Corporate data privacy notice

Whenever you engage with a service, we begin to collect and process your personal data. When we process your personal information, we have a duty to tell you:

• the name and contact details of the council
• the name and contact details of any third party who will use your information on our behalf
• why we want to use the information
• the reason for processing
• how long we will hold your information for
• if we are collecting your data because the law tells us to
• if we are collecting your data to fulfil a contract
• if any decisions are made by a computer and not a human (automated decision making)
• information on your rights
• if your data will be transferred outside of the UK/EU/EEA

We will tell you the above information in the form of a data privacy notice when your data is being collected. If you're not informed, you have the right to request a copy of the notice. Where the right of erasure applies, we will tell you in the privacy notice.    

Data protection legislation allows you, the data subject, to gain access to any of your personal information which is held by the council. You can request copies of your information by contacting us directly. When we receive your request, we will ask for a copy of your ID to check that we are sending your personal data to the right person. Once your identity has been verified, we will begin to process your request and locate your data. 

We may write to you to request additional information to help us locate your information. For example, if you ask for all of the information the council holds on you, we may ask you which departments you have dealt with such as the housing or benefits team. If you do not provide further information, we may not be able to provide a full response within the one calendar month deadline.  

When you receive your information, you may find that certain data has been redacted or removed. When we're processing your request, we may need to remove (redact) data if:

• the data is about someone else
• a professional thinks that if the data is released, it will cause serious harm to your or someone else’s physical or mental wellbeing
• if we think that giving you the information may stop us from preventing or detecting a crime

If we have removed any of the data, we will tell you why.  

Normally, we will not share your data with any other person. However, in some situations, you may want someone else to make a subject access request on your behalf.  When we receive the request, we will need to see evidence that you have given permission for them to do this. This can be done by a signed letter attached to the request. If we're concerned, we may contact you to check that you're happy for the release or we may refuse the request in full.

To make a subject access request, email accessinfo@southwark.gov.uk or write to:

Access info team
2nd floor Hub 1
PO Box 64529
London
SE1P 5LX

If you'd like to make your request in another way, please contact the access info team on 0207 525 5000.

If you're unhappy with the response the council has provided you, you can ask for the decision to be reviewed. A senior officer will look at the documents that you have been sent and check if all information that you are entitled to has been provided. You also have the right to contact the Information Commissioner’s Office (ICO) if you're unhappy with how the council has handled your request. Information on how to contact the ICO can be found at the bottom of this privacy notice.

We have a duty to make sure that the information we hold on you is properly maintained and correct. The right of rectification allows you to challenge anything that is written on your file which you believe is incorrect.

We can only change or remove factual inaccuracies. Sometimes we cannot change our records. You may disagree with a professional opinion, or feel that the council has got the facts wrong. Where this is the case, we can include your comments on the file to show that you disagree with what has been written.

To make a request for a record to be changed, please contact the relevant department directly. If you're dissatisfied with their response, contact our Data Protection Officer to review the decision.

To contact the Data Protection Officer, email dpo@southwark.gov.uk, call 0207 525 5000 or write to:

Data Protection Officer
2nd floor Hub 1
PO Box 64529
London
SE1P 5LX

If you're dissatisfied after the Data Protection Officer has responded to your request, you have the right to contact the Information Commissioner’s Office (ICO). Information on how to contact the ICO can be found at the bottom of this privacy notice.

The right of erasure, which is also known as the right to be forgotten, allows you to ask for your personal data to be deleted. This right is very limited. If you make a request for any of your information to be deleted, we will have to check that your data meets one or more of the following criteria:

• your personal information was originally provided to us and processed with your consent
• your personal information is no longer required for its original purpose
•  there is no legal reason for us to use your personal information
• deleting your personal information is a legal requirement
• your personal information data has been kept longer than the retention period (and we're not using it for legal reasons)

Where the right of erasure applies, we will tell you in the privacy notice. To make a request for your information to be deleted, contact our Data Protection Officer by emailing dpo@southwark.gov.uk, calling 0207 525 5000 or writing to:

Data Protection Officer
2nd floor Hub 1
PO Box 64529
London
SE1P 5LX

If you're dissatisfied after the Data Protection Officer has responded to your request, you have the right to contact the Information Commissioner’s Office (ICO). Information on how to contact the ICO can be found at the bottom of this privacy notice.

