What it means to you
Data Protection legislation means you have the right to know how your data has been processed and make requests to us for copies of that information, subject to some exemptions that might mean you are not entitled to a copy of that information..
Information Commissioner (ICO) – more information about these rights.
Personal data and special category data
Personal data is information that relates to an identifiable living individual. The definition includes information such as an identification number, location data or online identifier ie IP address, reflecting changes in technology and the way organisations collect information about people.
Personal data that has been pseudonymised – e.g. key-coded (such as a customer ID or reference number) – falls within the scope of Data Protection if the person holding the data has additional information to use the pseudonymised data to identify the person it is about. The special categories of personal data (personal sensitive data) which are subject to further protections of the law, include genetic data, and biometric data, where this data is processed to uniquely identify an individual.
If we process personal data relating to criminal convictions and offences we have to comply with additional safeguards under the Data Protection legislation.
Lawful basis
We will apply an appropriate lawful basis for processing your data. For most of our public services this will be because we have a legal obligation or, it’s necessary to process your personal data in the exercise of a task in the public interest or in our official capacity, or under a contract we have with you. Some services will ask for your explicit consent, such as collecting data like cookies when you go on our website or, being able to contact you by email or text for news updates.
Consent
In the case where we are relying on your explicit consent as the lawful basis to process your data, you can request to withdraw consent or restrict/object to some elements of the processing. The ICO has a guide to consent.
Please note that we may also ask for your permission to share sensitive health and care data that we have obtained from you in confidence, with partners to provide seamless continuity of service. This is separate to requiring consent under data protection legislation and is to ensure that we comply with our duty of confidence.
Transparency
To comply with data protection legislation, we must provide detailed information on why and how we are processing the data – we provide this information in privacy notices and we have used a layered approach as recommended by the ICO. These may be summarised and a web link provided for more information. Printed versions are available on request.
See our main customer privacy notice and links to further service specific notices.
Requesting a copy of your information – subject access requests
Anyone can make a request to the council for the information it holds about them. We would be grateful that you only ask for the information you actually need, to save time and allow us to be more efficient.
We will not charge for this request, unless we consider it is excessive. Once we have a valid request we will have a month to provide the information requested which we can extend if complex for two further months.
We will provide this in an electronic form unless you request otherwise. See our access to information page for help and the section to request personal information.
Correction
You have the right to ask for changes to inaccurate personal data. This may be your contact details or in the case of reports or assessments it may be making a note on the record.
Data portability
This allows you to ask for personal data to be given in an electronic form to be used in or transferred to another organisation’s electronic processing system. This only applies if the lawful basis for the processing is a contract with you or consent.
Erasure
In the few instances where as a public authority the council relies on your consent as our legal basis to process your personal data, you have the right to withdraw your consent and ask for your data to be deleted. As explained above, however, we will not rely on consent in most cases to process your information.
Automated decisions and profiling
If we process your personal data based on automated decisions (where no individual was involved in the final decision), and this will have a legal or similarly significant effect on you, you can request a written explanation of the decision made and you can contest the results of the decision.
We will notify you in a privacy notice if we carry out automated decision making or profiling that comes under this definition.
Accountability
All organisations have to demonstrate how they comply with Data Protection when collecting and processing your personal data, if asked by the Information Commissioner’s Office (ICO). Contracts need to be in place between us and an organisation that we ask to process your data on our behalf to provide a service or host a system is a data processing.
Data Protection Impact Assessments
Organisations are obliged to conduct a data protection impact assessment when processing is likely to result in a high risk to individuals. These assessments look at the privacy risk when introducing new technology such as AI, profiling, using special category data, matching data, use of CCTV and surveillance and a number of other types of processing.
Data Protection Officer
As a public authority, we have a statutory duty to appoint a Data Protection Officer. They are independent, provide audit assurance, review Data Protection Impact Assessments, provide the first point of contact for Data Protection complaints and report to the highest authority in their role, the council Corporate Board and Joint Managing Directors.
The Officer can be contacted by emailing: dataprotectionofficer@warwickshire.gov.uk.
Complaints about data protection
The council is required to have a process in place for dealing with complaints about data protection.