Author: Pam Evans

From 25 May 2018 the law regarding data protection in the EU changes, the UK will be bound by this despite Brexit.
In most cases Mid Devon District Council is the Data Controller as defined by GDPR, contact us on:
Tel: 01884 255255
Email: customerfirst@middevon.gov.uk
Your contact for data protection at Mid Devon District Council is the Data Protection Officer dpo@middevon.gov.uk
You have several rights under GDPR these are:
The right to be informed: We must keep you informed about why we are collecting information from you, what we will do with it and how long we will keep it. We must also tell you who else we may share your data with.
The right of access: You can ask the Council what information we hold about you and confirm that we are processing it lawfully. (See overleaf)
.The right to rectification: The Council makes every effort to ensure the personal information we hold about you is accurate and up to date. But if you think we are holding information about you which is incorrect we must correct it if you ask us to, usually within one month.
The right to erasure: There are specific circumstances where if we have no overriding reason to continue to hold your information you have a general right to ask us to remove your information from our records, with some exceptions.
The right to erasure: There are specific circumstances where if we have no overriding reason to continue to hold your information you have a general right to ask us to remove your information from our records, with some exceptions.
There are extra rules for children’s data.
The right to restrict processing: In certain circumstances you can restrict processing of your data; we can still hold it but cannot do anything with it.
The right to data portability: This right is quite limited; among other conditions it only applies to data provided to the Council by the subject.
The right to object: In certain, again limited, circumstances you can object to your information being used e.g. for direct marketing or research, which again we do not do.
Rights related to automated decision making and profiling: This applies to legally binding decisions based on automated processing; we do not do this at present.
Please note that we have a legal obligation to process certain information in order to exercise certain statutory duties such as the collection of Council Tax and the provision of benefits.
Accountability and governance: We must protect your data while we hold it and make sure that we do not allow unauthorised access to your information or accidental damage or deletion.
We must also carry out data protection impact assessments whenever we are making changes to our technology and there may be a high risk to your rights and freedoms because the data is special category (what was called sensitive before).
Breaches: There are strict rules for when we must report data breaches to the ICO, which must be within 72 hours. In addition if the breach is likely to result in a high risk to your rights and freedoms we must also inform you
.Subject Access Rights: You have the right to confirm we are processing your information and to have access to your personal data.
We will need to confirm your identity when you make a request. Two forms of identity are required from the following list: birth certificate; marriage or civil partnership certificate; driving licence; passport; two different utility bills (e.g. gas, electricity or water). Photocopies are acceptable.
We then have up to one month to provide your information to you, free of charge. We can however charge our administration costs to provide additional copies if you ask for them.
Please bear in mind that if, for example, you were to ask for “everything you have about me” this may be considered excessive and in that instance we may be able to charge a reasonable administration charge and have an extra two months to provide you with the information.
For this reason it is best to be specific about what information you need so you get what you need more quickly and don’t get a lot of data you don’t need or want.
If you make your request online we will reply by email.
You can get further information about your rights on our website:
https://www.middevon.gov.uk/your-council/access-to-information/personal-information/
Or the Information Commissioner’s Office (ICO):
https://ico.org.uk/for-the-public/
You also have the right to contact the ICO if you have concerns about how your information is being processed or have a complaint about how we have handled your request for information

Mid Devon District Council
Phoenix House
Phoenix Lane
Tiverton
EX16 6PP
Phone: 01884 255255
E-mail: dpo@middevon.gov.uk

Data Protection Law is Changing
Guide to exercising your rights under the new General Data Protection Regulations (GDPR)