Data subjects rights - frequently asked questions

How do I make a request?

Where you are making a request, please complete the form at www.sthelens.gov.uk/dataprotection.

For all requests, we will need:

documentary proof that you are who you say you are (this is for security reasons to ensure we are dealing with you and that none of your personal data is accessed or interfered with by anyone else falsely claiming to be you);
information about the request you are making and your dealings with us to help identify the personal data in question and to your request.

Please ensure you provide at least two forms of identification as directed in the form.

On receipt of your request, we will always send you a written acknowledgement and may need to ask you for:

proof of identification if you have not supplied this already;
information about the nature of your request and your dealings with us so we can understand, identify and locate personal data that is relevant where this is not already clear from your request.

If we do not hear back from you with confirmation of your identity and/or sufficient information to respond to your request, we will not be able to process your request.

Can someone else make a request for me?

A friend, relative, advocate or solicitor may act on your behalf. However, this person must supply written authority from you to confirm that they are acting for you and we will still require identification for you.

What if a data subject 'lacks mental capacity'?

A person with a lasting power of attorney appointed directly by the data subject or a deputy appointed by the Court of Protection may exercise these rights.

What about requests involving children?

There is no set age in England which recognises when children are automatically able to exercise data protection rights.

As a general rule a child must have sufficient understanding and maturity to exercise their own rights and a common sense approach will be adopted in the event a child or young person submits a request.

For children aged under 12, it will generally be expected that a request is made by a person with parental responsibility with whom the child normally resides and 'best interest' considerations will be taken into account.

When can I expect your response?

We aim to respond to your request without undue delay and no later than one calendar month counted from the first working day after we are in receipt of your request, and:

proof of your identity, and
any further information (where we have requested this from you) we need to process your request and/or locate and retrieve your personal data.

Where it is not possible to respond sooner and the last day before expiry of one calendar month, falls over a weekend or on a bank holiday, the latest due date will be treated as the first working day after the weekend or bank holiday.

If your request is complex or numerous, we may need to extend the length of time required to respond.

If this applies, we will let you know before the latest due date on which you would be expecting to hear back from us.

The law says we can extend the length of time to respond by a maximum of a further two calendar months.

Where it is not possible to respond sooner, and the last day before expiry of the second calendar month falls over a weekend or on a bank holiday, the latest due date will be treated as the first working day after the weekend or bank holiday.

We will always endeavour to respond as quickly as we can.

Will I have to pay a charge?

We will not charge a fee for fulfilling a request from you.

Will I get all of the personal data I am requesting?

It is important to note that the right of access to your own personal data does not extend to personal data about other people who may be identified in the data that also refers to you. We may therefore redact personal data about other persons where we are satisfied it is reasonable in the circumstances to do so.

In some cases data may be so interlinked that it is not possible to fulfil your request without breaching another person's privacy rights.

The names of professional staff (whether directly employed by us or not) involved in decision-making will often be disclosable and their identities will not be automatically redacted, unless this is warranted in a particular case.

The law recognises that there are occasions when it may be appropriate to withhold certain personal data and provides exemptions in specified circumstances.

If we withhold personal data on the basis that it is exempt from disclosure, where it is possible to do so, we will explain the exemption(s) we are relying on.

Can I choose the format in which my personal data is supplied?

Where you have submitted your request electronically or asked us to respond in a particular format, we will try to do so wherever this is reasonable.

Can you refuse my request?

In certain circumstances we may refuse to act on your request if we consider that your request is unfounded, excessive or repetitive in nature.

We will give our reasons if we refuse to comply with your request on this ground.

What if I am not satisfied with your response or it is taking too long?

If you do not hear from us by the latest due date or are not satisfied with the response we have given, you have the right to complain to the Information Commissioner's Office (ICO).

The ICO is the UK's independent regulator responsible for upholding and enforcing the rights of individuals under data protection law.

You can write to the ICO at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

You can also contact the ICO via their website: https://ico.org.uk