Data protection

Whenever you engage with a service, we begin to collect and process your personal data. When we process your personal information, we have a duty to tell you:

• the name and contact details of the council
• the name and contact details of any third party who will use your information on our behalf
• why we want to use the information
• the reason for processing
• how long we will hold your information for
• if we are collecting your data because the law tells us to
• if we are collecting your data to fulfil a contract
• if any decisions are made by a computer and not a human (automated decision making)
• information on your rights
• if your data will be transferred outside of the UK, EU or EEA

We will tell you this information in the form of a data privacy notice when your data is being collected. If you're not informed, you have the right to request a copy of the notice. Where the right of erasure applies, we will tell you in the privacy notice.    

Data protection laws let you, the data subject, access the information we hold about you. 

When you do, we'll ask for a copy of your ID. Once it's been verified, we will begin to process your request and locate your data. 

We may write to you to ask for more information to help us locate your data. For example, if you ask for all the info the council holds on you, we may ask which departments you have dealt with. Without more info, we may miss the deadline for a full response.  

When you receive your information, you may find that certain data has been redacted or removed. When we're processing your request, we may need to remove data if:

• it is about someone else
• a professional thinks that if the data is released, it will cause serious harm to your or someone else’s physical or mental wellbeing
• we think that giving you the information may stop us from preventing or detecting a crime

If we have removed any of the data, we will tell you why.

Normally, we will not share your data with any other person. 

However, in some situations, you may want someone else to make a subject access request on your behalf.  When we receive the request, we will need to see evidence that you have given permission for them to do this. This can be done by a signed letter attached to the request. If we're concerned, we may contact you to check that you're happy for the release or we may refuse the request in full.

To make a subject access request:

• email accessinfo@southwark.gov.uk 
• write to Access info team 2nd floor Hub 1 PO Box 64529 London SE1P 5LX
• call 020 7525 5000

If you're unhappy with tour response, you can ask for the decision to be reviewed. A senior officer will check our initial response to you.

If you're still unhappy contact the Information Commissioners Office on 0303 123 1113.

We have a duty to make sure that the information we hold on you is properly maintained and correct. The right of rectification lets you challenge any incorrect entry on your file.

We can only change or remove factual inaccuracies. Sometimes we cannot change our records. You may disagree with a professional opinion, or feel that the council has got the facts wrong. When this occurs, we can add your comments to the file to indicate your disagreement.

To make a request for a record to be changed, contact the relevant department directly.

If you're concerned about how we're handling your personal information, contact our Data Protection Officer by:

• emailing dpo@southwark.gov.uk
• writing to Data Protection Officer, 2nd floor Hub 1, Southwark Council PO Box 64529, London, SE1P 5LX
• calling 0207 525 5000

If you're still unhappy, contact the Information Commissioners Office on 0303 123 1113.

The right of erasure, or the right to be forgotten, allows you to request deletion of your personal data. This right is very limited. If you request the deletion of your data, we must check that:

• your personal information was originally provided to us and processed with your consent
• your personal information is no longer required for its original purpose
• there is no legal reason for us to use your personal information
• deleting your personal information is a legal requirement
• your personal information data has been kept longer than the retention period (and we're not using it for legal reasons)

Where the right of erasure applies, we will tell you in the privacy notice. To make a request for your information to be deleted, contact our Data Protection Officer by:

• emailing dpo@southwark.gov.uk
• writing to Data Protection Officer, 2nd floor Hub 1, Southwark Council PO Box 64529, London, SE1P 5LX
• calling 0207 525 5000

If you're still unhappy, contact the Information Commissioners Office on 0303 123 1113.

The right of restriction allows you to stop us from using your data if:

• you believe the data that we hold on you is wrong
• the processing is unlawful but you do not want the information deleted
• we no longer need your data but you require it for a legal claim
• you object to us processing your data (this requires us to check the reason we are using your data)

If you object to us using your personal data, we must check that we're processing it appropriately. We have a month to check. If we confirm that we are using your personal data lawfully, we will tell you and continue to process your information.

If you restrict us from processing, we will store your data securely. That will mean we can only use your information:

• if we have your consent
• for legal claims
• to protect the rights of others
• if it is in the public interest to continue processing

You have the right to ask us to stop using your personal information for any of our services. We will inform you if your request has been approved. If you ask us to restrict your data, it may cause delays or prevent us from delivering a service to you. If your request is refused, you can ask for the Data Protection Officer to review the request by:

• emailing dpo@southwark.gov.uk
• writing to Data Protection Officer, 2nd floor Hub 1, Southwark Council PO Box 64529, London, SE1P 5LX
• calling 0207 525 5000

If you're still unhappy, contact the Information Commissioners Office on 0303 123 1113.

We perform most services because the law requires it or it is in the council's or public interest. The right of data portability does not apply.

You can request your personal information or ask to have it sent to another service provider. But only if:

• you have given us your consent
• it is necessary to fulfil a contract with you
• your data is automated (including decisions made by computers and not humans)
• it’s not held in a paper file 
• it’s been provided by you

We'll transfer your data in a commonly-used readable format. We call this data portability.

To make a request for us to transfer your data, contact our Data Protection Officer by:

• emailing dpo@southwark.gov.uk
• writing to Data Protection Officer, 2nd floor Hub 1, Southwark Council PO Box 64529, London, SE1P 5LX
• calling 0207 525 5000

If you're unhappy with our decision, contact the Information Commissioner's Office on 0303 123 1113.

If the processing of your personal data is having a harmful effect on you, you can object to the processing. 

You have the right to object to direct marketing including where profiling occurs. This is where decisions about you are made based on your personal data, like your age and gender.

If we use your personal data to profile you, we will tell you and inform you of your rights. You can ask us to explain why the profiling has happened.

To make an objection contact our Data Protection Officer by:

• emailing dpo@southwark.gov.uk
• writing to Data Protection Officer, 2nd floor Hub 1, Southwark Council PO Box 64529, London, SE1P 5LX
• calling 0207 525 5000

If you're still unhappy, contact the Information Commissioners Office on 0303 123 1113

If a computer makes a decision, you can ask a council officer to review it. But not if:

• the processing is needed for entering into or carrying out a contract with you
• we are authorised to do so under a law
• we have your explicit consent

You can ask for any automated individual decision-making to be explained to you.

To make a request for a decision to be reviewed and explained, contact our Data Protection Officer by:

• emailing dpo@southwark.gov.uk
• writing to Data Protection Officer, 2nd floor Hub 1, Southwark Council PO Box 64529, London, SE1P 5LX
• calling 0207 525 5000

If you're still unhappy, contact the Information Commissioners Office on 0303 123 1113.