Your rights and contacting the Data Protection Officer

Learn about your data protection rights (such as making a Subject Access Request) and how to contact the Data Protection Officer

Your rights and subject access requests

What is a Subject Access Request?

Individuals have the right to access and receive a copy of their personal data, and other supplementary information held by Westmorland and Furness Council. This is commonly referred to as a Subject Access Request or ‘SAR’.

Subject Access Requests can be made verbally or in writing, including via social media. Please see ‘Submitting Subject Access Requests’ below for information.

Data Subjects can make requests themselves, or ask another person to do it on their behalf i.e. child (under 12), attorney, litigation friend. In these circumstances the council will need to see evidence of permission to request the data of another person and it should be emailed at the same time as the request is submitted. Failure to provide evidence may result in delays with handling your request or it being declined.

How Subject Access Requests are processed

In most cases the council does not charge a fee for handling Subject Access Requests, it can however charge a fee:

  • where a request is repeated to cover administrative costs
  • where a request is manifestly unfounded or excessive
  • in some circumstances, we may refuse to handle Subject Access Requests where they are vexatious, manifestly unfounded or excessive

Please be aware that the council may seek evidence of your identity and clarification of your request to assist with the identification of relevant information.

Once your request has been accepted, the council will:

  • provide a response within one calendar month (where possible)
  • inform you if your request cannot be responded to within one calendar month, as it is complex or you have submitted more than one request (the deadline for providing a response can be extended by up to a further two months)
  • conduct reasonable searches for the requested information
  • inform you if information is exempt from disclosure
  • provide a response via secure email unless an alternative format has been requested

Submitting Subject Access Requests

If you would like to submit a request or you would like assistance with submitting a request, please contact us:

If you have any concerns about how your personal data is being used by the council please contact the Data Protection Officer (DPO) by email: dataprotection@westmorlandandfurness.gov.uk

Your other rights

In addition to your right of access the UKGDPR gives you the following rights:

  • the right to be informed via the council's Privacy Notice
  • the right to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point
  • the right of rectification, we must correct inaccurate or incomplete data within one month
  • the right to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information. Where your personal data has been shared with others, we will ensure those using your personal data comply with your request for erasure
  • the right to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future
  • the right to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked
  • the right to object. You can object to your personal data being used for profiling, direct marketing or research purposes
  • you have rights in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention
  • Where our processing of your personal, special category personal or criminal/law enforcement data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent, we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on - in which case, we will let you know. Your withdrawal of your consent won't impact any of our processing up to that point.

Where our processing of your personal, special category personal or criminal/law enforcement data is necessary for our legitimate interests, you can object to this processing at any time. If you do this, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim.

Unless otherwise stated above you can exercise any of these rights by contacting us:

Verifying Your Identity

When exercising the rights mentioned above, please be aware that under UKGDPR Article 12(6) additional information can be requested to verify that you are the data subject if your identity is unconfirmed.

Please note that:

  • additional documentation is only required when the council cannot verify your identity using internal council systems that relate to the service you are requesting information about
  • the council will contact you for this documentation prior to processing your request
  • the statutory deadline for responding to your request will start when you have provided the additional documentation
  • failure to provide additional documentation may lead to the council rejecting your request

Contacting the Data Protection Officer 

You can contact the DPO by:

Complaints

If you have concerns about the way the council has processed your data, please contact us by:

If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you can complain to the Information Commissioner's Office (ICO).