Data protection

The GDPR provides the following rights regarding the personal data the Council, as a data controller, processes about you:

Please note that these rights are not absolute and are subject to a number of conditions and exemptions.  We may apply these conditions and exemptions to any request which we receive from you. Some of the above rights will only apply if the processing activity is undertaken on specific legal grounds and/or in particular circumstances.

Right to be informed

You have the right to be informed about what information we collect about you and what we will do with it.  This information will be on the website in our privacy notices, on any form you complete or you will be told verbally over the phone.

You can see all of our privacy notices

When does this apply?

When we first gather information from you we will confirm that:

• we are the data controller
• let you know who our Data Protection Officer is and how to make contact
• the legal basis for processing your data and the purpose(s) we will use it for
• any consequences of you not providing all the data requested
• who we share this with and how long we keep them for
• we will let you know your rights to have data rectified, to be forgotten, to portability, to object to processing and to complain
• we will let you know if the data will be subject to any automated decision making
• transfers outside European Economic Area and
• if the data was not provided by you, the identity of the source and the categories of data we hold

When does this not apply?

If you already have this information.

Right of access

You can ask for a copy of the data we hold on you. This is also known as a Subject Access Request.

When does this apply?

This applies to any personal data that we hold about you and we can tell you what data and what categories of data we hold.

To help us to do this we will ask you to tell us which services are likely to hold your data, for example, there may be a Housing Benefit file, employment records, housing file or area of correspondence you have had.

You will need to provide proof of your identify, including a utilities bill or bank statement with your current address and something confirming your identity such as a driving licence or birth certificate so that we can ensure that the correct data is provided to you and that your data and the data of others is adequately protected.

There is no charge, however, if you request further copies, we may charge or consider if we can meet the request.

We will let you know the purpose(s) the data is processed for and any other organisations we share the data with.  Also if any data we hold is collected from other sources. For example, we may be given data from the Department of Work and Pensions regarding benefit applications.

When does this not apply?

There are some circumstances in which we cannot provide your data. For example, where it involves legal advice and proceedings.

The law also permits us to reject a request that is manifestly unfounded or excessive. If we believe this to be the case we will let you know why we think this is the case. 

If it is necessary to protect the rights and freedoms of others. For example, if other family members’ details are in your housing file, we would need to either obtain their permissions to share this part of the file or redact their data.

Right to be forgotten

This allows you to request that we delete our records or some of our records in so far as they identify you. It does not apply in all circumstances.

When does it apply?

If you provided the information with your consent. 

For example, you agreed to take part in a consultation or you signed up for a newsletter. You can withdraw your consent.

• if the data is no longer necessary and the timescale for us to keep records has expired
  if the data is being unlawfully processed for a purpose we were not entitled to
  if you successfully object to the data processing under the right to object
  if we are obliged to erase the data to comply with a legal obligation

When does it not apply?

If we need the information to provide a service we are authorised to provide by law, for a legal obligation or we believe the data to be necessary for a task in the overriding public interest. 

• if the data is required for a contract to which you are party
• if records are required to protect public health
• if we require the data to establish, exercise or defend a legal claim
• if records are required for archiving in the public interest or for scientific or historical interest

For example, a task carried out in the public interest will include a wide range of the Council’s functions such as:

• assessing and collecting council tax and business rates
• processing anti-social behaviour complaints
• refuse collection
• FOI requests

So, if you ask for council tax records to be erased the Council on balance is likely to say that they need to be retained until the end of the statutory retention period to be sure all monies due are appropriately charged and collected. 

If you ask for your complaints of noise nuisance or anti-social behaviour to be erased, the Council will have to consider whether there are overriding reasons in the public interest to keep those records. This may be to ensure sufficient evidence is held to rectify the nuisance for the good of the community balanced against any possible detriment to you.

Right to rectification

This concerns correcting your personal data that is held.

When does this apply?

If you believe the data held is not accurate, you can request that it is corrected without due delay. Similarly if data is incomplete you can ask that it is completed.

When does this not apply?

If we dispute that the data we hold is incorrect we may restrict access to the data pending a decision, to allow further checks to be made. 

Rectification can be achieved by adding to the record or creating a supplementary record. Even if we decide that the information is correct, we will place a statement from you on the record with the data you believe to be correct or stating your dispute.

If we have shared the data with others, we will need to correct that data or ask the other party to do so.

Right to restriction of processing

You can ask that access to your records is limited in certain circumstances.

When does this apply?

If you are contesting the accuracy of the data on record and we are seeking to verify it.

If the processing of your data is unlawful but you want the record preserved. This could be because you are pursuing a complaint; or you are making an objection to the Council processing your data under a lawful authority.  This also applies to objections to processing under legitimate interest. In these circumstances the Council may only process the data with your consent or to establish exercise or defend a legal claim or to protect the rights of another person or important public interest. 

Right to portability

This allows you to be provided with a copy of your data in an accessible electronic format. There are unlikely to be many circumstances where information held by the Council will be subject to this right.

When does this apply?

• if you gave us the data with your consent
• if the data was provided as required for a contract between you and the Council
• if the processing is electronic

When does this not apply?

It does not apply to data collected in any other circumstances

For example, if you move to another authority you may wish to transfer details but this right does not apply as we process the data for a task carried out in the public interest. In most cases this right will apply when changing providers for utilities or mobile phones. 

Right to object

The GDPR provides a right to object to data processed under lawful authority and legitimate interests. In most cases the services provided by the Council are carried out in the public interest or legal obligation for which there will be limited grounds for objection.

When does this apply?

If we are using your data for direct marketing or for research purposes, unless the Council has a public interest justification for this.  

When conducting research we will in most instances anonymise the data so your personal data cannot be identified.  Or there may be projects where we combine data and then remove any personal identifiers. This way the outcomes are not linked to any individuals.

When does this not apply?

When the Council has demonstrated overriding grounds to continue processing. 

The Council will have to demonstrate overriding grounds to continue processing your data under its lawful authority or a task carried out in the public interest or to establish exercise or defend a legal claim.

Right to object to automated decision making

Automated decision making takes place when an electronic system uses personal information to make a decision without human intervention.

When does this apply?

The regulation allows you to object to having decisions made by an automated process. 

This also includes profiling data which has a legal or other significant effect on you. Profiling could mean analysing and predicting your performance at work, your economic situation, your health, your location or movements and your preferences or behaviour. The Council is unlikely to undertake profiling that has a significant and/or legal impact but will at times use data held to identify populations impacted by policy and legislative changes.

When does this not apply?

• if the processing is necessary for a contract between you and the council, for example, your employment contract
• for tax evasion, fraud or regulatory prevention activities
• if processing is authorised by law with necessary safeguards to your rights and freedoms
• if you gave explicit consent
• if you object, you have the right to have the decision explained to you
• you also have the right to have manual intervention so the decision is verified