Part 3, Chapter 3 of the Act provides the following individual rights:
- the right to be informed;
- the right of access;
- the right to rectification;
- the right to erasure or restrict processing; and
- the right not to be subject to automated decision-making.
Certain rights under the UK GDPR, such as the right to object and the right to data portability, do not exist in Part 3 of the Act. Further, there are exemptions and restrictions that can, in some circumstances, be legitimately applied to prevent individuals from exercising rights.
It is important to note that subject access rights and the rights to rectification, erasure and restriction do not apply to the processing of ‘relevant personal data’ in the course of a criminal investigation or criminal proceedings.
‘Relevant personal data’ means personal data contained in a judicial decision or in other documents relating to the investigation or proceedings which are created by or on behalf of a court or other judicial authority.
Access to ‘relevant personal data’ is governed by the appropriate legislation covering the disclosure of information in criminal proceedings, such as (in England and Wales) the Criminal Procedure and Investigations Act 1996.
This provision only applies if the judge or other judicial authority is the controller and the relevant personal data is contained in a judicial decision or in other documents which are created during a criminal investigation or proceedings and made by or on behalf of the judge or judicial authority. For example, the ‘relevant personal data’ may be contained in judge’s notes.
You must communicate any information in clear and plain language that you are required to provide in Part 3. It is also your duty more generally to assist individuals to exercise their rights.
Similar to the UK GDPR, the Act includes further provisions for individuals to exercise their rights through raising a complaint with the Information Commissioner, or taking matters to court.
The next sections explain each of these in more detail.