Under the General Data Protection Regulation and Data Protection Act 2018, you have a number of rights.
We have provided information on these next, but you can also read the detailed information published by the Information Commissioner on their website.
When you wish to exercise your rights, you should contact us via email to DPA@blackpool.gov.uk or write to us at:
Data protection
Information governance team
Blackpool Council
PO Box 4
Blackpool
FY1 1NA
We ask you to email or write as this ensures we have the correct details and can verify these with you if necessary.
Right to be informed
You have the right to be informed about the collection and use of your personal data. We will provide you with information about the purposes for processing your personal data, the retention periods, and who it will be shared with.
We will tell you this in a ‘Privacy Notice’ which will be provided to you at the time that we collect your personal data.
If we obtain your personal data from other sources, such as DWP or your GP, we will provide you with the privacy notice within a reasonable period of obtaining the data and no later than one month.
More information about privacy notices, how we handle your data and to see the ones we publish can be found on our privacy notices page.
Right of access
You have the right to access your personal data and this is generally referred to as subject access or subject access request (SAR).
You can now make a subject access request verbally or in writing, but it is helpful if you follow our process as this ensures we have all the correct details and provide you with a copy of the personal data you wish to see.
You are only entitled to your own personal data, and not to information relating to other people (unless the information is also about you or you are acting on behalf of someone such as your child, or you have legal responsibility to act on their behalf).
We have more information on making a subject access request here.
Right to rectification
You have a right to have inaccurate personal data rectified, or completed if it is incomplete. In certain circumstances we may refuse a request for rectification but we will explain this to you.
You can make a request for rectification verbally or in writing but it would be helpful if you made the request in writing to ensure that we do not make the wrong corrections and we can check all spelling is correct.
We will respond to this request within one calendar month.
Right to erasure (the right to be ‘forgotten’)
The right to erasure, more commonly referred to as the ‘right to be forgotten’, is not absolute and only applies in certain circumstances. If we do agree to erase your personal data, we will have to tell anyone that we have shared your data with.The right to erasure does not apply if our processing of your personal data is necessary for one of the following reasons:
- To exercise the right of freedom of expression and information
- To comply with a legal obligation
- For the performance of a task carried out in the public interest or in the exercise of official authority
- For archiving purposes in the public interest, scientific research historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing
- For the establishment, exercise or defence of legal claims
Where we process your personal data for public health reasons, occupational health, or for health & Social care purposes, we may not be able to erase the data if it is being processed by a designated health professional.
Please note that in many instances, Blackpool Council will be processing your data for the performance of a “public task” and will not be able to erase your details. The council must act upon any request within one month of receipt.
must act upon any request within one month of receipt.
Right to restrict processing
You have the right to request the restriction of your personal data in certain circumstances and where you have a particular reason for wanting the restriction. This may be because you have issues with the content of the information that the council holds or how we have processed your data.
In most cases we will not be required to restrict your personal data indefinitely, but we will need to have the restriction in place for a certain period of time. When processing is restricted, we are permitted to store the personal data, but not use it.
You can request restriction of processing in the following circumstances:
- You contest the accuracy of your personal data and the council is verifying the accuracy of the data
- The data has been unlawfully processed (ie in breach of the lawfulness requirement of the first principle of the GDPR) and the individual opposes erasure and requests restriction instead
- We no longer need the personal data but you need us to keep it in order to establish, exercise or defend a legal claim; or
- You have objected to the council processing your data and we are now considering whether our legitimate grounds override those of you as an individual.
As with the other rights, we will respond to your within one calendar month.
Right to data portability
The right to data portability gives you the right to receive personal data you have provided to the council, in a structured, commonly used and machine readable format. It also gives you the right to request that the council transmits this data directly to another organisation.
Data portability allows you to obtain and reuse your personal data for your own purposes across different services.
However, this right only applies to information you have provided to us with your consent or for the performance of a contract; and where the council is carrying out the processing by automated means (ie not paper files).
Right to object
The right to object to the processing of your personal data effectively allows you to ask us to stop processing your personal data.
This right only applies in certain circumstances and whether it applies depends on what we are processing your data for.
You have the absolute right to object to the processing of your personal data if it is for direct marketing purposes. If we are processing data for scientific or historical research, or statistical purposes, the right to object is more limited.
If we are unable to comply with your right to object we will tell you.
We are required to respond to an objection within one calendar month.
Rights related to automated individual decision-making including profiling
Automated individual decision-making is where a decision is made solely by automated means without any human involvement.
Profiling is automated processing of personal data to evaluate certain things about an individual.
Profiling can be part of an automated decision-making process. We can only carry out solely automated decision-making with legal or similarly significant effects if the decision is:
- Necessary for entering into or performance of a contract between an organisation and the individual
- Authorised by law (for example, for the purposes of fraud or tax evasion)
- Based on the individual’s explicit consent.You will be told if we are doing this in the privacy notice for that service
You will be told if we are doing this in the privacy notice for that service.