The Data Protection Act 2018

In accordance with the General Data Protection Regulation (GDPR), the Data Protection Act 2018 came into force on May 25, 2018. The principles are broadly similar to the pre-existing Data Protection Act 1998. However, the new Act has changed how we handle and maintain your information.

For more information about the Data Protection Act 2018 you can refer to the Information Commissioner's website.

Your rights under the Act

You have the following rights:

The right of access – The Data Protection Act 2018 gives you the right to ask us for a copy of the personal information that we hold about you for the purposes of providing services to you. You are also entitled to additional information including:

  • the identity and contact details of the controller and Data Protection Officer
  • the purposes of the processing and the legal basis
  • your additional rights in respect of the data
  • your right to complain
  • the categories of personal information
  • who your data has been with and will be shared with
  • data source - where the data has not been collected directly from the data subject

This is known as a Subject Access Request (SAR). There is no charge. Make sure you enclose the appropriate identity to ensure the security of your personal information.

When an appropriate application is made using our data request form (pdf, 245kb) we are required to provide you with the information, subject to any exemptions, within 30 days of verification.

The right to rectification - The Data Protection Act 2018 gives you the right to have inaccurate and incomplete personal data held about you rectified, known as ‘data rectification’. You can provide a supplementary statement detailing what information requires rectification, for example, misspellings and incorrect or out of date personal data.

The right to erasure - The Data Protection Act 2018 gives you the right to have your data erased, for example:

  • data that is no longer necessary and unrelated to the original purpose it was collected for
  • is of no legitimate interest to continue processing the data
  • the data is being used for direct marketing, without your consent.  You can object to the processing of the data
  • withdrawing consent where data was collected for lawful basis purposes and you no longer give consent

Please note that the Council may not be able to process your request if it is subject to a legal obligation compliancy. In the event of this, we will contact you.

The right to restrict and object to processing - The Data Protection Act 2018 gives you the right to restrict the processing of your personal data, which can include the following:

  • the data has been unlawfully processed
  • if the data is contested as being inaccurate and requires verification
  • a legitimate objection preventing the processing of restricted information

The right to data portability - The Data Protection Act 2018 gives you the right to request for you to use your personal data across different services.

This is known as the ‘right to data portability’.

Please note that you are only able to request for your personal information to be transferred if the information:

  • is processed for a contract
  • is processed based on your consent
  • is processed automatically
  • was provided to the Council by you

Rights in relation to automated decision making and profiling – you have the right to challenge a decision that affects you and has been made automatically without human intervention. For example, an online form with an instant decision.

Please complete the data request form (pdf, 245kb)to assist in dealing with your request.

Validating your request

For your protection and the security of the data, we will need to confirm that you are the person whom the data is about, and will require proof of your identity before we process the request. If you are acting on behalf of someone else, the Council will need proof of this as well as proof of your identity.

We may also need to contact the data subject to confirm that they have authorised you to act on their behalf.

If you have not provided the relevant proof of identity and consent with the form, it will need to be provided before we can process your request for information.

Once your request has been validated, the Council will have 30 days to respond to your request. However, if your request is complex or numerous, the Council may require a further two months, which will be communicated with you.

Please send completed application forms to:

dataprotectionofficer@southderbyshire.gov.uk

Or

South Derbyshire District Council
Civic Offices
Civic Way
Swadlincote
Derbyshire
DE11 0AH

If you have any queries, you can get in touch with our Data Protection Officer by calling 01283 595795.

Please note: We ask that you keep us informed – by email, telephone or in writing – of any changes in your personal data so that we can keep our records up to date at all times.

Complaints

If you would like to make a complaint regarding the use of your personal data you can contact our Data Protection Officer;

  • By post: Civic Offices, Civic Way, Swadlincote, Derbyshire DE11 0AH
  • By phone: 01283 595795
  • By email: dataprotectionofficer@southderbyshire.gov.uk

For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate number).

Email: casework@ico.org.uk

Further guidance on the use of personal information can be found at www.ico.org.uk