Data Protection and Data Subject Rights
The General Data Protection Regulations (GDPR) set the rules for how organisations should handle your personal data. They also give you the right to request and amend the personal information that an organisation holds about you.
Data Protection
Cherwell District Council holds and processes resident’s personal information for a variety of purposes (e.g. Council Tax, Housing, Planning). The ways we collect, use and share personal data are set out in our Privacy Statements.
Cherwell District Council is very careful with the personal data it stores and processes. Occasionally though, there are errors. If your data has been inappropriately shared, or if you have received misdirected personal data, please report it using the form on our Data or Information Security Concerns page.
Data Subject Rights
The General Data Protection Regulations (GDPR) give individuals several rights regarding their personal information. Collectively these are known as Data Subject Rights.
Please note: You will not always be able to exercise all the rights set out in the GDPR as they vary depending on why we collected the personal information. There are also some circumstances where your rights cannot be exercised because exemptions will apply. We will explain this in our response to you.
Data Subject Rights Requests
You can exercise any of the rights described above by making a Data Subject Rights Request, using the form linked below.
The council will not always be able to fully comply with all data subject rights requests, because exemptions will apply in some cases. If you make a request that we are unable to fulfil, we will explain the reasons in our response to you.
Please be aware that you will be required to upload (or otherwise provide) two valid forms of identification. This is so we can be confident the request comes from you, rather than someone else trying to fraudulently acquire or amend your personal information.
Make a Data Subject Rights Request
1. The right to be informed
You have the right to be informed about the collection and use of your personal data. A privacy notice will be provided to you at the time your personal data is collected and will explain simply and clearly how and why we intend to process your data. This information will be on the website and be referenced on the form you complete.
2. The right to change inaccurate information
You have a right to rectification of inaccurate personal information and to update incomplete personal information.
If you believe that any of the information that we hold about you is inaccurate, you have a right to request that we restrict the processing of that information and to rectify the inaccurate personal information.
Rectification can be achieved by adding to the record or creating a supplementary record. Even if we decide that the information is correct, we will place a statement from you on the record with the data you believe to be correct or stating your dispute.
3. The right to have your information deleted
You have a right to request that we delete your personal information.
You may request that we delete your personal information if you believe that:
- We no longer need to process your information for the purposes for which it was provided
- You have previously given consent to process your personal information, and you wish to withdraw your consent
4. The right to restrict the processing of your information
You have a right to request the council to restrict the processing of your personal information.
You may request the council to restrict processing your personal information if you believe that:
- Any of the information that we hold about you is inaccurate
- We no longer need to process your information for the purposes for which it was provided, but you require the information to establish, exercise or defend legal claims
5. The right to data portability
Where we have requested your permission to process your personal information, you have a right to receive the personal information you provided to us in a portable format.
You may also request the council to provide it directly to a third party, if technically feasible. We’re not responsible for any such third party’s use of your information, which will be governed by their agreement with you and any privacy statement they provide to you.
Please note that this right only applies to data that is being processed electronically.
6. The right to object to the processing of your information
You have a right to object to the processing of your personal information.
You must tell us the circumstances justifying your objection to processing. Please be aware that we can still process personal information where there are compelling grounds, or it is necessary for legal claims or the carrying out of our statutory duties.
You can also object separately to your data being used for direct marketing and for research. Your objection to your data being processed for a research purpose may be overridden if the council has public interest justification for this.
7. Rights in relation to automated decision making and profiling
Automated individual decision making is a decision made without human involvement. Examples of this include an online decision to award a loan, or a recruitment aptitude test which uses pre-programmed algorithms and criteria. Automated decision making does not have to involve profiling, although it may do.
Automated decision making and profiling can lead to a quicker and more consistent decision, but if used irresponsibly there are significant risks for individuals.
As this type of processing is high risk, the GDPR requires that a Data Protection Impact Assessment is completed to demonstrate that the organisation has identified and assessed the risks and how these will be addressed.
The GDPR also requires organisations to:
- give individuals specific information about the processing
- take steps to prevent errors, bias and discrimination, and
- give individuals rights to challenge and request a review of the decision
These provisions are designed to increase individuals understanding of how the organisation might be using their personal data.
8. The right to withdraw consent
Where we rely on your permission to process your personal information, you have a right to withdraw your consent at any time. We will always make it clear where we need your permission to undertake specific processing activities.
Please be aware that you will not be able to withdraw your consent if we do not rely on your permission to process your personal information ie: to use a service we are required to provide by law.
9. The right to make a subject access request (SAR)
A person (the Data Subject) has the right to request a copy of any personal information held by an organisation (the Data Controller); this is known as a Subject Access Request (SAR).
It is important to remember that not all personal information is covered and there are exemptions which may allow an organisation to refuse to comply with your subject access request (or parts of it) in certain circumstances.