Your Rights & Subject Access Request
Overview
Access to your personal information
Who can make a request for information & making a request on behalf of a child
How much does it cost?
How long does it take?
How to make a complaint
Performance data for Subject Access Requests
Overview
From 25th May 2018, the General Data Protection Regulation (GDPR) as supplemented by the UK Data Protection Act 2018 will have legal effect.
This replacement data protection framework places new obligations on us and strengthens the rights that you have over the processing of your personal information.
The GDPR provides the following rights for individuals
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
These rights are not absolute and are dependent on conditions and exemptions. In some cases the rights described above only apply if the processing activity is undertaken on specific legal grounds and/or in defined circumstances. Therefore all of these rights are unlikely to be engaged in all cases.
You can find more detailed information about your rights from the Information Commissioner’s Office (the ICO). The ICO is the UK’s independent regulator responsible for upholding and enforcing your rights under data protection law.
Access to your personal information
You have the right to ask for information we hold about you; this is known as a Subject Access Request
Once you have made this request we must; Give you access to the information you ask for, unless an exemption applies
- Complete your request within a month of receiving it. If your request is very complicated, covering many years & different services, we may take up to an additional two month. We will inform you as soon as we know if this is required.
We would prefer that you send your request in writing/email to make the process simple and comprehensive, so there is no delay in getting your information.
To make a Subject Access Request (SAR) you must:
- Tell us what information you want to see, in as much detail as possible.
- Provide 2 forms of identification that proves you have the right to see this information; this should include proof of address such as a utility bill and photo ID such as a drivers licence.
- If you are asking for someone else’s information we require a signed letter, by hand, confirming they want you to access this information.
You can make a Subject Access Request by:
- By email – Informationanddata@tameside.gov.uk
- By letter – TMBC Subject Access Requests, Level 2 (Information & Data), PO BOX 317, Ashton under Lyne, OL6 0GS
- By using our online request form here
Who can make a request for information
You can make a request for information about yourself. The person who the request for information is about is legally known as the Data Subject.
A friend, relative, advocate or solicitor can also act on your behalf. However, this person must provide us with written permission from you to confirm that they are acting for you and we will require identification for you.
If someone does not have the mental capacity to make a request for their information, they may appoint a person with a lasting power of attorney or a Deputy appointed by the Court of Protection who can exercise rights on behalf of their behalf. In this circumstance, we can ask you to present a certified copy of your power of attorney.
Making a Subject Access Request on behalf of a Child
There is no set age in England which recognises when children are automatically able to exercise data protection rights.
As a general rule a child must have sufficient understanding and maturity to exercise their own rights and we will use a common sense approach if a child or young person submits a request.
For children aged under 13, it will generally be expected that a request is made by a person with parental responsibility, usually, the person who the child lives with. Any ‘best interest’ considerations will be taken into account.
The following evidences would be accepted as proof of parental responsibility:
- birth certificate
- court order
- adoption record
- Special Guardianship Order (SGO)
How much does it cost?
From 25th May 2018, the General Data Protection Regulation (GDPR) states that In most cases, when you are making a subject access request we cannot charge a fee.
However, when the request is excessive or unfounded we may charge a ‘reasonable fee’ for the administrative costs of complying with the request.
We may also charge a fee if you request further copies of the information you have requested, we will base this on the administrative costs of providing further copies.
How long does it take?
When you send in your subject access request we must complete your request within a month of receiving it.
Although, we can take up to an additional two months if your request is very complicated, covering many years & different services. We will inform you as soon as we know if this is required.
Subject Access Request Policy
The council's policy on how Subject Access Requests are dealt with can be accessed here
How to make a complaint
If you want to exercise your rights or to raise a concern about the way your personal information has been handled, please contact our Data Protection Officer (DP) by emailing informationanddata@tameside.gov.uk
Once you have contacted us we will process requests following the legal framework and the statutory time scales and let you know if we need more time.
If you do not hear from us by the latest due date or are not satisfied with the response you have been given, you have the right to complain to the Information Commissioner.
The Information Commissioner is the UK’s independent regulator responsible for upholding and enforcing the rights of individuals under data protection law.
You can email the Information Commissioner’s office (ICO)
accessicoinformation@ico.org.uk or write to:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Full information about your rights is also available on the ICO’s website.
Performance data for Subject Access Requests
Data will be available quarterly and will be published a month after the end of each quarter to enable us to capture the outcomes for all requests made during that time period.