Personal Information

Your Rights

IMAGE: The cover shows the Orkney Islands Council crest and the title “Personal Information Your Rights”. It states: “All our written information can be made available, on request, in a range of different formats and languages. If you would like this document in any other format or language, please contact Business Support on 01856 873535 or email business.support@orkney.gov.uk.”

All our written information can be made available, on request, in a range of different formats and languages. If you would like this document in any other format or language, please contact Business Support on 01856 873535 or email business.support@orkney.gov.uk.

Contents

• What are your rights? — 3
• 1. How will your personal information will be used? — 4
• 2. How do you ask to see your information? — 7
• 3. What do you do if information held about you is incorrect? — 10
• 4. Your right to erasure or the ‘right to be forgotten’ — 11
• 5. Your right to ask the Council to restrict how your personal information is used — 12
• 6. Your right to object to the use of your personal information — 13
• 7. Right to complain — 14
• Further Information — 15
• Document Control Sheet — 16
• Appendix 1 — 17

What are your rights?

In this leaflet we explain your rights, as a user of Council services.

Your rights are:

1. The right to be informed about how your information will be used.
2. The right of access to your personal information.
3. The right to rectification, which is the right to require the Council to correct any inaccuracies or omissions.
4. The right to request the erasure of any personal information held by the Council where the Council no longer has legal reason to hold the information.
5. The right to request that your information is only processed in certain ways.
6. The right to object to the Council processing your personal information.

You also have the right to complain to the Council’s Data Protection Officer and the Information Commissioner’s Office if you are unhappy with the way the Council has processed your personal information.

These are not absolute rights and there may be circumstances where the Council is legally obliged to process your information in a particular way.

1. How will your personal information will be used?

We keep personal information about you for a variety of reasons, for example in order that we can:

• Provide you with the services you require.
• Provide you with up to date information about these services and the most appropriate service for your needs.
• Collect council tax and rent.
• Assess the correct level of benefit for your needs.

The information about you is also used to maintain a record of any help provided (Orkney Health and Care’s provision of home care services, for example) in order that we can look at it from time to time to see if it is still what you need and to plan for any changes. The personal information you provide may also be shared with other agencies involved in the provision of services to you, and between different services of the Council.

Your personal information will be processed by Orkney Islands Council, School Place, Kirkwall, KW15 1NY. You can contact the Council on 01856 873535 or business.support@orkney.gov.uk.

What sort of information do we hold?

The personal information held will depend on the service being provided. Basic information includes your name and address, age, date of birth, sex, next of kin and a note of the service provided. Decisions regarding the provision of the service and any meetings between you and the section of the Council providing the service may appear on records.

Other more sensitive data may also be held. Depending on the needs of the service being provided such data may include, for example, details of a person’s physical or mental health, disabilities and racial or ethnic origin. Data relating to specific services include:

• The level of payment and the current state of the account – Council Tax.
• Property details and the extent of proposed alterations – Planning Services.
• Health and disability information – Orkney Health and Care.

Personal information we hold may also take the form of images captured by CCTV equipment on Council premises for security and prevention of crime purposes.

The Council’s entry on the Information Commissioner’s Data Protection Register can be accessed from this link. Our entry on the register provides more detail on the information we hold and how we use it.

Who do we share information with?

We will only share information where we have a statutory right to do so.

The Council is legally obliged to share certain data with other public bodies such as HMRC and will do so where the law requires this; the Council will also generally comply with requests for specific information from other regulatory and law enforcement bodies where this is necessary and proportionate. Information is also analysed internally to provide management information, inform service delivery reform and similar purposes.

Transferring our information outside the UK or European Economic Area

The Council will not transfer personal data outside either the UK or the European Economic Area (EEA) unless this cannot be avoided. The Council will only transfer data outside the UK and the EEA when it is satisfied that the party which will handle the data and the country it is processing it in will provide adequate safeguards for personal privacy. On the occasions when it does transfer your information outside the UK or the European Economic Area, the Council will inform you.

How do we keep the information and who is responsible?

The information is kept on secure computer systems and in secure manual filing systems. Maintaining the record and keeping it secure is the responsibility of the Council service providing the services you receive. All our employees are required to comply with our Data Protection Policy.

Are the records confidential?

