Data Protection legislation is designed to protect personal data about living individuals (data subjects). The Data Protection Act 2018 also places obligations on those organisations that process personal data (data controllers). As a data controller, ÌÇÐÄvlog¹ÙÍø (SCC) is committed to complying with the legislation by applying the principles of good information handling across all its services.
Please scroll down the page or use the content list to jump to information within this page.
Page contents
- Why do we hold personal information about you?
- What types of information does the council hold?
- What are your rights?
- Making a request for access
- CCTV applications
- If you have a complaint
- Contacts
Why do we hold personal information about you?
We keep personal information about you so that we can provide and maintain a record of those services that you need. As a local authority we need to collect, process and keep data in relation to our statutory duties such as in the provision of social care services, education, sustainable development, trading standards, and births, deaths and marriages.
What types of information does the council hold?
The council has registered its use of personal information through the notification process to the Information Commissioner's office (ICO). The Information Commissioner's office is the governing body that oversees the act. The register entry shows what the organisation is registered to do, it does not reveal whether or not personal data is held about you. If you wish to have a copy of the SCC entry on the register you can obtain a copy from the .
What are your rights and how to make an application?
There is some useful guidance and assistance which you may find helpful on the . See also the Council's Corporate Privacy Notice for information about how we use information about you and how we protect your privacy.
Under the Data Protection Act 2018 you have the following rights:
- To be informed if your personal data is being used – an organisation must inform you if it is using your personal data
- To get copies of your data – you have the right to find out if an organisation is using or storing your personal data
- To get your data corrected – you can challenge the accuracy of personal data held about you by an organisation
- To get your data deleted – you can ask an organisation to delete personal data that it holds about you
- To limit how organisations use your data – you can limit the way an organisation uses your data
- To data portability – you have the right to get your personal data from an organisation in a way that is accessible
- To object to the use of your data – you have the right to object to the processing or use of your personal data in some circumstances
- Relating to decisions being made about you without human involvement – where decisions are made about you when your personal data is processed automatically and in profiling
- To raise a concern – if you are concerned about how an organisation is using your data
If you would like to make a request to update, correct or remove your data, you can use the online request to access, update or remove data form.
Making a request for access
You have the right to request a copy of the information that is held about yourself. You may, if you wish, appoint someone else to apply on your behalf such as a parent/guardian or a solicitor. However, we will need a Letter of Authority from you in order to process your request.
If you would like to make a request for a copy of the information that is held about yourself, you can use the subject access online request form.
Alternatively you can make a request by email to corporateig@surreycc.gov.uk or apply in writing at the following address:
Corporate Information Governance Manager
Legal and Democratic Services
ÌÇÐÄvlog¹ÙÍø
Woodhatch Place
11 Cockshot Hill
Reigate
ÌÇÐÄvlog¹ÙÍø
RH2 8EF
Verbal requests are acceptable via the Contact Centre, who will forward your request to the Corporate Information Governance Team, but please note that your verification contact details and supplementary documents are required in order to process your request. Please see What information will I need to provide to make a subject access request?
The majority of responses are sent via secure electronic mail. However, if you wish to collect a copy of the response to your request in person at one of our offices, you will need to bring with you proof of identity (ID).
Adoption Team requests
If you would like to see your adoption records you will need to contact the Adoption Team directly.
What information will I need to provide to make a subject access request?
You will need the following information uploaded into the form (or sent to us with your request if you are contacting us by email or post).
- Completed form or letter detailing the information requested
- Relevant supporting evidence, which includes two separate and different documents each showing name and address (guidance is on the form). Photocopies or photographic copy from a mobile device of original documents are acceptable.
One form of proof of ID such as:
- Valid Driving Licence
- Valid Passport
- NHS card
- National Insurance card
- Valid Government issue photo identification
Together with one proof of address such as:
- Recent building or bank statement
- Recent Council Tax bill
- Recent landline telephone bill
- Recent utility bill
- Current benefits or pension statement
- Current rent statement or tenancy agreement
In order to validate your identity we will keep copies of the proof of your ID. These copies will be destroyed once your request has been closed.
Please note your request will be closed after 1 month if we do not receive the details requested.
How long do I have to wait for my data protection subject access request?
As an organisation we normally have to respond to your request within one month. However, if you have made a number of requests or your request is complex, we may need extra time to consider your request and this can take up to an extra two months to respond.
If we are going to do this, we will let you know within one month that we need more time and why.
Will I always receive everything I asked for?
Not always. Depending on the circumstances:
- you may receive only part of the information you asked for; or
- we may not provide you with any personal information at all.
As an organisation we can refuse to comply with your subject access request if we think it is 'manifestly unfounded or excessive'.
There can be other reasons why you may not receive all the information you expect, such as when an , or the type of information you asked for is not covered by a subject access request.
Making a subject access request for information about your child
Children who are younger than 13 years old
You can request your child's information on their behalf if they are younger than 13 years old, or if they are not capable of understanding the request. You will need to provide verification documents. Additionally you will need to provide proof of . This could be
- Child's full birth/adoption certificate naming you as the parent
- Valid Court Order naming you as the parent
- Valid Court Order granting you parental responsibility
Children who are 13 years old or older
If you are requesting information about your child and they are 13 years old or over and are capable of understanding the request, you will need to upload