View our 'what we do with your personal data when you...' infographic for a basic overview of the below information.
Contents
- Purpose and lawful basis for processing
- What we need and why we need it
- What we do with it
- How long we keep it
- What are your rights?
- Do we use any data processors?
Purpose and lawful basis for processing
Our purpose for processing your personal data is so we can fulfil your information request to us.
The lawful basis for this is article 6(1)(C) of the UK GDPR, which relates to processing necessary to comply with a legal obligation to which we are subject.
If any of the information you provide us in relation to information request contains special category data, such as health, religious or ethnic information the lawful basis we rely on to process it is article 9(2)(g) of the UK GDPR, which also relates to our public task and the safeguarding of your fundamental rights. And Schedule 1 part 2(6) of the DPA2018 which relates to statutory and government purposes.
What we need and why we need it
We need information from you to respond to you and to locate the information you are looking for. This enables us to comply with our legal obligations under the legislation we are subject to:
- General Data Protection Regulation (2016)
- Data Protection Act (2018)
- Freedom of Information Act (2000)
- Environmental Information Regulations (2004)
- Re-use of Public Sector Information Regulations
What we do with it
When we receive a request from you, we’ll set up an electronic case file containing the details of your request. This normally includes your contact details and any other information you have given us. We’ll also store on this case file a copy of the information that falls within the scope of your request.
If you are making a request about your personal data, or are acting on behalf of someone making such a request, then we’ll ask for information to satisfy us of your identity. If it’s relevant, we’ll also ask for information to show you have authority to act on someone else’s behalf.
We’ll use the information supplied to us to process your information request and check on the level of service we provide.
If the request is about information we have received from another organisation – regarding a complaint, for example – we’ll routinely consult the organisation/s concerned to seek their view on disclosure of the material.
We compile and publish statistics showing information such as the number of requests we receive, but not in a form that identifies anyone.
We may also contact you to ask if you would be interested in participating in a customer satisfaction survey. If you would like to be included, we will pass your name and email address onto a third party to complete the survey on our behalf.
How long we keep it
For information about how long we hold personal data, see our retention schedule.
If you agree to participate in the customer experience survey, ICS will keep your survey response for 30 days from the survey closes. They will keep your name and email address for 9 months from the survey expiry date.
What are your rights?
For more information on your rights, please see ‘Your rights as an individual’.
Do we use any data processors?
No – we do not use data processors for the above.
We use the Institute of Customer Service (ICS) as a data processor to run our customer satisfaction surveys.