All our employees agree to a confidentiality clause when they start work with us. Our employees also have a duty of care when providing services. This includes respecting the right to confidentiality and ensuring that information about you is only used and given to others for the purposes of the service being provided. Care is taken to ensure that third parties cannot access the information without permission and that data about you is not disclosed, to third parties or others, unless we are legally obliged to or if you provide your consent.

How long are records about you held?

The Council will only keep your information for as long as necessary. Full details of how long the Council usually retains your information can be found in the Council’s Retention and Disposal Schedule which is published on the Council’s website here: OIC Retention Disposal Schedule

However, there may be circumstances where we may need to keep your information for longer. Once the Council no longer needs to keep your information, it will be securely destroyed.

Profiling and automatic Decision making

The Council does not use profiling or automated decision-making processes. Some processes are semi-automated (such as anti-fraud data matching) but a human decision maker will always be involved before any decision is reached in relation to you.

2. How do you ask to see your information?

You should submit a request in writing to tell us which records you would like to see. It is helpful for us if you use the Information Rights form that is attached to this document as Appendix 1. If you have difficulty with the form, please let us know and we will try to help.

The form sets out all the information we need from you to help us process your request. Sometimes we might need to get in touch with you to ask you to be more specific in order to reduce the time and effort we spend in getting your information.

You have a right of access to your records, regardless of your age, as long as we are satisfied that you understand what it means to exercise your right. In Scotland you are presumed to understand what it means from the age of 13. We will however consider the circumstances of each case.

Who will handle your Subject Access Request?

The Information Governance Officer will be responsible for responding to Subject Access Requests. The Information Administrator will support the Information Governance Officer in coordinating the response to your request in liaison with the Council’s network of FOI Officers.

If a member of staff receives a subject access request they will forward details of that request to the foi@orkney.gov.uk mailbox immediately. This will help the Information Governance Officer and Information Administrator to respond to you as soon as possible.

What information will you receive?

Copies of the personal information you have requested on both our computer and structured manual record systems. Structured manual record systems are those where the information about you is readily accessible whether it is by name, reference number or some other means of identification. You will also be given a description of the purposes for which we process your data, a list of those to whom we may disclose the data and information about sources where this is available.

What information might we withhold?

There are some occasions where we will refuse to disclose information you have requested. For example:

• If the information on your record identifies other people, then usually we will not disclose their identity without their consent.
• If disclosure of the information might lead to serious harm to the physical or mental health of the data subject or any other person.
• If it would hinder the prevention and detection of crime or the prosecution or apprehension of offenders to provide it.
• If the information forms part of a court report or a report made by or for a reporter to the children’s panel.
• If the information is confidential because it was provided in the context of legal privilege or a solicitor/client relationship.
• If the information requested refers to someone who is now unable to manage their own affairs and we are satisfied that, at the time the information was given, they would not have wanted it to be disclosed to you.
• If there is any other legal obligation not to disclose the information.

Can you see information about members of your family or any other person?

You will not normally be able to see information about other people unless they have given their consent. This includes information about members of your family.

You can make a request on behalf of someone who is unable to manage their own affairs, and you have been appointed by a court to do so. We will normally require seeing proof of such entitlement.

If you are a parent of a child still at school, you have a right of access to your child’s education records although we will consider each request on its own merits.

You may apply to see the social work records of a child aged under 16 who does not have sufficient understanding to make their own request and for whom you have parental responsibility.

How will you be given the information?

You will usually be provided with a copy of your information to keep. This may be a printout of the information from the computer system or a photocopy of your manually held record.

Where we cannot provide you with your own copy of the information (due to the amount of information for example) you will be invited to attend one of Orkney Islands Council’s offices to view the information.

If you have difficulty in understanding any of the contents you may ask a member of staff for assistance.

Will you be charged a fee for information provided?

No, there is no charge for the information.

How long does it take to provide you with the information?

We must respond to your request within a calendar month, unless your request is very complex when we may extend the deadline by another month. However, this period does not begin until we:

• Are satisfied about your identity.
• Are satisfied with the validity of your request.
• Have enough details to locate the information which you are seeking.

What should you do when you get the information?

You should check it to ensure that you have received all the information to which you are entitled and to make sure it is correct.

What do you do if you think you have not been given all the information you asked for?

