Three Rivers District Council will comply with the Data Protection Act and General Data Protection (GDPR) principles and ensure that personal data is:
- Processed fairly and lawfully and in a transparent manner
- Obtained for one or more specified, explicit and lawful purposes
- Adequate, relevant and only limited to what is required
- Accurate and where necessary kept up to date
- Not kept in a form which permits identification of data subjects for longer than is necessary
- Processed in accordance with the rights of data subjects
- Processed in a manner that ensures appropriate security of the personal data.
The Three Rivers District Council Privacy Notice sets out how we collect, process and store personal data.
The Data Protection Legislation also gives data subjects additional rights about the information we hold about them and how we use it, including the following:
1) Right to information - this right provides the data subject with the ability to ask for information about what personal data (about him or her) is being processed and the rationale for such processing.
2) Right to access - this right provides the data subject with the ability to get access to their personal data that is being processed. This request provides the right for data subjects to see or view their own personal data, as well as to request copies of the personal data.
3) Right to rectification - this right provides the data subject with the ability to ask for modifications to their personal data in case the data subject believes that this personal data is not up to date or accurate.
4) Right to withdraw consent - this right provides the data subject with the ability to withdraw a previously given consent for processing of their personal data for a purpose. This is only applicable where the lawful basis for processing the personal data is because the data subject has given consent to the processing of their personal data for one or more specific purposes.
5) Right to object - this right provides the data subject with the ability to object to the processing of their personal data. Normally, this would be the same as the right to withdraw consent, if consent was appropriately requested and no processing other than legitimate purposes is being conducted.
6) Right to object to automated processing - this right provides the data subject with the ability to object to a decision based on automated processing. Using this right, a data subject may ask for their request for a service to be reviewed manually, because they believe that automated processing of their request may not consider their unique situation.
7) Right to erasure - also known as right to be forgotten, this right provides the data subject with the ability to ask for the deletion of their data. This will generally apply to situations where a customer relationship has ended. It is important to note that this is not an absolute right, and depends on the retention schedule and retention period in line with other applicable laws.
8) Right for data portability - this right provides the data subject with the ability to ask for transfer of their personal data. As part of such request, the data subject may ask for their personal data to be provided back to them or transferred to another controller. When doing so, the personal data must be provided or transferred in a machine-readable electronic format.
The Data Protection Officer at Three Rivers District Council is Phil King. He can be contacted by post at Three Rivers District Council, Three Rivers House, Northway, Rickmansworth, Herts WD3 1RL or by email: firstname.lastname@example.org