This covers requests which you make to us under the Freedom of Information Act 2000, UK General Data Protection Regulation , Data Protection Act 2018 or the Environmental Information Regulations 2004.
If you are a complainant, this notice supplements information which we have already given you.
When you make a request to us, we will need your name and contact details. We need this information for the purposes of administering, processing and responding to your request.
We need information from you to respond to you and to locate the information you are looking for. This enables us to comply with our legal obligations under the legislation we are subject to:
General Data Protection Regulation (2016)
Data Protection Act (2018)
Freedom of Information Act (2000)
Environmental Information Regulations (2004)
Re-use of Public Sector Information Regulations
In certain circumstances we may also require information that proves who you are or that you are entitled to see the information you are requesting.
We will not collect any personal data from you which we do not need.
We will only use the personal information to handle your information access request and to check on the level of service we provide. We compile statistics which are reported within the organisation showing information like the number of complaints we receive, but not in a form which identifies anyone.
Our purpose for processing your personal data is so we can fulfil your information request to us.
The lawful basis for this is article 6(1)(C) of the UK GDPR, which relates to processing necessary to comply with a legal obligation to which we are subject.
If any of the information you provide us in relation to information request contains special category data, such as health, religious or ethnic information the lawful basis we rely on to process it is article 9(2)(g) of the UK GDPR, which also relates to our public task and the safeguarding of your fundamental rights. And Schedule 1 part 2(6) of the DPA2018 which relates to statutory and government purposes.
If the information you have requested has been provided to us by someone else or another organisation, then we may contact them to discuss giving it out.
When the information relates to information provided to us about your complaint, we will need to identify you to the organisation so they can discuss this with us.
When the information relates to a Freedom of Information or Environmental Information request, then we will not tell another organisation who you are.
We do not use any data processors to fulfil information requests.
Where we receive a complaint from the Information Commissioner’s Office, they will request information from us, which we will have to provide because we are legally required to do so.
We retain personal information only for as long as necessary to deal with your information access request, or any follow up appeals, or investigations.
We will keep correspondence relating to FOI and EIR requests or appeals for one year after our response to your request / review request has been issued. If you have raised a complaint with the Information Commissioner’s Office (ICO) we will retain the information for one year after the ICO’s investigation has concluded.
For subject access requests the correspondence relating to the request or appeal will be held on our case management system and deleted in accordance with our Retention and Disposal of Casework Records policy. You can find it here on our website.
If you decide to raise a complaint about our response to your subject access request with the ICO please notify us promptly so we can delay the information being deleted.