Data protection
We may hold some of your personal information if you've provided it when using our services. We comply with the data protection law to protect your details.
Dumfries and Galloway Council ('the Council') is a data controller, as registered with the Information Commissioner's Office, of your personal data.
Privacy Statement
Our Privacy Statement outlines the ways in which we process your personal information as a Council. It also explains what rights you have in relation your personal information and how you can access these:
Data protection has changed
The current Data Protection Act 1998 regulates the way we handle and process your personal data that we hold.
The Data Protection Act 2018 replaced this on 23 May 2018. The new data protection law emphasises protecting your personal information and gives you with more rights and control over how organisations such as the Council handle and process your personal information.
Personal information is information, which relates to a living person who could be identified from the information itself, or by linking it with other information. For example, it could be:
- Name and address
- A school pupil's record
- Health information
Processing personal information is the name given to anything the Council does with your personal information that they hold. For example, this could be:
- Entering your details into our computer systems
- Storing a completed form in a filing cabinet
Six Data Protection Principles
The Council will comply with the six data protection principles to ensure the protection of your personal information. The Council will ensure your personal information is:
- Processed lawfully, fairly and in a transparent manner
- Collected for specified, explicit and for legitimate purposes
- Adequate, relevant and limited to what is necessary
- Accurate and where necessary, kept up to date
- Kept for no longer than is necessary for the purpose
- Protected by appropriate technical and organisational measures against unauthorised or unlawful processing, loss, damage or destruction
Making a Subject Access Request
You have the right to access your personal information. There is no fee for this request. If requests are repetitive and excessive, the Council may charge a fee.
To access your own personal information, use the Subject Access Request Form.
To see what information is held about you, you need to complete this form and provide proof of who you are. We won't be able to process your request until we have received proof of who you are.
Making a request on behalf of someone
To access the personal information of another person/to allow another person to access your information on your behalf use the Subject Access Request Form-Permission to release your personal information.
If you are making the request on behalf of a person, you need to complete this form and provide proof of who you are. We won't be able to process your request until we have received proof of who you are.
You and the person who the information is about will both need proof of identity.
If you are making the request as a power of attorney - you will need to provide proof of this.
Examples of proof include your driving license, passport, birth certificate, utility bill or letter from a government agency. If you do not have any of these, please contact us.
You can send originals or certified photocopies (certified means a professional person-doctor, dentist, teacher, social worker, bank official - has signed the photo to prove who you say you are). If you send originals we will return these to you via Royal Mail Recorded Delivery Service.
The Council has one calendar month to respond to your subject access request.
Return your subject access request form to:
Data Protection Officer
Dumfries and Galloway Council Headquarters
English Street
Dumfries
DG1 2DD
Your individual rights
You have the right to:
- Be informed of why and what we will do with your personal data
- Have access to your personal information
- Have your personal data deleted
- Restrict or object to processing of your personal data
- Have personal data corrected
- Have personal data moved from one IT environment to another securely and without hindrance
- Withdraw your consent
To exercise these rights contact the Council's Data Protection Officer: dataprotection@dumgal.gov.uk
How to raise a concern
If you are not satisfied with how we have answered your request or have concerns about how we handled your personal information, you should email our Data Protection Officer dataprotection@dumgal.gov.uk to raise a concern in the first instance. When you contact our Data Protection Officer we will consider your concerns and will respond within one calendar month. If we can't respond within that timescale, we will let you know when we will be able to respond.
If you are unhappy with our response to your concern, you are entitled to raise your concern with the regulator of data protection, which is the UK Information Commissioner (ICO) and you contact their office by writing to:
UK Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Website: www.ico.org.uk
