Data Subject Rights

Your information

Why does the Council hold information about me?

We may hold information about you for a number of reasons but this is primarily so that we can provide you with the services you require. We may also use your information to plan and improve our services, and so that we can keep in touch with you. We have to protect your personal data and we don’t share it with other organisations without your consent, unless we are required to do so by law.

The Council has to comply with data protection laws which exist to make sure your personal data is legally and fairly processed. This guide has been produced to provide you with information about your rights under data protection legislation and to provide answers to some of the most frequently asked questions.

How are you using my data?

You have the right to know why we have your data and how we are using it. We issue privacy notices to provide you with this information.

The information contained in the privacy notice will vary depending on the reason for collecting or using your personal data but will contain:

  • Information about who we are, the reason for using your data and the legal basis for doing so
  • Information about other organisations we may share your data with
  • How long we will keep your data for
  • What rights you have regarding the data we are processing
  • The type of information we have about you
  • Information about your additional rights in relation to your data
  • The source of the data if we have obtained it from a third party
  • Contact details for our Data Protection Officer
  • How to make a complaint
  • Where we use IT systems (without human intervention) to make decisions based on your personal data

We will endeavour to provide this information at the time your data is collected and it will normally be on our website, in a leaflet or a poster, but may also be given verbally.

Can I see the information you have about me?

Data protection law allows you to access to your personal data. These requests are referred to as Subject Access Requests.

Making your Request

There are several ways you can make a request and there is no fee.

To help us look for your information please give as much detail as possible. We will ask you to be more specific if your request is unclear.

For example, you might know:

  • the dates or time period. This helps us know where to look.
  • the departments and teams you dealt with, including the names of staff who worked with you.
  • where we hold the information. The Council stores information in several locations, such as County Hall Lewes, St Marks House, Eastbourne, Ocean House, Hastings and the Archives in Falmer and Hailsham. Please tell us if you know the locations of your documents.
  • any reference numbers that might be relevant to you.

Sometimes we may decide to refuse a request. For example:

  • if we consider a request to be unfounded, for example, you already have the information.
  • you have already asked for it and been told we don’t have it.
  • the request is too broad.

In this case we will provide an explanation with information about your right to complain to the Information Commissioner’s Office (ICO). We will advise you of a refusal within one month of receiving your request.

Complex Requests

We aim to respond to all requests within one month of receipt; however, complex requests may take a further two months. We will let you know within one month if this is the case. Reasons why requests might be considered complex include:

  • the information needs to be gathered from multiple sources
  • separating your information from that of other people will take a long time
  • it is one in a series of requests from the same person.

Legally withholding information

If we hold your information we may not be able to give all of it to you. We will explain the reason to you along with any information that we can provide. There are data protection exemptions that prevent the release of certain records, or that require us to remove information. Possible exemptions may be:

  • information about another person, unless they have given their permission
  • advice given by a legal advisor
  • information regarding social care that is likely to impact our duty of care
  • information which has been given in confidence
  • information relating to law enforcement
  • adoption records

What if the information you have about me isn’t correct?

If the information we hold on you is wrong, you can ask for us to change it.

You can do this by completing the form below telling us what you would like us to change. We will consider your request within one month of receipt.

We will require the following evidence to process your request:

• Proof of ID and address. We need proof of name and address, so we only give information to the correct person. We need two pieces of identification to prove who you are; one piece of photographic identification (passport/driver’s license) and one proof of your current address (utility bill/bank statement). We accept photocopies, scanned copies and photographs of documents.

• Proof of entitlement to make the request. If you are making the request for information about someone other than, or as well as, yourself. Please see our guidance on making a request for information on the supporting documentation required.

ir webform

Can I ask you to delete my data?

You may be aware of what is commonly referred to as the ‘right to be forgotten’. This is also known as the right to erasure.

This allows individuals to request that their personal data is deleted where there is no justification for its continued use. This right only applies in certain circumstances, which are outlined below:

  1. The data is no longer necessary for the reason(s) for which the Council originally collected or processed it
  2. When you have provided consent for us to process your data and have subsequently withdrawn this consent
  3. If you have objected to us processing your data and we have no overriding grounds for continuing to process it
  4. Your data was processed in breach of the GDPR i.e. it was unlawfully processed
  5. There is a legal requirement to erase the data
  6. The data was collected with parental consent when you were a child and you no longer wish for your data to be held

If you believe you have a good reason to request erasure of your data please complete the form below.

