• Do you know about the rights individuals have under the law?
In summary these are as follows:
○ The right to be informed – being told what data you hold about them and what you do with it.
○ The right of access – being able to request a copy of their data you hold.
○ The right to rectification – being able to have inaccurate data corrected.
○ The right to erasure – being able to ask you to delete / destroy their data.
○ The right to restrict processing – being able to limit the amount or type of data used.
○ The right to data portability – requesting to move their data electronically to another business.
○ The right to object – being able to request you stop using their data.
• Do you have plans in place so you can deal with any requests?
• Do you know that a request can be made in writing or verbally, in person or on the phone?
A request could be made over the phone, in an email, or face to face. It doesn’t have to be made formally in writing by letter. If you can, treat requests that are easily dealt with as routine matters, in the normal course of business.
Simon, a local football-team manager, receives a call from a player asking for details of all the matches he has played in the last year. This can be dealt with as business as usual.
Peter (the newsagent) is asked by a customer in the shop for the balance of her account. This can be dealt with as business as usual.
You would probably want to treat the following requests in a more formal way:
One of Susan’s ex-employees requests a copy of the reference she gave about him to a prospective new employer.
Kevin manages the under-10s football team and receives a request from one of the children’s parents for a copy of the info held on their child.
• Do you know how long you have to respond to a request?
Pam receives a request on 3 September, so the time limit will start from the next day (4 September). This gives her until 4 October to complete the request.
However, Sachin receives a request on 30 March, so the time limit starts from the next day (31 March). As there is no equivalent date in April, Sachin has until 30 April to complete the request. If 30 April had fallen on a weekend, or was a public holiday, he would have until the end of the next working day to complete the request.
• Are you able to delete someone’s information if they ask you to?
Alex processes personal data to send direct marketing materials by post. As individuals may have the right to have their personal data erased, Alex makes sure he can erase personal data within one month, if needed.