How do I know what the Council is doing with my information?

We will tell you why we need to collect your information and what we are going to use it for. We will also tell you about the purpose for processing your personal information, how long we will need to keep it for and who it will be shared with. This information will be in what we will call a privacy notice.

If you give the information to us directly, for example, over the phone or by filling in a form, we will tell you then what will happen with your information.

If we get information about you from someone else, we will tell you what will happen with your information the first time we get in touch with you after receiving the information, or within one month of receiving the information.

We will try our best to make this information easy to understand, using clear and plain English and will make sure you can find it when you need it. We will review the information in our privacy notices regularly and where necessary update it.

If you have any questions about why use and how we manage your information you can ask a member of our staff and they will talk you through it.

Can I get a copy of my information?

You can ask the Council to confirm that we are processing your information and you can request to see the information we have about you. This is sometimes called a Subject Access Request.

To make a Subject Access Request you can email us at data-management@abzworks.co.uk.

Or alternatively you can phone us on 01224 346100.

Sometimes we might need to verify who you are before we process your request. This is because we want to make sure we don’t give your information to anyone who is not authorised to have it. The Council processes large amounts of information so we might also have to ask you to give us more details in relation to the information you would like to access.

Accessing a copy of the information we hold about you will normally be free of charge and will be provided to you within one month. If we can’t provide you with the information within one month we will let you know and explain the reason why. It might be because the request is complex, so it will take us a bit longer to respond. In these cases, we can extend the time period but only to a maximum of 3 months in total.

There are some circumstances set out in law where we may not be able to give you all the information we hold about you. If these circumstances apply, we will give you as much information as we can. Some examples of these circumstances are:

• Information that may be seriously harmful to you or someone else.
• The information identifies another person who has not agreed to it being passed to you.
• Information given and held for the purposes of preventing or detecting crime, or for prosecuting or apprehending offenders.
• Information which is restricted by another law, for example adoption agency records.
• Special rules apply to information provided by health professionals, the Children’s Reporter and the Education Service.

Can I change my information if I think it is inaccurate?

It’s important to the Council that the information we hold about you is correct and up to date. If we hold information about you that is incorrect or incomplete, you can ask us to correct it. We will do our best to fix it for you within one month. If it’s going to take us longer to correct it we will let you know within the first month, because if it’s a complicated case we can extend the period by 2 months.

If the Council has shared this information with anyone else, we will tell them to correct it too, and if you ask us who they are we will tell you. If we regularly share your information with anyone else this will be in the privacy notice we give you.

In some circumstances we might not be able to correct the information. This might be because we want to keep a record of the original information we received as well as the correction request as a supplementary statement. If this is the case will explain to you the reason why we unable to fulfil your request.

Can I get my information deleted?

In some circumstances, you can ask the Council to delete or remove information we hold about you. This right is sometimes referred to as the “right to be forgotten”. This is a qualified right, which means it only applies in certain circumstances:

• If we no longer need your information for the purpose we originally collected or processed it for.
• If you gave your consent for us to use your personal information and you decide to withdraw it.
• If we are using your information unlawfully.
• If we need to delete your information to comply with a legal obligation that the Council is subject to.

The Council keeps different types of information for different lengths of time. Sometimes there are specific laws which say how long we must keep information, and sometimes how long we keep information is based on business reasons. The Council needs to make sure that we comply with any legal requirements, but we also need to make sure that we keep our information for the right amount of time to evidence the decisions we take and the processes we follow where there is no specific relevant law. The Council has a Retention and Disposal Schedule which sets out how long we keep key council records, and we will always tell you how long we keep your information in the privacy notice we give you. This means that in some cases we won’t be able to delete or remove your information. In such cases there will be a good reason why we can’t, and we will explain this to you.

We will respond to your request within one month unless your request is complex, and we need more time. In this case we can extend the time period by 2 months. If we are not going to comply with your request we will tell you within the first month and explain why.

Can I ask the Council to stop using my information?

In some circumstances, you can tell us if you want us to stop processing information about you. We will restrict processing in the following circumstances:

• If you have exercised your right to have your information rectified.
• If you have exercised your right to object to the processing of your information.
• If the Council no longer needs your information for the purpose it was collected but you need us to keep it longer so you can establish or defend a legal claim.

When processing is restricted, we can store your information, but we won’t be able to process it any further. If the Council has shared this information with anyone else, we will tell them to stop processing your information too. We will retain enough information to ensure that any restrictions that are placed on processing your information are respected. If we decide to lift a restriction on the processing of your information, we will let you know.

Again, we have one month to respond to your request which can be extended by 2 months if it is a complex request. If we decide we can’t comply with your request, we will let you know within the first month and explain our reasons why.

Can I use my information for something else?

In some circumstances, you can ask us to give you a copy of your information so that you can re-use it. You can also ask us to send a copy to someone else on your behalf. We will make sure the information is in a machine-readable format. This is a qualified right, which means it only applies in certain circumstances:

• With information you have given directly to us.
• When we are processing your information based on your consent.
• When the processing is being done as part of a contract between you and the Council.

We will do this within one month but if your request is complex it might take a bit longer. In this case we may be allowed to extend the period of time we can respond by 2 months, but we will tell you about it and explain why.

I want the Council to stop using my information. What can I do?

This right is a qualified right which means it doesn’t always apply. You can tell us if you disagree with how we are processing your information about you if:

• We are processing your information for the performance of a task in the public interest or in the exercise of official authority.
• We are directly marketing to you.
• We are processing your information for historical research and statistics.

If you choose to exercise your right to object, we will stop processing your information unless we are able to:

• Demonstrate that the reason we are processing your information overrides your reason for objecting; or
• the processing is being done to establish, exercise or defend a legal claim.

This may mean that the Council won’t be able to be able stop processing your information, even if you make a request. This is because the Council is subject to many laws which affect what the activities we must do, how we must do them, and how we can evidence the decisions we have made and the things we have done.

Again, we have one month to respond to your request which can be extended by 2 months if it is a complex request. If we decide we can’t comply with your request, we will let you know within the first month and explain our reasons why.

I don’t want the Council to use my information for automated decision making and profiling. What can I do?

Automated decision-making is when a computer or programme solely makes an important decision about you without a human being involved in the process of making that decision.

We will always tell you if the Council is using automated decision making or profiling to make decisions about you in our privacy notice.

Your right not to be subject to a decision does not apply to all automated decisions. You would not be able to exercise this right when it’s necessary for entering into or for the performance of a contract between you and the Council, and if it’s been authorised by law, for example if we are using it for the prevention of fraud.

In Scotland, children aged 12 or over are presumed to be old enough and mature enough to exercise their own data protection rights and provide their own consent for data protection purposes, unless it can be shown otherwise.For children under the age of 12 it is normally the person with parental rights who can exercise rights and provide consent for data protection purposes.

See the Data Protection Act 2018 c.12 Part 7 General Section 208.

To exercise your legal rights about the way the Council handles and uses your information or to make a complaint, please contact the Council’s Information Protection Officer by email on data-management@abzworks.co.uk

You also have the right to make a complaint to the Information Commissioner’s Office. They are the body responsible for making sure organisations like the Council handle your information lawfully. For more information visit the Information Commissioner’s Office website.