Personal Data Complaints Policy
Approved by Shavington-cum-Gresty Parish Council on 15 March 2023
Adopted by Shavington-cum-Gresty Parish Council on 17 May 2023
Introduction
The Data Protection Act 2018 (DPA 2018), gives data subjects rights in relation to their personal data which are detailed further in this policy. In addition, the Privacy and Electronic Communications Regulations (PECR) which sits alongside the DPA 2018 gives people specific privacy rights in relation to electronic communications such as marketing calls, emails, texts, cookies and associated technologies.
Processing personal information
This means obtaining, recording or holding the personal information or carrying out any operation or set of operations on the information, including:
• organising, adapting, storing or altering it
• retrieving, consulting or using the information or data
• disclosing the information or data by transmission, dissemination or otherwise making it available
• aligning, combining, blocking, erasing or destroying the information or data. regardless of the technology used.
Personal Data and Data Subjects
‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal data the Parish Council gather may include: individuals’ phone number, home address, email address, educational background, financial and pay details, details of education and skills, marital status, nationality, and CV etc.
Data subjects’ rights
Individuals have rights to their data under data protection legislation which the Parish Council must respect and comply with to the best of their ability. The Parish Council must ensure individuals can exercise their rights in the following ways:
Right to be informed
Providing privacy notices which are concise, transparent, intelligible and easily accessible, free of charge, that are written in clear and plain language, particularly if aimed at children.
Keeping a record of how the Parish Council use personal data to demonstrate compliance with the need for accountability and transparency.
Right of access
Enabling individuals to access their personal data and supplementary information
Allowing individuals to be aware of and verify the lawfulness of the processing activities
Right to rectification
The Parish Council will rectify or amend the personal data of the individual if requested because it is inaccurate or incomplete. This must be done without delay, and no later than one month. This can be extended to two months where valid reason(s) have been identified.
Right to erasure
The Parish Council will delete or remove an individual’s data if requested and there is no compelling reason for its continued processing.
Right to restrict processing
The Parish Council will comply with any request to restrict, block, or otherwise suppress the processing of personal data.
The Parish Council are permitted to store personal data if it has been restricted, but not process it further. The Parish Council will retain enough data to ensure the right to restriction is respected in the future.
Right to data portability
The Parish Council will provide individuals with their data so that they can reuse it for their own purposes or across different services.
The Parish Council will provide it in a commonly used, machine-readable format, and send it directly to another controller if requested.
Right to object
The Parish Council respect the right of an individual to object to data processing based on legitimate interest or the performance of a public interest task.
The Parish Council respect the right of an individual to object to direct marketing, including profiling.
The Parish Council respect the right of an individual to object to processing their data for scientific and historical research and statistics.
Rights in relation to automated decision making and profiling
The Parish Council respect the rights of individuals in relation to automated decision making and profiling.
Individuals retain their right to object to such automated processing, have the rationale explained to them, and request human intervention.
What is a complaint?
A complaint is an expression of dissatisfaction about the Council’s handling of a data subject’s personal data or the data of the individual they represent. This can include dissatisfaction with how the Council has responded to a previous subject access request.
Scope
This policy addresses complaints made by data subjects regarding the use of their personal data and previous responses(s) to their subject access requests.
Responsibilities
The council has overall responsibility for this policy but has delegated day-to-day responsibility for overseeing its implementation to the Clerk. All relevant members of staff have been made aware of the policy.
All Employees are responsible for ensuring that any complaints that are made in relation to this policy are reported to the Clerk.
The Council will review this policy annually to ensure that its provisions continue to reflect best practice.
Making a Complaint
Data subjects can make a complaint relating to the Council’s use of personal data.
Complaints should be sent directly to the clerk at : clerk@shavingtononline.co.uk
An officer of the council will normally acknowledge the complaint within 5 working days, subject to council resources and annual leave commitments.
The Council will only accept a complaint from a data subject’s representative, if the representative provides the data subject’s written consent authorising the representative to act on the data subject’s behalf in relation to the complaint.
If there is any doubt about the identity of the complainant the Council will first seek to verify the data subject’s identity or third party’s entitlement to act on behalf of the individual. The forms of identification that are acceptable from a data subject are as follows;
a. Passport
b. Driving Licence
c. For third parties the identification requirements will vary dependent on their relationship to the data subject. Therefore, these will be assessed on a case by case basis.
Investigation and Complaint Outcome
Once all identification requirements have been met, the investigation will be carried out and responded to normally within one month or earlier without undue delay. If further clarification is required from the complainant or more time is required for the response to be completed the Council will inform the complainant prior to the original deadline.
The complaint outcome will be communicated to the complainant in writing.
Review
If the complainant does not agree with the outcome, they can request a review of the decision.
This request must be made within one month of the original decision being communicated and should be sent to the clerk at clerk@shavingtononline.co.uk
The decision will be internally reviewed and responded to by a nominated individual within one month from the receipt of the request for review. Once the internal review has been completed, the Council will communicate the outcome in writing.
Manifestly unfounded, and/or excessive complaints
In some circumstances the Council can refuse to investigate and respond to the complaint. This will be when a complaint is deemed to be manifestly unfounded, and/or excessive. Each complaint will be considered on a case by case basis by applying the following factors:
a. the data subject has explicitly stated that they intend to cause disruption (whether in the complaint, or in other correspondence), and has threatened individuals;
b. the data subject has made unsubstantiated accusations against individuals, and is persisting in those accusations;
c. the data subject is targeting particular individuals, against whom they have a personal grudge;
d. the data subject makes frequent complaints intended to cause disruption; and
e. the data subject continues to repeat the substance of previous complaints which have already been investigated.
Where a complaint is deemed to be manifestly unfounded and/or excessive, the Council will contact the individual and in a reasonable timeframe explain to them:
a. the reasons for refusing to consider the complaint;
b. their right to make a complaint to the ICO; and
c. their right to pursue their data subject rights through a judicial remedy.
Independent External Review of Complainant Issues
If the complainant remains dissatisfied, they can escalate their complaint to the Information Commissioner’s Office (the “ICO”). Information about how to make a complaint to the ICO can be found here: https://ico.org.uk/make-a-complaint/
In order to respond to the complaint, the Council will investigate the complaint based on the information provided by the ICO. The cooperation of any staff/members able to assist with the investigation will be required. The reason for the investigation may need to be disclosed to the relevant staff/members. The Clerk will submit an evidenced response to the ICO after consultation with the Council.