6. Individual rights
The right to be informed
Individuals have the right to be provided with information about how we process their personal data. The information to be provided varies depending on whether we obtain the personal data from the individual or from a third party. We will generally satisfy this requirement through the use of privacy notices. We will ensure that the information provided is concise, transparent, intelligible and easily accessible and written in clear and plain language.
We recognise that an individual has rights in relation to the way we obtain and process their personal data.
We will ensure that individuals are able to exercise the following rights (where permitted);
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to data portability
- Right to object
- Rights in relation to automated decision-making (including profiling)
The council will document all personal data processing through service and process specific privacy notices which are published on our website. These notices will specify our lawful basis for processing; what personal data is being processed; where it was obtained from; who it may be shared with; and will link to our document retention schedules.
The right of access
It is a fundamental right of individuals to be able to access their own information. Individuals will be able to obtain confirmation that their data is being processed and to access that data. It is in the interests of the council to have an open and honest approach with all individuals about whom it holds data.
Any individual requesting access to their data will be asked to provide a request in writing to the Data Protection Officer. This enables us to be clear about the information the individual is seeking and encourages the individual to think clearly about the data they require. However, we are mindful of the fact that the legislation does not require such a request to be made in writing and that a verbal request is legitimate.
The individual requestor will be required to provide a document to confrm their identity
The council will respond to requests in accordance with the time limits specified under DPA and UKGDPR
There will be some requests where it will not be possible or appropriate to release personal data, for example, where doing so would involve releasing personal data about a third party individual or if the data relates to ongoing criminal investigations or legal cases. In these cases we will clearly state where information has been withheld and on what basis.
When we have responded to a request, the individual will have a right to review by the Senior Information Risk and Monitoring Officer, and will be made aware of their right to refer to the Information Commissioner.