The General Data Protection Regulation and the Data Protection Act 2018 known together as data protection law places strict requirements on any organisation which processes personal information. The law states that personal information must be:
1. processed fairly, lawful and transparently
2. collected for specified, explicit and legitimate purposes
3. adequate, relevant and limited to what is necessary
4. accurate and kept up to date
5. kept for no longer than is necessary
6. processed in a manner that ensures appropriate security
These are known as the data protection principles.
As well as applying the data protection principles, to process personal information the Council must ensure it has a lawful basis for doing so. The lawful bases are set out in data protection law and include consent, legal obligation, or where the processing is necessary to perform a task in the public interest.
How we use your personal information
A key part of data protection law is making people aware of how we use their personal information. Our privacy notice does this and includes information on how we collect, share, and use your information.
We also have individual privacy notices to give you more detail about how we use your personal information in relation to specific services, including details of the relevant lawful basis for processing.
Data protection law gives you certain rights in relation to your personal data including the right to have inaccurate data corrected and to obtain a copy of it.
Full details of your rights under data law can be found on the Information Commissioner’s Office website or in the Council’s privacy notice.
Access to your Personal Information (Subject Access Request)
To access your personal information and obtain a copy of it, please complete and submit the Council’s Subject Access Request Form. The form includes some guidance on the information we need from you and how to complete the it.
From the date when we receive your completed form and have confirmed your identify, we will have 1 calendar month to provide you with a response. We can however extend this to three months in certain circumstances. If this is the case, we will let you know within 1 calendar month and tell you why.
There is generally no charge for providing you with your information but there are some circumstances when there might be. For example, if the request is excessive or for additional copies. If there is any charge, we will advise you within 1 calendar month and will ensure the fee is reasonable and only relates to the administrative cost of responding.
Please be aware that in some circumstances we may not be able to provide you with all personal information held by the Council. This would likely be the case if disclosure of the information would prejudice the prevention or detection of crime, or where the information relates to a third party.
Access to Personal Information (Third Party Requests)
There are occasions when the Council may share information with third party organisations. These will likely relate to occasions when requests relate to:
· the prevention or detection of crime
· the apprehension or prosecution of offenders
· the assessment or collection of a tax or duty or an imposition of a similar nature
· disclosures required by or made in connection with legal proceedings
Third parties most likely to be able to make relevant requests in relation to the above are, for example:
· statutory authorities with powers to prosecute, (eg Customs and Excise; Trading Standards, etc.)
· claimants in civil proceedings
· accused persons or defendants in criminal proceedings
· other agencies, according to purpose and legal status
If your organisation needs to request personal information that is held by us for the purposes listed above, please use the Third Party Request Form (Police and Statutory Enforcement Bodies) in the downloadable documents section below.
If you are from any other organisation and would like to request personal information held by us, please contact the Data Protection Officer using the contact details below, who will advise you of how to make your request and discuss with you the potential for disclosure.
Data Protection Policy
Carlisle City Council's Data Protection Policy is currently under review to ensure it complies with the latest data protection law provisions and will be added to this page soon.
Queries or complaints
If you have any data protection queries or wish to make a complaint in relation to how the Council has handled your personal information, please contact:
Data Protection Officer
Tel: 01228 817200