Data protection and your rights

We have a legal duty to protect your personal data.

The use of your personal data is controlled by the UK General Data Protection Regulation 2018 (GDPR) and the Data Protection Act 2018, which relates to any living individual. St Helens Borough Council is, as defined under this act, Data Controller.

The council has a Data Protection Officer who has overall responsibility for data protection in the council, and acts in an independent manner in line with legislation. The council's Data Protection Officer is the Director of Policy and Transformation, and they can be contacted via email at dataprotection@sthelens.gov.uk.

Under the legislation, you have a number of rights relating to your personal data, which are detailed on the following pages.

Every time we collect personal data from you, we will inform you as a minimum of the following (known as a Privacy Notice):

• why we need it;
• why we are allowed to process it;
• your rights relating to this;
• how we intend to use it;
• who we may share it with;
• how long we will keep it for;
• the contact details of the Data Protection Officer;
• your right to complain to the ICO.

We meet these obligations in various ways depending on how you come into contact with us, including directing you to the relevant Privacy Notice.

You are entitled to ask us for copies of your personal data that we hold (known as the Right of Access / Subject Access).

When making a Subject Access Request you will be asked to provide identification as follows:

If you are the Data Subject, we will need proof of ID e.g. current passport, photo driving licence or birth certificate and proof of address e.g. utility bill (last 3 months), council tax bill (current year), current driving licence, bank statement (last 3 months) or other official documentation (last 3 months).

If the request is being made on behalf of another Data Subject, then we need the above, plus the below, depending on the circumstances.

• Parent/Guardian - Evidence of PR, a birth or adoption certificate if a child is aged 12 or under or lacks the capacity to understand what a SAR is.
• Parent/Guardian - Signed and dated written permission from a child for the requestor to act on their behalf if a child is aged 13 or over and has the capacity to understand what a SAR is.
• Lasting Power of Attorney - Evidence of this power.

You can make a Subject Access Request here (Link to: https://www.sthelens.gov.uk/article/6526/Raise-a-subject-access-request)

You also have the right to request further information, including:

• the reasons why we process your personal data.
• the types of personal data we process.
• the organisations we share your personal data with.
• how long we will retain your personal data for, where possible.
• your rights relating to this data.
• where we have obtained your personal data from.
• whether or not decisions are made about you solely using automated means (including profiling) without human intervention. If so, we will provide the logic involved, as well as how this affects you.

When providing you with a copy of your information we will also explain if we have redacted any information that identifies third parties.

If we withhold personal data on the basis that it is exempt from disclosure, where it is possible to do so, we will explain the exemption(s) we are relying on and the reason why one or more exemptions apply. 

In certain circumstances we may refuse to respond your request if we consider that it is unfounded, excessive, or repetitive in nature.

You are entitled to ask us to:

• correct inaccurate personal data about you
• update the personal data we hold if it is incomplete

(known as the Right of Rectification)

If we agree that the personal data you have identified is factually inaccurate, we will correct it and:

• try to inform anyone we may have shared it with of any correction(s) we have made so they can also make them;
• if you wish, we can tell you who we have shared it with so you can check they have also made any correction(s).

If you consider that personal data we hold about you is incomplete and we disagree, we may offer the option of adding a statement to our records explaining why you consider the personal data we hold is incomplete.

You have the right to stop us using your personal data (known as the Right to Object) where it is being processed for;

• direct marketing;
• performing our role in the public interest or exercising our official authority;
• our legitimate interest or those of a third party;
• scientific / historical research / statistics

Direct marketing

If you object to us using your personal data for direct marketing (or profiling linked to direct marketing) we will stop this processing.

Scientific / historical research / statistics

You can only object to use of your personal data for scientific/historical research or statistical purpose where:

• it is likely to cause substantial damage/distress; or
• involves decision-making about an individual

If you object to the on these grounds, we will carefully consider your request and let you know the outcome.

Public interest / exercising official authority / legitimate interest

Where you object to us processing your personal data for any of these reasons, we will:

• consider if we have strong enough legitimate grounds for this to continue; and
• whether these grounds are enough to justify overriding your privacy rights.

If the law requires us to process your personal data in the public interest or in exercising our official authority, it is very unlikely that we will be able to comply with the request. 

For example, you will not be able to use this right to prevent us from:

• collecting and administering council tax or assessing benefit entitlements;
• taking measures to protect the health and safety of our staff;
• establishing, exercising or defending our legal rights;
• pursuing criminal investigations or proceedings

In certain circumstances, you have the right to request that we erase your personal data (known as the Right to Erasure).  

These are:

• if we store your personal data for longer than is necessary or in breach of a legal obligation that requires its erasure;
• under consent, and you decide to withdraw this and request your personal data to be erased (if there is no other legal ground for this being kept);
• you have made an 'objection' and it has been accepted by us, and you have further requested that we erase the personal data in question;
• we are processing your personal data without a legal basis for doing so.

We will carefully consider your request, and our response will outline whether or not we consider retention of your personal data is unwarranted. 

It may not always be possible to agree to your erasure request and we have listed a number of grounds below where it may be necessary for us to retain your information:

• in order to comply with a legal obligation;
• for exercising legal rights or defending legal claims;
• for archiving in public interest;
• for public health functions in public interest.

If we agree to erase your personal data, we will try to notify any recipients and let you know who they are (if you ask us to do so).

In certain circumstances, you have the right to restrict the processing we carry out with your personal data (known as the Right to Restrict Processing).  

These are:

• where we are considering your arguments if you are:
  • contesting the accuracy of the personal data we hold about you; or
  • objecting to our processing of your personal data;
• if it has already been determined the processing is 'unlawful' but you ask us to keep the personal data and 'restrict' its use;
• when we no longer need to retain your personal data but you ask us to keep it to make your own legal claim.

We will carefully consider your request, and our response will outline whether or not we agree to restrict processing of your personal data.

If we agree to your request, we will:

• try to notify any recipients and let you know who they are (if you ask us to do so);
• let you know the outcome of your argument and notify you prior to lifting a restriction, if the restriction is relating to accuracy or an objection;
• delete the personal data only after resolving the issue(s), if the restriction is relating to unlawful processing or a legal claim.

In addition to storing your personal data we will only process it during the period of restriction:  

• with your consent; or
• where it is required in relation to legal claims;
• where it is required to protect another individual's rights; or
• where it is required for reasons of important public interest, e.g. communicating with the Information Commissioner's Office (ICO).

In general, decisions which affect you legally (or have similar significant impact) are not allowed to be made using solely automated decision making, this means without human involvement.

Where this is allowed, you have the right to ask for the decision to be looked again by an individual (known as the Right related to Automated Individual Decision Making, Including Profiling). It is allowed for processing:

• based on your explicit consent;
• inecessary for entering into or the performance of a contract with you;
• required or authorised by law.

Where an automated decision is made about you based on one of these reasons, you will be:

• informed that the processing involves automated decision making and advised about the logic involved and the likely effects of the processing;
• told what measures and safeguards we have in place to protect your privacy.

Within one month of receiving the information above, you have the right to:

• contest the automated decision;
• to ask that the automated decision be reconsidered to reach a fresh decision that is not based solely on automated processing.

If you contest an automated decision and ask for it to be reconsidered, we will respond within the allowed time period and let you know whether or not this fresh decision has led to the same or a different outcome. 

In certain circumstances, you have the right to request that personal data you have supplied to us be converted into a format so that it can be transmitted to another organisation (known as the right to data portability).

This right only applies where we process your personal data electronically, and the legal basis for our processing:

• is based on your consent; or
• is for entering into or the performance of a contract with you

To make a request under any of these rights, please contact us as detailed under 'Any data protection questions?' or complete this  data subjects rights form (PDF) [199KB] (opens new window)

We will generally respond to requests within one month of receipt, unless your request is considered complex or numerous.  We will advise you if the request will take longer than one month to respond to.

If we do not fulfil your request, we will explain our reasons and your right to complain to the Information Commissioner if you are not satisfied.

Please be aware that these rights are not absolute and are subject to conditions and exemptions. In some cases the rights only apply if the processing activity is on specific legal grounds and/or in defined circumstances. Therefore all of these rights are unlikely to be engaged in all cases. 

If you have any questions about these rights, please read the data subjects rights frequently asked questions.

For any other information about how the we deal with your personal data, please contact:

St Helens Borough Council
Town Hall
Victoria Square
St Helens
Merseyside
WA10 1HP

Email: dataprotection@sthelens.gov.uk

For more information about data protection then please go to the Information Commissioner's website.