Your data privacy rights

On 25 May, 2018, new data protection laws came into force. The General Data Protection Regulation (GDPR) ensures that all personal data kept by all companies and organisations is clearly managed, using the same set of strict rules.

It also gives you certain rights regarding this data. You can ask us to:

send you a copy of the data we hold about you
erase your data
transfer your data
correct your data
limit the use of your data
stop using your data

You can request information:

for yourself
on behalf of your child
on behalf of another person

You can make all these requests by completing one of the online forms on this page. All these requests are free to make.

If you can’t use the online forms, you can make these requests in writing, to the address at the bottom of this page.

There are circumstances where we don’t have to provide the information, such as, if you ask for it too frequently or the extent of the request is unreasonable.

Evidence you need to provide

With your request, you need to include:

proof of your identity, such as a copy of your driving licence or passport

If you’re acting on behalf of your child or another person, please also include:

proof of their identity
proof that you’re legally entitled to act on their behalf

Request your personal data Click to get info

You have the right to get a copy of the information that is held about you.

This request is called a Subject Access Request (SAR).

Under a SAR, we will also tell you:

how we collect your information
what we use it for
how we process the data
who else we share it with

There are also some exceptions, set out in the legislation, where we won’t be able to provide you with your personal data. Examples of this include where it’s been used by us in order for us to seek legal advice, or where we’ve received it from someone else in confidence and we’re bound by that obligation.

For further information, please visit the right to be informed page on the Information Commissioner’s Office (ICO) website.

Make a Subject Access Request (SAR)

Request us to erase your personal data Click to get info

You can ask us to remove your personal data.

This request is called a Subject Erasure Request (SER), more commonly known as ‘the right to be forgotten’.

The right you have only applies under certain circumstances. These are if you don’t consent to us keeping and processing your data and:

your personal data is no longer necessary for the purpose which we collected it for
you want to withdraw your consent to us having data which you consented to before
we’re relying on ‘legitimate interests’ to process your data, but there aren’t any
we’re using it to send you marketing communications, but you’ve asked us not to
we’ve processed your data unlawfully
we have to erase it to comply with a legal obligation
we’ve processed your personal data to offer information society services to a child who has asked for it to be erased

There are also some exceptions, set out in the legislation, where we won’t be able to erase your personal data. Examples of this include if we have to comply with a legal obligation, or if we need it to allow us to carry out a task under our official authority.

For further details, please visit the right to erasure page on the Information Commissioner’s Office (ICO) website.

Make a Subject Erasure Request (SER)

Request us to transfer your data Click to get info

You can ask us to give you copy of your personal data in a safe, secure format that can be easily transferred to other IT systems.

This request called a Subject Portability Request (SPR).

You can request that we send this data directly to another organisation. We will do this, provided it’s technically feasible to do so.

For more details, please visit the right to data portability page on the Information Commissioner’s Office (ICO) website.

Make a Subject Portability Request (SPR)

Request us to correct inaccurate data Click to get info

You can ask us to correct any of your personal data that is wrong and complete any data that is missing.

This request is called a Subject Rectification Request (SRR).

There are some circumstances where we can refuse this request, such as where we don’t agree that the information we have is wrong. If this is the case, we’ll allow you to set out what you think is wrong and place that with the information we hold.

For more details, please visit the right to rectification page on the Information Commissioner’s Office (ICO) website.

Make a Subject Rectification Request (SRR)

Request us to limit how we use your data Click to get info

You can ask us to limit how we use your data, even though we will still store it.

This request is called a Subject Processing Restriction Request (SPRR).

The right you have only applies under certain circumstances. These are if:

you’ve told us the data is inaccurate and we’re checking this
the data has been unlawfully processed but you don’t want us to erase it completely
we don’t need the data any more, but you need us to keep it as part of a legal claim
you’ve asked us not to process your data, but we’re considering whether our ‘legitimate grounds’ override this

We may continue to use your data if we ask you and you then consent.

We may also continue to use your date without your consent if it’s necessary for us to do so in connection with a legal claim, or necessary to protect another person’s rights, or if it’s necessary because of an important public interest reason.

For more details, please visit the right to restrict processing page on the Information Commissioner’s Office (ICO) website.

Make a Subject Processing Restriction Request (SPRR)

Request us to stop using your data Click to get info

You can object to us using your data, under certain circumstances.

You can ask us to stop using your data for marketing purposes completely.

This request is called a Subject Processing Objection (SPO).

If you ask us to stop using your data for marketing purposes, we can’t refuse to do so.

If you ask us to stop using your data for non-marketing purposes, we may not agree to your objection if we’re using it:

for a task carried out in the public interest
through official authority vested in us
as our ‘legitimate interest’ (or those of a third party) provided there’s no undue harm caused to you

Your right to object is also limited if we’re using your data for scientific or historical research, or statistical purposes.

For more details, please visit the right to object page on the Information Commissioner’s Office (ICO) website.

Make a Subject Processing Objection (SPO)

How long will my request take? Click to get info

We’ll respond to you within 30 days of receiving your request and the appropriate evidence.

Where we need to perform additional complex work, we may take up to an additional 60 days.

If it’s going to take us longer than 30 days, we’ll write to you before the end of 30 days, explaining why this is and how long it will take.

Complaints Click to get info

If you need to complain about how we deal with your personal data, please see our complaints page, where you can complete the online form and find out what happens next.

If we’re unable to resolve your complaint to your satisfaction, you can make a complaint to the Information Commissioner's Office (ICO).

View our entry on the Register of Data Controllers Click to get info

Every organisation that processes personal information (known as ‘data controllers’) must register with the Information Commissioner’s Office (ICO), unless they’re exempt.

The ICO publishes this register of data controllers on their website, along with a description of the type of processing each data controller does.

To view our entry, enter Z7599838 into the registration number field.

Contact Click to get info

Information Officer

Business Hub
Waltham Forest Town Hall
Forest Road
Walthamstow E17 4JA

Email Information.Officer@walthamforest.gov.uk