We will require the following evidence to process your request

  • Proof of ID and address. We need proof of name and address, so we only give information to the correct person. We need two pieces of identification to prove who you are; one piece of photographic identification (passport/driver’s license) and one proof of your current address (utility bill/bank statement). We accept photocopies, scanned copies and photographs of documents.
  • Proof of entitlement to make the request. If you are making the request for information about someone other than, or as well as, yourself. Please see our guidance on making a request for information on the supporting documentation required.

ir webform

There are some circumstances where we will be unable to comply with a request for erasure, including:

  • When we have a legal obligation or it is part of our official authority to process the data
  • For public health reasons
  • For certain archiving activities
  • When we need the data in connection with a legal claim

We will respond to all requests sensitively and as quickly as possible. We will aim to respond to all requests within one month of receipt. If we consider your request to be complex or if you submit multiple requests, we may extend the response time to three months. This will be discussed with you as soon as possible after receiving your request and before the end of the first month.

We will give full consideration to all requests and, in particular, those relating to children’s personal data, regardless of your age when you submit a request for the right to be forgotten (the right to erasure).

Can I ask you to restrict the use of my data?

It may be possible in certain, specific, circumstances to restrict the processing of your data.

We will stop processing your data and will do no more than store it

  • Whilst establishing accuracy of data, if you have contested this
  • Whilst we follow up any objection you have raised to us processing your data.
  • When your data has been processed unlawfully but you do not want us to erase it and have asked, instead, for us to restrict processing of the data.
  • When we no longer need the data but you have advised us that you need it in connection with a legal claim.

We will advise you when we decide to remove a restriction on processing your data.

We may refuse to restrict the processing of your data if:

  • The processing is necessary for the Council in connection with a legal claim
  • It is necessary for the protection of another person
  • There are substantial public interest reasons for continuing to process the data

You can request a restriction by completing the form below. We will require the following evidence to process your request

  • Proof of ID and address. We need proof of name and address, so we only give information to the correct person. We need two pieces of identification to prove who you are; one piece of photographic identification (passport/driver’s license) and one proof of your current address (utility bill/bank statement). We accept photocopies, scanned copies and photographs of documents.
  • Proof of entitlement to make the request. If you are making the request for information about someone other than, or as well as, yourself. Please see our guidance on making a request for information on the supporting documentation required.

ir webform

Can I take my data elsewhere?

There are some situations when you have a right to not only see the data we hold on you but also to transfer it to another organisation, if you wish. This will only apply, however, when:

  • You have supplied the data yourself and provided consent for the processing; or
  • The data is being processed as part of a contract which you are a party to; and
  • The data is held electronically (not in paper files)

If you wish to make a request to exercise this right, please complete the form below. We will require the following evidence to process your request

  • Proof of ID and address. We need proof of name and address, so we only give information to the correct person. We need two pieces of identification to prove who you are; one piece of photographic identification (passport/driver’s license) and one proof of your current address (utility bill/bank statement). We accept photocopies, scanned copies and photographs of documents.
  • Proof of entitlement to make the request. If you are making the request for information about someone other than, or as well as, yourself. Please see our guidance on making a request for information on the supporting documentation required.

ir webform

Can I object to my data being used?

You have the right to object to your information being processed in the following circumstances:

  • If the legal justification we have outlined is that processing is necessary either to a) perform a task carried out in the public interest or b) as part of the organisations official authority or legitimate interest and you feel this is not applicable.
  • In the case that we retain your information in defence or potential defence of a legal claim but you believe there are insufficient grounds to do so.

You also have a right to object to your data being used for direct marketing purposes at any time and we must cease processing for this purpose. Examples of direct marketing conducted by the might Council include distribution of leaflets, where you are the addressee, providing information on services that might be relevant to you.

Where we use IT systems to make automatic decisions based on your personal data e.g. calculate your eligibility to receive a service, unless an exemption applies you have a right to object and:

  • request human intervention in the decision making
  • be able to express your point of view
  • obtain an explanation of how a decision has been reached
  • challenge the decision

You do not have a right to object to ‘automated decision making’ if:

  • it is necessary to fulfil a contract in which you are party
  • automated processing is authorised by law
  • we have your explicit consent

Where we are using your data for research purposes you have the right to object unless the research is being undertaken in the wider public interest and which outweighs your right to privacy.

We must respond to your objection within one month. For complex requests, this response may be to notify you that a three month deadline for addressing your objection will apply.

To make any of the objections above, please complete the form below. We will require the following evidence to process your request

  • Proof of ID and address. We need proof of name and address, so we only give information to the correct person. We need two pieces of identification to prove who you are; one piece of photographic identification (passport/driver’s license) and one proof of your current address (utility bill/bank statement). We accept photocopies, scanned copies and photographs of documents.
  • Proof of entitlement to make the request. If you are making the request for information about someone other than, or as well as, yourself. Please see our guidance on making a request for information on the supporting documentation required.

ir webform

Contact details

Should you have any further queries on the uses of your information, or to complain about the use of your information, please contact:

You can also contact the ICO for further information:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Phone: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number

Email ICO
Report a concern on the ICO website