You can make a complaint to the Council’s Data Protection Officer and, if you are not satisfied with the response, to the Information Commissioner’s Office. Please see Section 7 below.

3. What do you do if information held about you is incorrect?

You should tell the Council service that the data is incorrect and ask for corrections to be made. It is helpful for us if you use the Information Rights form at the end of this document. We will need to be satisfied of your identity, and the form explains what evidence we will need from you. The Council service will aim to let you know if they have or have not corrected the data within a calendar month of you asking them to do so. If the service does not agree that the information is incorrect you can ask us to record your disagreement on the record itself.

If the service does not correct the information you can make a complaint to the Council’s Data Protection Officer. If you are not satisfied with the response from the Data Protection Officer, you can make a complaint to the Information Commissioner’s Office. Please see Section 7 below.

You also have a right to apply to the court to have inaccurate data rectified, blocked, erased or destroyed. This right extends to any other personal data which contains an opinion about you based on the inaccurate data.

4. Your right to erasure or the ‘right to be forgotten’

You have the right to have your personal data erased in certain circumstances, including if:

• The personal data is no longer necessary for the purpose which the Council originally collected or processed it for.
• The Council is relying on consent as the lawful basis for holding the data, and you withdraw your consent for the Council to hold your information.
• The Council has processed the personal data unlawfully.

To make a request for erasure, please send a request in writing to the Council. It is helpful for us if you use the Information Rights form at the end of this document. We will need to be satisfied of your identity and the form explains what evidence we will need from you. We will write to you within a calendar month to let you know if we can comply with your request.

5. Your right to ask the Council to restrict how your personal information is used

You have the right to restrict how the Council uses your personal information in certain circumstances. This is an alternative to requesting the erasure of your information.

You have the right to request that the Council restricts the processing of your personal information in the following circumstances:

• You contest the accuracy of the information held about you and we are still investigating whether the information is accurate.
• Your information has been unlawfully processed by the Council, but you do not want us to erase the information, just restrict how we use it.
• We no longer need the personal data, but you ask us to keep it to establish, exercise or defend a legal claim.
• You have objected to us processing your information and we are still considering whether we are able to comply with your request.

If you want us to restrict the use of your information, please write to us using the Information Rights form at the end of the document and we will write to you within a calendar month to let you know if we think we can comply with your request.

6. Your right to object to the use of your personal information

In some circumstance, the Council has a legal obligation to carry out an activity, such as collecting Council Tax. To collect the Tax, we need personal information about you and, because we do not have a choice about whether to process your information for this purpose, you do not have the right to object to our use of your information.

In other circumstance, in carrying out its public duties, the Council will use the information of individuals. In cases such as these, you have the right to object to how we use your information.

We must comply with your request unless:

• We can demonstrate compelling legitimate grounds for the processing of your information, which override your interests, rights and freedoms; or
• The processing is for the establishment, exercise or defence of legal claims.

If you want to object to the use of your information, please write to us using the Information Rights form at the end of the document and we will write to you within a calendar month to let you know if we can comply with your request. While we are investigating whether we can comply with your request, and we are able to, we will suspend the processing of your information.

7. Right to complain

If you are unhappy with the way the Council has processed your personal information you have the right to complain. Any complaints regarding your data should be addressed to the Data Protection Officer (see below). If the matter is not resolved, you can contact the Information Commissioner’s Office. The address and contact details for the Information Commissioner’s Officer are:

45 Melville Street
Edinburgh
EH3 7HL

Telephone: 0131 244 9001

Email: scotland@ico.org.uk

Data Protection Officer

The Council’s Data Protection Officer is Gavin Mitchell, Head of Corporate Governance. You can write to him at Orkney Islands Council, School Place, Kirkwall, KW15 1NY, telephone on 01856 873535 or send an email to business.support@orkney.gov.uk.

Further Information

The following documents provide more information on how we handle information:

• Data Protection Policy
• Records Management Policy
• Freedom of Information Policy
• Information Security Policy

Further information is also available from the Information Commissioner website.

Document Control Sheet

Review/Approval History

IMAGE: The document control sheet contains the heading “Document Control Sheet”, the subheading “Review/Approval History”, and a four-column table headed “Date.”, “Name.”, “Position.”, and “Version Approved.” The table records: “9 May 2018 | Gavin Mitchell | Head of Legal Services | 1.0.”; “25 March 2020 | George Vickers | Information Governance Officer | 1.1.”; “5 June 2020 | Special Information Governance Group | | 1.1.”; and “25 September 2025 | Paul Kesterton | Information Governance Officer | 1.2”.

