You have a statutory right of access (certain exemptions apply) to personal data about yourself under the Data Protection Act 1998. The right of access here is to personal data held on computer or on structured manual files and you are entitled to be informed whether any personal data concerning yourself is being held by the "data controller" i.e., West Dunbartonshire Council, and, if so to be:
given a description of the data in question;
told for what purposes the data are processed;
told of the recipients or classes of recipients to whom the data are or may be disclosed.
You are also entitled to be given a copy of the information with any unintelligible terms explained and to be given any information available to the Department as to the source of the data. The Freedom of Information Act will extend this right to access to personal data held on any type of file, with effect from 1 January 2005.
If you wish to apply for access to your personal data, known as a "subject access request", you should write to the Head of Information Services, West Dunbartonshire Council, Garshake Road, Dumbarton G82 3PU.
A request for access to personal data must be dealt with promptly and, in any event, within 40 days of receipt of the request. We may charge a fee, not exceeding £10.
If you consider that a request by you for access to your personal data was not dealt with in accordance with the Data Protection Act 1998 you may take further action as follows:
(a) You may apply to the court alleging a failure to comply with the subject access provisions of the 1998 Act. The court may make an order requiring compliance with those provisions and may also award compensation for any damage you have suffered as a result and any associated distress.
(b) You may write to the Information Commissioner, who may do one of the following:
(i) make an assessment as to whether it is likely or unlikely that the Council has complied with the 1998 Act.
(ii) issue enforcement proceedings if he is satisfied that the Council has contravened one of the Data Protection Principles.
(iii) recommend that you apply to court alleging a failure to comply with the subject access provisions of the 1998 Act.
Anyone processing personal data must comply with the eight enforceable principles of good practice. They say that data must be:
- fairly and lawfully processed;
- processed for limited purposes;
- adequate, relevant and not excessive;
- accurate;
- not kept longer than necessary;
- processed in accordance with the data subject's rights;
- secure;
- not transferred to countries without adequate protection.
Personal data covers both facts and opinions about the individual. It also includes information regarding the intentions of the data controller towards the individual, although in some limited circumstances exemptions will apply. With processing, the definition is far wider than before. For example, it incorporates the concepts of 'obtaining', holding' and 'disclosing'.
A full explanation of these principles can be found on the
Information Commissioner's website.
The
full text of the Data Protection Act is provided online by the Office of Public Sector Information.
You can also view West Dunbartonshire Council's entry in the
Data Protection Register.
