Your right to complain
If you are at any point concerned or unhappy with the way in which we are processing your personal data, you may complain to the Information Commissioner’s Office, via their online webform or telephone 0303 123 1113.
The Information Commissioner's Offices are closed to post due to the Covid-19 pandemic. They are accepting complaints via the online form and telephone only. For more information please go to the ICO website statement on postal contact.
Access to your information
You have the right to request access to the information that we hold on you. This type of request is referred to as a subject access request. You can only request information about yourself and not that of others.
To ensure that information is only released to the individual in question, we may ask you to confirm your identity when processing a request. This is likely to be in the form of a copy of photo ID (passport or driving license) and proof of address (utility bill).
We will respond to a request of this type within one month of receiving the request. If we are unable to meet this timeframe, we will inform you of the delay within the month and the reasons for it.
The maximum extension to the period for responding will be two months, bringing the total timeframe to three months.
We will provide the information electronically wherever possible.
There will be some circumstances where fully responding to your request may not be possible:
- If we hold a large volume of information relevant to your request, to the degree that it would hinder the fulfilment of the request within the statutory timeframe, we may ask you to define the nature for the information you want access to. This may, for example, be by refining subject matter or setting a timeframe for the information.
- If we hold the information for the purpose of the prevention, investigation, detection or prosecution of criminal offences we may not be able to provide you with access to your information. This may, for example, be relevant when we are holding information in relation to our enforcement case work or when information is shared with us by other law enforcement bodies.
Restriction and rectification
You have the right to request that we update or change any information that we hold that you deem is inaccurate, incomplete or no longer necessary, this is known as rectification.
Restriction may be applied to processing whilst the accuracy or completeness of the information is being checked or if the purpose for which it is processed is being established.
When making such a request you must set out the grounds or reasons relating to your particular circumstances that underlie your request. We will respond to requests unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or the establishment, exercise or defence of legal claims.
If your personal data has been shared with any third parties, we will notify those third parties of your request for restriction or rectification and their responsibility to action your request.
Objection and erasure
You may object to the processing of your personal data. The right to object to processing means that you can request that we cease all processing of your data. This right cannot be applied to any information that is processed for the purposes of a legal obligation or the prevention, investigation, detection or prosecution of criminal offences.
You also have the right to request that we delete any information that we hold that you deem is no longer necessary or being processed unlawfully. We will respond to any requests for objection or erasure. We will act on each request based on its own merits.
There is a right to portability under the regulations. This means that you can request that we transfer any personal data that you have provided to us directly, under consent, so that it can be reused.
Automated decision making and profiling
You may request that no decisions are made by automated means using your personal data. This includes processing that reaches decisions that have a direct impact on you but has no human intervention, and profiling that analyses or aims to predict behaviour.
We do not undertake any activities of this nature.