct purely factual inaccuracies and may include your comments in the record to show that you disagree with it. Where your data has been shared with others, we will do what we can to make sure that recipients also comply with your request. Please also see "Your right to ask us to restrict our use of your personal data" below, which may be relevant during any period between your submission of a request for rectification and our determination of that request. You can make a rectification request online.
You can ask us to erase your personal data where:
Where your personal information has been shared with others, we will do what we can to make sure that those using your personal information comply with your request for erasure.
Please note that the right to be forgotten is subject to limitations and exemptions. You can make a request to be forgotten online.
You have the right to object to our use of your personal data, on grounds relating to your particular situation, where we are using your data on the basis of either a legal obligation, our tasks carried out in the public interest or the exercise of our official authority.
On receipt of an objection, we must cease using the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or we require use of the data for the establishment, exercise or defence of legal claims. You can make an objection online.
You have the right to ask us to restrict our use of your personal data so that we may only use it for purposes to which you have expressly consented, for legal claims, for the protection of other people's rights, and for reasons of important public interest.
You can ask us to restrict our use of your personal data where:
Where your data has been shared with others, we will do what we can to make sure that recipients also comply with your request. Where we have restricted our use of your data, we will inform you before the restriction is lifted.
You can make a request for a restriction online.
You have the right to ask for your personal information to be given back to you or another service provider of your choice in a commonly used format. This is called data portability. This only applies if we're using your data on the basis of your consent alone (i.e. not as part of our statutory functions) and if processing is carried out by automated means.
It is likely that this right will not apply to most of the services that you receive from the Council. You can make a request to have your personal data sent to somebody else online.
You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly affects you. This includes the right to have automated decisions explained to you and the right to question the automated decisions that have been made.
See our complaints procedure page for details of how to complain.
In addition to our own complaints procedure, if you have concerns about how we have used your personal data, then you have the right to complain to the Information Commissioner's Office, whose details are as follows: