Personal data and data protection
Every individual has a number of rights in relation to their own personal data and their privacy.
This page has been designed to inform you about those rights and how you can exercise them at Richmondshire District Council.
You may also want to read our helpful definitions page to understand some of the terminology we use.
Right of access (subject access request)
Data subjects (that is the individual who the data is about) have a very strong right of access to their own personal information held by an organisation. This could be information held in electronic form (ie emails or database entries) or it could be paper files that we hold (ie paper records or archived files).
What am I entitled to?
When I am the data subject
Data subjects are only entitled to their own personal data. If data about other individuals are included within your files then it is likely that this information will be withheld.
When I am acting on behalf of the data subject
If you are acting on behalf of a data subject (ie parent, legal guardian, or solicitor) then you may still have a right of access to information about the data subject. The council would require the following to be able to disclose records to you:
|Data subject||Evidence required by the council|
Child under 12 (or child lacking mental capacity)
Demonstrable evidence that you have parental responsibility for that child.
Child over 12
Your child may be asked to consent to disclose data to you.
Adult (who lacks mental capacity)
Official paperwork listing you as legal guardian of the data subject.
Solicitor or agent (acting on behalf of an individual).
A form of authority addressed specifically to the council and signed by the data subject or their legal representative. In some circumstances we may also request explicit consent from the data subject.
Accessing the records of deceased persons
A common law of confidentiality restricts the council from disclosing a deceased person’s records to any individual other than the personal representative of the deceased’s estate. That is, an individual who has a grant of probate (if the deceased left a will) or letter of administration (if the deceased did not leave a will – otherwise known as intestate).
If you are the personal representative for the deceased’s estate and affairs the council will request the legal documentation from you validating this, and will therefore be able to consider disclosing the requested records.
Are you allowed to withhold information?
Yes. In some circumstances the council is allowed to withhold information. This could be, but not limited to, if disclosure could prejudice a criminal investigation, if disclosure could cause mental or physical harm to any individual, or if information originates from the court. These are known as exemptions.
Exemptions are not applied to information very often but when they are the council may not need to inform you of such an application.
Right to erasure, Right to rectification, and Right to restriction
All individuals have a right to request that an organisation deletes, corrects or limits part or all of the personal information that it holds about them.
Where the council is processing your personal data based on a legal power or an official authority it will only comply with one of these requests if:
- It is certain that the personal data it holds about you is incorrect or,
- It no longer requires your personal data for the purpose that it was collected
In most cases we will upload a copy of your complaint to any information we hold about you to ensure we have a record of your request.
Please be aware that decisions in regards to these requests are made on a case-by-case basis. The council will make a judgement based on relevant information in deciding whether or not to comply with the request.
Right to object to automated decision making
When the council has used any ‘automated decision making’ software (that is if a computer has made a decision about you without human involvement) then you have a right to ask for a human being to review the decision instead.
We will always tell you when we do use automated decision making and provide you with details about how you are able to appeal
How do I make a data protection request?
All data protection requests should be made using the below online form
Or by completing the printable form and returning it to the below address:
Private and confidential
Data Protection Officer
Richmondshire District Council
To make a data protection request, you will need to validate your identity (so that we can be certain that only you have access to your personal data).
You can do this either by attending one of our council offices in person or by providing us with electronic copies of your ID via email.
The easiest and most straightforward way to make a data protection request and provide proof of your identity is through our online form.
What happens next?
Once the council has validated your identify and is certain of your request then it will acknowledge this with you as soon as possible.
The council then has up to 30 calendar days to respond to your request.
Please be aware that in some circumstances the council may apply a discretionary extension of a further 60 calendar days if it believes your request is complex or very large. The council will write to you and let you know if this is the case.
Right to complain
If you are unhappy with the way in which your data has been handled or the way in which a data protection request has been answered then you may complain to the council’s data protection officer.
You can contact the data protection officer during usual office hours at the following:
Data Protection Officer
Richmondshire District Council
If you remain dissatisfied with the response from the council’s data protection officer, or if you would rather complain straight to a regulator, then you may make a complaint to the Information Commissioner’s Office (ICO) who regulate data protection and information governance matters in the UK.
You can contact the ICO at:
First Contact Team
Information Commissioner’s Office