Appendix 1

Information rights application form

You can use this form to exercise your Information Rights.

The completed form should be returned to:

Information Governance Officer, Chief Executive’s Service, Orkney Islands Council, Council Offices, School Place, Kirkwall, KW15 1NY.

Part 1: Personal Details of Data Subject (individual whose data is being requested)

Part 2: Nature of information request

IMAGE: The Appendix 1 application form displays the Orkney Islands Council logo, the heading “Appendix 1”, the title “Information rights application form”, instructions for returning the completed form, Part 1 personal-detail fields, and Part 2 request options with blank tick boxes.

Additional Information

Please provide information about your request, such as:

• What information you want access to?
• Which error needs correcting and how?
• What information you want erasing and why?
• How you want the use of your personal information restricting? Or
• What use of your information do you object to?

Part 3: Request Details

Orkney Islands Council uses personal data for a number of purposes. Please tick the box next to the service(s) that relates to your request. If it is not listed write in beside ‘Other’.

IMAGE: The Part 3 form table is headed “Service.”, “Tick.”, and “In connection with:”. It lists the services Building Standards; Business Gateway; Council Tax; Development Management (Planning); Development and Marine Planning (Local Development Plan and Policy); Economic Development; Environmental Health; Housing Benefit; Housing and Homelessness; Human Resources and Performance; Kirkwall Townscape Heritage Initiative Project; LEADER Programme; Legal; Leisure and Lifelong Learning; Licensing; Quarries; Rent Collection; Roads; Schools*; Social Work and Social Care; Trading Standards; Waste Management; and Other (please specify):. The tick and connection fields are blank.

Part 4: Additional Information

Please provide any additional information (for example reference number, date(s), name of school, payroll number or previous surname.) that you think may assist us in identifying and locating the data you are making the request about.

Additional Information:

Part 5: Proof of Identity

For reasons of security, the Council requires proof of your identity before it will process this request and release personal information.

Are you the Data Subject?

You may supply the documents by presenting them in person. If making your application by post please send photocopies.

IMAGE: The Part 5 form contains the heading “Part 5: Proof of Identity”, the question “Are you the Data Subject?”, and a two-row table labelled “Yes.” and “No.” explaining the identity documents and authority required. It also states: “You may supply the documents by presenting them in person. If making your application by post please send photocopies.”

Part 6: Data Subject Declaration

I wish to exercise my rights under Data Protection legislation as I have indicated in Section 2.

I certify that the information I have provided in this application form is true.

I confirm that I am the Data Subject and not someone acting on their behalf.

IMAGE: The declaration page contains the heading “Part 6: Data Subject Declaration”, the statements “I wish to exercise my rights under Data Protection legislation as I have indicated in Section 2.”, “I certify that the information I have provided in this application form is true.”, and “I confirm that I am the Data Subject and not someone acting on their behalf.” It has blank fields for “Signature:” and “Date:”.

Part 7: Declaration of Agent for the Data Subject

This section is only to be completed if someone else is acting on behalf of the Data Subject.

I confirm that I am acting on behalf of the Data Subject and have submitted proof of my identity and my authority to do so.

The information provided by you on this form will only be used to process your Information rights request. Council staff may have to contact you to clarify your request or to check your identity.

Orkney Islands Council will to respond to your request within a calendar month. However, this period does not start until the Council is:

• Satisfied about your identity.
• Satisfied with the validity of your request.
• Have enough details to locate the information which you are seeking.

If you would like this document in any other format or language please contact Business Support on 01856873535 or email business.support@orkney.gov.uk.

IMAGE: The final form page contains the heading “Part 7: Declaration of Agent for the Data Subject”, the instruction that the section is only to be completed when someone else is acting on behalf of the Data Subject, a declaration of authority, blank fields for “Forename.”, “Surname.”, “Address.”, “Postcode.”, “Daytime telephone number.”, “Email address.”, “Relationship.”, “Signature.”, and “Date.”, and the closing information about processing the request, the calendar-month response period, identity and request requirements, and contacting Business Support on 01856873535 or business.support@orkney.gov.uk.