Privacy Notice and Data Protection

You have rights under the General Data Protection Regulation 2016 (GDPR) regarding the personal data the council, as the Data Controller, processes about you.

In this section, you can learn more about how to exercise your rights in regards to:  

• Right to access (Subject access request)
• Right to erasure
• Right to rectification
• Right to restriction of processing
• Right to portability
• Right to object

How to exercise your right

Right to access

To make a subject access request visit our subject access request page

Right to erasure

This allows you to request that we delete our records or some of our records in so far as they identify you. It does not apply in all circumstances.

When does this apply?

• If you provided the information with your consent.
• If the data is no longer necessary and the timescale for us to keep records has expired
• If the data is being unlawfully processed, e.g we have processed data for a purpose we were not entitled to
• If you successfully object to the data processing under the Right to Object 
• If we are obliged to erase the data to comply with a legal obligation
• If we have made the data available on-line or to others, we will need to erase that data or ask the other party to do so.

When does this not apply?

If we need the information to provide a service we are authorised to provide by law, for a legal obligation or we believe the data to be necessary for a task in the overriding public interest.

• If the data is required for a contract to which you are party
• If records are required to protect public health
• If we require the data to establish, exercise or defend a legal claim
• If records are required for archiving in the public interest or for scientific or historical interest.

Right to rectification

This concerns correcting your personal data that is held.

When does this apply?

If you believe the data held is not accurate, you can request that it is corrected without undue delay. Similarly, if data is incomplete you can ask that it is completed.

When does this not apply?

We are obliged to correct incorrect data and incomplete data without undue delay.

However, if we need to make further checks or dispute that the data we hold is incorrect we may restrict access to the data pending a decision.

Rectification can be achieved by adding to the record or creating a supplementary record. Even if we decide that the information is correct, we will place a statement from you on the record with the data you believe to be correct or stating your dispute.

And if we have made the data available on-line or to others, we will need to correct that data or ask the other party to do so.

Right to restriction of processing

You can ask that access to your records is limited in certain circumstances.

When does this apply?

If you are contesting the accuracy of the data on record and we are seeking to verify it.

If the processing of your data is unlawful, but you want the record preserved.

• This could be because you are pursuing a complaint.
• It could also be because you need the data to establish a legal claim, to exercise and/ or defend a legal claim.
• This could also be while you are making an objection to the council processing your data under a lawful authority. This also applies to objections to processing under legitimate interest.

In these circumstances, the council may only process the data with your consent or to establish exercise or defend a legal claim or to protect the rights of another person or important public interest.

And if we have made the data available on-line or to others, we will need to restrict that data or ask the other party to do so.

While there is a request for restriction of processing, we must inform you before lifting that restriction.

Right to portability

This allows you to be provided with a copy of your data in an accessible electronic format. This does not apply to all data.

When does this apply?

• If you gave us the data with your consent
• If the data was provided as required for a contract between you and the council.
• If the processing is electronic

When does this not apply?

• It does not apply to data collected in any other circumstances
• The data we provide to you can also include data directly observed from the information you provided to us.

At your request, we can pass this data to another data controller.

E.g. if you move to another authority you may wish to transfer details, but as this does not apply to data we process for a task carried out in the public interest so many of the Council’s services will not be able to comply with such a request.

Right to Object

You have the right to object to the Council processing your personal information. This is not an absolute right and only applies in certain limited circumstances.  

You have the right to object to the processing of your personal information where the Council is relying upon one of the following reasons as a lawful basis for processing your personal information.

• Public task
• Legitimate interests

How to contact us and the Information Commissioner

For further information, or to make a request to exercise any of your data subject rights you can contact us by email or by post

Email: dpo@sutton.gov.uk

Data Protection Officer
c/o Information Governance
Guildhall 2
Kingston Council
High Street
Kingston
KT1 1EU

For more information about your data rights visit the Information Commissioner's website.