Data protection rights

What rights do I have in respect of my personal data? 

You have a number of rights in respect if the data we hold about you. When we collect information about you we will make sure you are informed about how your data will be used. We do this normally through something called a privacy notice. You also have the following rights:

1. the right of access
   
2. the right to rectification
   
3. the right to erasure
   
4. the right to restrict processing
   
5. the right to data portability
   
6. the right to object
   
7. rights in relation to automated decision making and profiling. 

More information can be found on the ICO website (external website).

Can I access my personal information? 

You have a right to obtain confirmation we hold your data, access to your data and the information we should have already made you aware of in our privacy notice. This type of request is often referred to as a Subject Access Request (SAR) and relates to living individuals. 

The council must be confident of your identity before any information can be released. The simplest way of achieving this is to provide us with two proofs of identity. This would apply to you and anyone you are requesting information on behalf of - for example, a passport, driving licence.

If you are requesting your child’s information you will need to supply evidence of parental responsibility e.g. your child’s birth certificate.

Originals are not required, any copies must be of good quality, and customer service centres can take authenticated copies to assist in making any request.

To speed up the process we suggest you use our Subject Access Request (SAR) form below:

Subject Access Request (SAR) form (pdf 122kb)

or by letter:

Data Protection and Feedback Team
East Riding of Yorkshire Council
County Hall
Cross Street
Beverley
HU17 9BA

or alternatively by email: data.protection@eastriding.gov.uk

Is there a cost for requesting to see what personal data the council holds about me? 

The request will be free of charge. However, we can charge a ‘reasonable fee’ if your request is manifestly unfounded or excessive, particularly if it is repetitive. You may also be charged a reasonable fee for further copies of the same information.

Information will be provided within one month (the council aims to respond within 28 days) of receipt of the request. The clock will be paused if we require further information to validate your request.

We may extend the timescale by a further two months where requests are complex or numerous. If this is the case, we will inform you within one month and explain why the extension is necessary.

Can I access my child’s information? 

Everyone has a right of access to their personal information, including children. However, as young children may not understand this right or are not capable of exercising this right, in some cases their parents may do so on their behalf.

There is no particular age when a child becomes capable of exercising his or her own data protection rights. Rather, the council must assess the child’s maturity and level of understanding when determining whether a parent should be making a request on the child’s behalf. To do this, the council may have to contact you to obtain further information.

As a general guide, a child of 12 and above is likely to have sufficient maturity but as stated, this will depend on the individual circumstances.

The council needs to be very careful about the disclosure of children’s personal information. If the council is in any doubt as to whether the parent or guardian is entitled to make a request on their child or ward’s behalf, then the council may refuse to grant access.

Will I get copies of everything held about me as part of my access request?  

In most cases, you will be supplied with all the information you have requested as long as it is held by the council and does not include third party information. Sometimes it may be necessary to summarise information so as not to disclose third-party information. There are other circumstances where information can be withheld for example if it would put at risk a criminal investigation or catching an offender. 

To make sure you get everything you want, it is advisable to limit your request to a single council area of business such as children's services, adult services, human resources, etc. Larger requests can be submitted, but it makes it harder for us to ensure you will get everything you are looking for.

Can I get my data rectified? 

You have the right to have inaccurate personal data corrected or completed if it is incomplete. You should make your request to the department you have been dealing with as they will be best placed to correct your information. 

You may need to provide evidence to support your request, for example, if a date of birth was recorded incorrectly a birth certificate would confirm the correct date of birth. You should also consider that we may have to hold a record of the original information as it may have been supplied by someone else or been used to make a decision previously. Opinions are by their nature subjective, as long as the record clearly shows it is an opinion we will not rectify it.

We will let you know what has happened within a month of you making your request.

Can I get my data erased? 

You have the right to have your data erased (also known as the right to be forgotten). This does not have to apply in every circumstance, however.

It does apply if:

• the personal data is no longer necessary for the purpose which you originally collected or processed it for
  
• you are relying on consent as your lawful basis for holding the data, and the individual withdraws their consent
  
• you are relying on legitimate interests as your basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing
  
• you are processing the personal data for direct marketing purposes and the individual objects to that processing
  
• you have processed the personal data unlawfully (for example in breach of the lawfulness requirement of the 1st principle)
  
• you have to do it to comply with a legal obligation or
  
• you have processed the personal data to offer information society services to a child. 

You should make your request to the department you have been dealing with as they will be best placed to consider your request. 

We will let you know what has happened within a month of you making your request.

Can I restrict how you use my data? 

You can stop us using your personal data, which means your data can be kept but not used. This does not have to apply in every circumstance, however.

You can restrict your data use when: 

• you question the accuracy of your data 
  
• you have objected to the handling of the data 
  
• when processing is illegal and you don’t want your data deleted but you want it restricting instead 
  
• we no longer need your data but you need the data in relation to a legal claim. 

In certain circumstances for example where we need to process the data to defend legal claims or protect other people’s rights or for reasons of important public interest we can continue to use your personal data even if you ask us not to. If this is the case we will tell you the reasons why. 

You should make your request to the department you have been dealing with as they will be best placed to consider your request. 

We will let you know what has happened within a month of you making your request.

Can I transfer my data (portability)?

The right to data portability allows you to obtain and reuse your personal data. It allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability.

The right to data portability only applies when:

• your lawful basis for processing this information is consent or for the performance of a contract; and
  
• you are carrying out the processing by automated means (for example excluding paper files). 

You should use the same contact details as for access, outlined above.

Can I object to how you use my data? 

You can object to the processing of your data. This effectively allows you to ask us to stop using your personal data. 

The right to object only applies in certain circumstances:

• Individuals have the absolute right to object to the processing of their personal data if it is for direct marketing purposes.
  
• Individuals can also object if the processing is for:
  • a task carried out in the public interest;
  • the exercise of official authority vested in you; or
  • your legitimate interests (or those of a third party).  

You should make your request to the department you have been dealing with as they will be best placed to consider your request. 

Can I stop automated decision making and profiling?  

Solely automated individual decision-making, including profiling with legal or similarly significant effects, is restricted. It is very unlikely we carry out any solely automated decision making or profiling. If we did, we must make sure you are able to have human intervention, express your point of view and get an explanation of the decision. 

You should ask the department you have been dealing with for more information, they should be able to explain exactly how your information is being used and if it falls under the category of automated decision making or profiling.

Can I make a request to see personal information about someone who has died?

You cannot do this using data protection rights, but the council does have a process in place to help people make requests to see records in relation to a deceased individual.

For more information about what a deceased information request is and how to make a request, visit information about the deceased.