Privacy notice

The UK GDPR provides the following rights for individuals:

The right to be Informed

You have a right to be told how and why your data is being used, who it is being shared with, and if your fundamental rights or freedoms may be affected. You also have a right to be told if your data was involved in a data breach. Further information on this can be found in the Council's Privacy Notice. The information we will supply about the processing of your personal data will be:

• Concise, transparent, intelligible and easily accessible.
• Written in clear and plain language.
   

The right of Rectification

You are entitled to have any personal data held by Welwyn Hatfield Borough Council rectified if it is inaccurate or incomplete.

If we have disclosed the personal data in question to any of our partners or contractors we will inform them of the rectification, where possible. We will also inform you about the partners or contractors to whom the data has been disclosed, where appropriate and will do all of this within one month. This will be extended by two months where the request for rectification is complex.

If we are not taking action in response to a request for rectification, we will explain why to you and inform you of your complaint rights.

The right to Restrict Processing

We will restrict the processing of personal data in the following circumstances:

• If you contest the accuracy of the personal data we will restrict the processing until we have verified the accuracy of it.
• Where you have objected to the processing (where it was necessary for the performance of a public interest task or purpose of legitimate interests), and we are considering whether the Council's legitimate grounds override yours.
• When processing is unlawful and you oppose erasure and request a restriction instead.
• If we no longer need the personal data but you require the data to establish, exercise or defend a legal claim.
   

If we have disclosed the personal data in question to our partners or contractors, we will inform them about the restriction on the processing of the personal data, unless it is impossible or involves disproportionate effort to do so.

We will inform you when we decide to lift a restriction on processing and we will retain just enough information to ensure that the restriction is respected in the future.

The right to Object

You have the right to object to:

• Processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling)
• Direct marketing (including profiling)
• Processing for purposes of scientific/historical research and statistics.

If we are processing your personal data for the performance of a legal task or the Council's legitimate interests you must have an objection on grounds relating to your particular situation. We will stop the processing your personal data unless:

We can demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims.

The right of Access

You have the right to access the personal data held on you. This is so that you are aware of and can verify the lawfulness of the processing of your data.

At no charge a copy of your personal information will be provided within one calendar month of receipt. This will be extended by a further two months where requests are complex or numerous. However, a fee will be charged where a request is manifestly unfounded or excessive, particularly if it is repetitive. Such request could also be refused. This fee must be based on the administrative cost of providing the information. A fee will also be charged to comply with requests for further copies of the same information

You will be asked to verify your identity when making such requests.

The right to Erasure/ The right to be Forgotten

• You have the right to request the deletion or removal of personal data where there is no compelling reason for its continued processing. This will apply where:
• The personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
• You withdraw consent.
• You object to the processing and there is no overriding legitimate interest for continuing the processing.
• The personal data was unlawfully processed.
• The personal data has to be erased in order to comply with a legal obligation.
   

Your request for erasure will not be complied with where the personal data is processed for the following reasons:

• To exercise the right of freedom of expression and information;
• To comply with a legal obligation for the performance of a public interest task or exercise of official authority.
• For public health purposes in the public interest;
• Archiving purposes in the public interest, scientific research historical research or statistical purposes; or
• The exercise or defence of legal claims.
   

The right of Data Portability

The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services. The right to data portability only applies:

To personal data you provided to Welwyn Hatfield Borough Council.

Where the processing is based on your consent or for the performance of a contract. When processing is carried out by automated means.

The right to object to Automated decision making and Profiling

You have a right to ask for any decision made on you which is made by a computer to be reviewed by a human being, and you can object to the Council profiling your behaviours and characteristics.

This does not apply where the decision:

• Is necessary for entering into or performance of a contract between you and the Council.
• Is authorised by law.
• Is based on explicit consent.
   

Explicit Consent

Welwyn Hatfield Borough Council collects and processes data to provide services to our residents. The data we collect is for a specific, explicit and legitimate purpose and it will be obvious to you what your data is going to be used for.

We cannot and will not use information collected for one purpose for another without your permission.

We will gain your explicit consent where we may want to legitimately use personal data we hold on you.

We are not required to seek your consent where there is any other lawful basis to obtain and process your data. We can process data without consent if it's necessary for:

• The performance of a contract with the individual (or you will enter into a contract).
• The processing is required under a legal obligation to which we are a party
• The processing is necessary in order to protect the vital interests of you, the data subject, or of another natural person.
• The processing is necessary for the performance of a task carried out in the public interest or in the exercise of our official duties.