Rights for individuals under GDPR
From May 2018 the General Data Protection Regulations will come into effect. The Regulations will give increased rights for individuals. The rights and how to exercise these are detailed below.
The right to be informed
The way that your personal data is collected, handled and processed and the purpose for its processing should be detailed in the Privacy Notice associated with the method of the collection, whether this is via electronic means or paper. The Privacy Notice is a full explanation for you of exactly why we need your personal data, where it will be stored, who it will be shared with, the purpose of collecting it, the Data Protection Officer contact, your rights to object and how long the data will be kept for. Each service area will have Privacy Notice which may be different depending upon the data being collected. There is a generic Privacy Notice on the Council website but specific detailed ones are available at the time that your data is collected.
The right of access
This is your right to request sight of the information that we as a Council hold about you. It is called a Subject Access Request (SAR) and is processed under s.7 Data Protection Act 1998 and will be dealt with by the Information Governance team free of charge. Please ensure that any request is sent in writing to: Department of Corporate Resources 1st Floor Britannia House, Hall Ings, Bradford BD1 1HX. For more information, please visit our ‘make a data protection request’ web page.
The right to rectification
This means that you have the right to request that we correct any incorrect or inaccurate information held on our systems, such as wrong addresses or incorrect spellings. Corrections must be carried out within a month of us being informed, including asking third parties to also amend their systems accordingly. Please contact the name provided on the appropriate Privacy Notice or email GDPR@bradford.gov.uk
The right to be forgotten
This means that as long as the purpose for processing the data is not a statutory one, or in other words doesn’t have a legal basis, then you can request that your information is withdrawn by withdrawing your consent for processing. As long as the data is not required for a legal or safeguarding purpose, you have the right for your entry to be deleted from our systems. Obviously an individual cannot be 'forgotten' from the Council Tax system but for systems that do not have a legal basis such as mailing lists, then you have the right to be forgotten and erased from the system.
The right to restrict processing
This right applies where an individual may feel that we are acting upon incorrect or inaccurate information. They will have the right under the new law to request that we restrict processing while we look into the situation. This must be done and a decision made within a month. During this time no action or further processing can take place. Once a written decision is made and any inaccuracies documented and amended the processing can be re-commenced.
The right to data portability
The right to data portability is new. It only applies to personal data an individual has provided to a controller and where the processing is based on the individual’s consent or for the performance of a contract; and when processing is carried out by automated means.
The right to object
This right is the same right that exists currently in that you can complain to the Council’s Data Protection Officer (DPO) if you feel that your data rights have been incorrectly handled or breached. Complaints about data protection should not be sent to the Council’s Corporate information Governance Team but should be sent to the Council’s DPO at dani.mistry@bradford.gov.uk
Complaints about the service that you have received should be sent to our Complaints department. For more information, please visit our complaints web page.
The right not to be subject to automated decision-making including profiling
If the Council intends to use your data for profiling purposes or for automatic decision making you must provide explicit consent or us to process your data in this way. You can withdraw your consent at any time. In addition, you can request that a human make the decision and that the 'automated' part is not utilised.
You have the right to request that Bradford Council stops processing your personal data in relation to any council service (other than statutory services) where that processing is likely to cause substantial and unwarranted damage or distress. However, this may cause delays or prevent us delivering a service to you. Where possible we will seek to comply with your request, however there may be circumstances where this is not possible – for example if we are required to hold or process information to comply with a legal requirement.
We try to ensure that any information we hold about you is correct. There may be situations where you find the information we hold is no longer accurate and you have the right to have this corrected.