The Data Protection Act 2018 and the General Data Protection Regulations (GDPR) gives you (Data Subject) the right to apply for a copy of information about yourself. If you wish, you may appoint someone to apply on your behalf (such as an agent, parent or solicitor).
How do I make a request?
Your request is called a ‘Subject Access Request’ and can be submitted in writing, in person or over the phone. This request can be submitted by post to:
The Data Protection Officer
Elmbridge Borough Council
Civic Centre
High Street
Esher KT10 9SD
Or by email to dataprotection@elmbridge.gov.uk
Your request must include:
- Your name
- Your address
- Your date of birth
- A full description of the information you wish to obtain
- Details of any service(s) you are receiving that could help us find your information, eg rent or council tax number
To ensure confidentiality, we may require evidence which confirms your identity. A copy of a photo id, passport and proof of your address in the form of a driving licence and/or an energy bill or council tax bill would be acceptable. This information would be kept securely and in accordance with the Data Protection Act.
If you are making a request on behalf of someone else, please include proof of their permission for you to do so, or provide evidence of a power of attorney, court order, or health professional evidence that they are unable to provide consent
What information can I request?
Please be as specific as possible and ensure that the description of the information you require is clear and detailed to enable us to find the personal information you are seeking.
If we do not have enough information in order to locate what you are seeking, we may come back to you with more questions.
What happens when I make a request?
When we receive a request for information, we must respond as soon as possible, and not later than one calendar month after receiving your request.
Once your request has been received, the Data Protection Officer will liaise with the appropriate area of the council that holds the information you have requested. The information will be reviewed to establish what information you are entitled to under the Data Protection Act / GDPR.
Information which identifies other people will not be released, unless they have given their permission or there is a legal provision for sharing that data.
Is there any cost?
Access to personal information is free of charge.
What happens if some or all my requests are refused?
The council is permitted to withhold information if it falls under one of the exemptions in the Act. If this is the case then the exemption will be noted in the response. If you are unhappy with the decision, you can write to us to ask for an internal review, which will be carried out by a different officer. If you are not happy with the results of the review, you can contact the Information Commissioner to request a review of that decision.
A Non-Response by EBC
Any non-response to a Subject Access Request is classed as a breach of the Data Protection Regulation. The issue can be escalated to the ICO who will investigate and take potential enforcement action or issue the council with a fine.
Who should I contact if I have any questions?
Further information and guidance around the Data Protection Act 2018 and GDPR is available on the Information Commissioner’s website.
The Data Protection Act 2018 is also available to read online.
Anna Grealis is the Data Protection Officer for Elmbridge Borough Council and can be contacted on 01372 474149 or by emailing dataprotection@elmbridge.gov.uk.
