The UK General Data Protection Regulation (UK GDPR) provides certain rights for individuals whose personal data is being used, processed, or transferred to ensure transparency and so individuals have control over their personal data.
Your rights
Right to be informed about your personal information
This right allows you to be provided with clear and concise information about how your information is being processed, which includes:
- what information is being collected
- the purpose and lawful basis for processing
- who the data will be shared with, including details of international transfers
- retention periods for the personal data
- the rights available to you
- the right to lodge a complaint
Right of access to your personal information
This is sometimes called a Subject Access Request (SAR). If you make an SAR to us, we'll send you copies of your information. This could be paper records, computer records or other types of information.
The right of access can be exercised verbally, or in writing (by post or email), as well as by filling in the council’s individual rights request form at the bottom of this page. If needed, we may have to seek more information and identification from the you as the requester. Once your identity has been confirmed, an acknowledgement of your request will be sent to you.
Right of rectification of your personal information (correct your data if you think it’s wrong)
You have the right to ask us to correct inaccurate or incomplete information about you. When we receive your request, we will check whether the data is inaccurate, and rectify it, only if it is correct to do so.
If after considering your request it is felt that the criteria for rectification is not met, you will be informed of the decision with the reasons for it. Where a request for rectification concerns a professional opinion, we may include a supplementary statement of your views to go alongside the records and inform you about it.
Right to erasure of your personal information (Right to be forgotten, request to delete your data)
The right to erasure is also known as the right to be forgotten. This right allows you to ask for your personal data to be deleted if:
- personal data is no longer necessary
- you withdraw consent, which you have previously given
- personal data is unlawfully processed
- you object to the processing, and the data controller has no reason to continue processing
- data erasure is necessary for compliance with a legal obligation (EU law or national law)
This right does not apply where we need to use your data for one of our statutory purposes (like collecting Council Tax), or where we need it for a legal claim.
Right to restrict processing of your personal information (stop using your data)
This right allows you to ask us to restrict how we process your data and may be applied in the following circumstances:
- information is inaccurate (during the checking process)
- the data has been unlawfully processed and you oppose erasure and request restriction instead
- we no longer need data, but you want the data to be preserved, for example exercise or defend a legal claim
- we are considering our legitimate grounds for your request
You cannot stop us using your data to protect other people's rights, or for legal claims or for an important public interest reason.
Right to data portability of your personal information (sending your information to another organisation)
This right gives you the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format. It also gives you the right to request that we transmit this data directly to another organisation. This right only applies when:
- you either consented to us processing this information
- the processing of your data is for the performance of a contract we have with you
- you are carrying out the processing by automated means (excluding paper files)
As with all rights, this right is subject to certain exceptions and limitations.
Right to object to processing of your personal information
You have the right to object to us processing (using) your personal data at any time. This effectively means that you can stop or prevent us from using your data.
You can only object to processing when we are using your data for one of our usual statutory functions.
However, we may not need to stop processing, if we can give strong and legitimate reasons to continue using your data which outweigh your rights. This could be when, for example, your data is processed for public interest or for legitimate security reasons.
You have absolute right to object to direct marketing.
Rights in relation to automated decision-making including profiling involving your personal information
We do not use automated decision making or automated profiling at the moment, however, if we were to, this right would allow you to ask the council to have a human reconsider the decision that had been made. This right only applies to decisions made fully by automation which affect you legally or have a significant outcome.
How to exercise your rights under the UK GDPR
You can make a request in relation to your rights under the UK GDPR by using our online form:
Make an information rights request online
External link
You can also make a request by emailing
DPFOI@leeds.gov.uk, verbally by calling us on 0113 378 4251 or in writing. If you would prefer to make your request in writing, please write to:
Information Management and Governance
PO Box 837
LS1 9PZ
Please note that in order to make a request for your personal information, you will need to provide enough help to identify and locate your information, as well as provide appropriate identification to the council. This can be attached to our electronic form, or to an email request, or included in the envelope (if your request is in writing).
We normally accept a copy of one of the following:
- passport
- driving licence
- Council Tax bill
- utility bill
- power of attorney document
- child’s birth certificate
- statement to prove parental responsibility
Please do not send the original documents.
If you prefer, you can choose to provide identification at your local
community hub when making your request to us. The hub can also help you to complete the online form.
How long it will take
In relation to individual rights requests under the UK GDPR, the council has one month in which to respond, although this can be extended by a further 2 months if the request is complex or we have received a number of requests from you.
Within one month we will either:
- respond to your request (either actioning your right or explaining to you why we are unable to do so and provide the reason for this)
- ask you for more information to help us process your request
- inform you that we need additional time, and explain why
Cost
Requesting your personal information is usually free but we may charge if:
- you want more copies of the same information
- we think your request is excessive
We will tell you if there will be a charge before we send you the information.
Asking for someone else's information
To request information for someone else, you need evidence that you have their permission or appropriate authority to act on their behalf. This could be a written authority to make the request or a power of attorney.
We may release information about children to a parent or carer, however, the best interests of the child will always be considered.
Information we may not be able disclose
We may not be able to give your personal data if you asked for information that:
Contains personal data about someone else
Unless the other person gives their permission, or it is reasonable under the circumstances to provide it without permission, we are entitled to withhold this information.
Could risk someone's safety or welfare
If the information could risk someone's safety, we will not disclose it without their agreement. There are exemptions for health, social work, and education information if your request is likely to cause serious physical or mental harm to you, or someone else.
Is being used to prevent or detect crime
If the police are investigating or prosecuting offences, we will ask them whether giving you the information would prejudice their activities. If they think it will, we will not be able to give you the information.
We do not have to give you information that would prejudice us in assessing or collecting Council Tax.
Is exempt
Other exemptions include:
- disciplinary proceedings against council staff
- the investigation of complaints of misconduct against council members
- information processed for research, statistical or historical purposes
- information that is already available to the public (such as planning permission applications)
- management forecasting or management planning information
- confidential references
- records of intention in relation to negotiations, exam scripts, and legal advice
Unhappy with our response
If you are unhappy with the response to your request, please contact us by:
Email:
You can make a request by emailing
DPFOI@leeds.gov.uk
Phone:
In writing:
Information Management and Governance, PO Box 837, LS1 9PZ
We will appoint an investigating officer who will carry out an internal review of our decision and will inform you of the outcome.
Please note that there is no statutory requirement to carry out an internal review, however, the council is committed to trying to resolve issues where it can.
You can also get advice about your request from the
Information Commissioner's Office. If they think we haven't dealt with it properly, they will ask us to review our response to you.
For all other data protection complaints (other than requests), visit
data protection complaints and incident reporting.