Data Protection Policy

6.1    The Council will only process personal information in line with the data subjects’ rights. Data subjects have the following rights:
•    The right to Erasure/be forgotten;
•    The right to rectification;
•    The right to be informed of any data sharing;
•    The right to object to data collection/use;
•    The right to withdraw consent
•    The right to access;
•    Rights in relation to automated decision making and profiling
•    The right to restrict processing
•    The right to data portability

6.2    To ensure individuals are aware of their rights the Council has:
•    Published a privacy notice on its website;
•    Published individuals’ rights on our website and how they can exercise their rights;
•    Maintained internal procedures on the processing of individuals exercising their rights;
•    Will review decisions generated by a computer if an individual exercises their right to object to decisions being made on them solely by a computer;
•    Cease to process data for profiling if an individual exercises their right to object to profiling.

6.3    The Council will ensure that the identity of an individual is confirmed before processing any exercise of individual rights.

6.4    To ensure that the Council meets its requirements in fulfilling an individual’s rights, unless there are legitimate reasons which override the rights or freedoms of an individual, it will:
•    stop processing data when an individual exercises their right to object;
•    erase data when an individual exercises their right to be forgotten;
•    inform individuals of how it is processing their data;
•    provide individuals with the information the Council holds on them.

6.5    The Council will only charge a fee of £25 per hour, increasing annually each financial year, from January 2019, by the RPI as at January prior to the start of the financial year, for access requests deemed to be excessive. The Council will not charge a fee for subject access requests in other circumstances. This was £28.77 in January 2022.

6.6    A register of subject access requests is maintained, including the date received, the name and address of the subject, brief details of the request, and the date the subject was responded to.