Data Protection: Your Rights
The General Data Protection Regulation provides a legal basis for the privacy and protection of data of UK citizens and businesses. It gives those who have data held about them (the data subject) rights of access to the information held. It also requires those holding the data (the data controller) to apply minimum standards of protection to the data and ensure that it is only used for the purposes it was collected for.
Your right of access
- to ask what the Council uses the information for
- to be provided with a copy of the information
- to be given details of the purposes for which the Council uses the information
- persons/organisations to whom the information is disclosed
- to ask for incorrect data to be corrected
What information will you receive?
All of the personal information we hold about you on both our computer and manual record systems. You will also be given a description of the purposes for which we process your data, a list of those to whom we disclose the data and information about sources where this is available.
Can you see information about any other person?
You may not see information about other persons, unless they have given their consent. This includes information about members of your family. If you are a parent or a member of an elderly person's family you may be provided with information about your child or the elderly person but only where you have written permission to ask for it or have been granted powers to do so by the court and the Council is satisfied that such permissions are genuine.
How will you be given the information?
You will be provided with a copy for your retention and use. This may be a printout of the information from the computer system or a photocopy of your manually held record. If you have difficulty in understanding any of the contents you may ask a member of staff for assistance.
Will you be charged a fee?
There is no charge for making a Subject Access Request under the General Data Protection Regulation, unless requests are repeated or manifestly excessive.
How long does it take?
The General Data Protection Regulation states that we must provide access to the information without undue delay, and within one month. This time starts from when we receive a clear request and enough identification to be sure that the request is from the data subject. Once this information has been received we will contact you to acknowledge that the one month period has started.
What do you do if the information provided is incorrect?
You should tell the Council that the data is incorrect and ask them to correct it. You must do so in writing. The Council must inform you if they have or have not corrected the data within 21 days of you asking them to do so. If the department does not agree that the information is incorrect you can ask it to record your disagreement on the record itself.
If the Council does not correct the information you may also appeal to the Data Protection Commissioner or the courts. These organisations have the power to order the Council to correct data, which is wrong.
How can you have inaccurate data about you corrected?
The Act provides you with a right to apply to the court to have inaccurate data rectified, blocked, erased or destroyed. This right extends to any other personal data, which contain an opinion about you based on the inaccurate data.
What do you do if you think you have not been given all the information you asked for?
You can appeal to the Council, through its complaints procedure or to the Data Protection Commissioner whose staff will look into the matter on your behalf.
Do you have any other rights under the General Data Protection Regulation and what are they?
In addition to the right of access, individuals also have the following rights:
- The right to be informed
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- The right to withdraw consent
- The right to lodge a complaint with the supervisory authority (see below)
How do you exercise these rights?
We are currently drafting a form for the submission of requests and will publish this as soon as it is available. In the meantime, please email any requests to: firstname.lastname@example.org
What if I am not happy with the response to my request?
If you wish to make a complaint about the way we have responded to your request, you can have your complaint considered under the Council’s Complaints Procedure. To do this you will need to contact the Deputy Chief Executive in writing or by email:
Deputy Chief Executive
Eden District Council
Cumbria CA11 7QF
If you are dissatisfied with the way we have handled your complaint, you may contact the Information Commissioner's Office:
Information Commissioner’s Office
Cheshire SK9 5AF
Telephone: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.
Do we provide you with help in understanding the information?
If you need help in understanding the information provided or the contents please inform the Council and we will provide someone to explain the contents of the information.