The right of restriction allows you to stop us from using your data if one of the following applies:

• you believe the data that we hold on you is wrong
• the processing is unlawful but you do not want the information deleted
• we no longer need your data but you require it for a legal claim
• you object to us processing your data (this requires us to check the reason we are using your data)

If you restrict us from processing your personal information because you object to us using it, we have to check that we are processing your data legally. We have one calendar month (30 days) to check. If we confirm that we are using your personal data in a lawful manner, we will inform you and then continue to process your information.

If you apply your right to restrict us from processing we will store your personal information securely. After you've restricted our use, we can only use your personal data:

• if we have your consent
• for legal claims
• to protect the rights of others
• if it is in the public interest to continue processing

You have the right to ask us to stop using your personal information for any council service. We will inform you if your request has been approved. If you ask us to restrict your data, it may cause delays or prevent us from delivering a service to you. If your request is refused, you can ask for the Data Protection Officer to review the decision.

To make a  request for your information to restrict processing, contact our Data Protection Officer by emailing dpo@southwark.gov.uk, calling 0207 525 5000 or writing to:

Data Protection Officer
2nd floor Hub 1
PO Box 64529
London
SE1P 5LX

If you are dissatisfied after the Data Protection Officer has responded to your request, you have the right to contact the Information Commissioner’s Office (ICO). Information on how to contact the ICO can be found at the bottom of this privacy notice.

Most of the services at the council are carried out because either the law requires us to do so or it is in the official authority/public interest. The right of data portability does not apply.

If we're processing your data due to the following reasons:

• you have given us your consent
• or it is necessary to fulfil a contract with you and your data is:
  • automated (including decisions made by computers and not humans)
  • not held in a paper file
  • provided by you

Then you have the right to ask for your personal information to be sent to you or transferred to another service provider in a commonly used readable format (data portability).

To make a request for us to transfer your data, contact our Data Protection Officer by emailing dpo@southwark.gov.uk, calling 0207 525 5000 or writing to:

Data Protection Officer
2nd floor Hub 1
PO Box 64529
London
SE1P 5LX

If you're dissatisfied after the Data Protection Officer has responded to your request, you have the right to contact the Information Commissioner’s Office (ICO). Information on how to contact the ICO can be found at the bottom of this privacy notice.

If the processing of your personal data by the council is having a harmful effect on your personal situation, you have the right to object to the processing. You can object to the processing if:

• we're processing your data because it's in the official authority/public interest
• if there's a legitimate interest in processing your data (except where your interests, rights or freedoms are being harmed)

You also have the right to object to direct marketing including where profiling occurs. Profiling is where decisions are made about you based on certain things from your personal information; for example your age and gender. If the council uses your personal data to profile you, we will tell you and inform you of your rights. You have the right to have any decision about the profiling explained to you.

To make an objection to the council, contact our Data Protection Officer by emailing dpo@southwark.gov.uk, calling 0207 525 5000 or writing to:

Data Protection Officer
2nd floor Hub 1
PO Box 64529
London
SE1P 5LX

If you're dissatisfied after the Data Protection Officer has responded to your request, you have the right to contact the Information Commissioner’s Office (ICO). Information on how to contact the ICO can be found at the bottom of this privacy notice.

If a decision is made automatically by a computer, you have a right for the decision to be reviewed by an officer of the council. This right cannot be used if:

• the processing is necessary for entering into or performance of a contract with you
• we are authorised to do so under a law
• we have your explicit consent

However, if you have been subject to automated individual decision-making you can ask for the decision to be explained and reviewed by a member of the council.

To make a request for a decision to be reviewed, contact our Data Protection Officer by emailing dpo@southwark.gov.uk, calling 0207 525 5000 or writing to:

Data Protection Officer
2nd floor Hub 1
PO Box 64529
London
SE1P 5LX

If you're dissatisfied after the Data Protection Officer has responded to your request, you have the right to contact the Information Commissioner’s Office (ICO). Information on how to contact the ICO can be found at the bottom of this privacy notice.