The Data Protection Act 1998 governs the protection and use of personal data. The Act applies to personal data of living individuals and does not apply to information relating to the deceased. The eight principles contained in the Act state that personal data shall be:
1. Processed fairly and lawfully.
2. Processed only for specified, lawful and compatible purposes.
3. Adequate, relevant and not excessive.
4. Accurate and where necessary, kept up to date.
5. Kept for no longer than necessary.
6. Processed in accordance with the rights of the data subject.
7. Kept secure.
8. Transferred outside the European Economic area only if there is adequate protection.
Individuals have certain rights in respect of their own personal data, which are:
1. Rights of subject access.
2. Right to prevent processing likely to cause unwarranted, substantial damage or distress.
3. Right to prevent processing for the purposes of direct marketing.
4. Right in relation to automated decision making.
5. Right to take action for compensation if the individual suffers damage.
6. Right to take action to rectify, block, erase or destroy inaccurate data.
7. Right to make a request for the Information Commissioner for an assessment to see whether any provision of the Act has been contravened. (The Information Commissioner's Office is the independent body set up to enforce the Act and provide advice and guidance to individuals and organisations).
SUBJECT ACCESS REQUESTS
The right of subject access entitles individuals to see information held about themselves. Requests for this type of information must be made in writing and are known as 'Subject Access Requests'.
The process for making a subject access request is as follows:
If you are seeking records relating to a time when you were in care, no fee will be charged. Please just type 'N/A' in the 'receipt number' field.
1. Pay the fee of £10 either online (new window) or by telephone.
2. Make a note of your receipt number.
3. Complete a Subject Access Request Form (New Window) ensuring that you enter your receipt number on the form.
Please note, forms without a receipt number will not be processed and, if your receipt number is invalid, there may be a delay in processing the request while the payment is located.
If you would prefer to send your application by post or deliver it by hand to Council offices, a copy of the form, which can be downloaded, is attached here:
SAR form English July 2016
Flintshire County Council will only use the information on the subject access request form for the purpose for which it has been provided and will not disclose it to any other party without the consent of the data subject, except where permitted by the Data Protection Act.
The Council will have 40 calender days from receipt of the written request to respond, provided that the fee of £10 has been received, that the Council is satisfied as to the identity of the person making the request and that sufficient information has been provided to be able to locate the information requested.
Although Subject Access Requests can be accepted electronically, responses will usually be sent by recorded delivery or similar method for security reasons.
DATA PROTECTION COMPLAINTS
The Council has a specific procedure to deal with any complaints about how personal information has been processed, and this can by clicking on the link below:
Data Protection Complaints Procedure
For further information about Data Protection in Flintshire County Council write to:
Flintshire County Council, Data Protection Team, Democratic Services, County Hall, Mold, Flintshire CH7 6NR or telephone 01352 702423.
Information and advice about Data Protection can be found on the Information Commissioner's website: www.ico.org.uk