Getting access to your information

Norfolk County Council needs to collect and use certain types of information about people we deal with. The Data Protection Act 1998 says that all personal information must be dealt with properly however it is collected, recorded and used – whether on paper, in a computer, or on other material – and there are safeguards to ensure this.

The Act gives anyone the right to find out about the information held about them.

How to ask for your information

You need to put your request in writing. For this you can fill in a downloadable information request form and send it to us.

Alternatively you can simply write to us, providing enough information for us to identify you in our records – such as name, address and date of birth. You need to tell us whether you are interested in all the information we hold about you or just specific areas.

If you prefer, you can send an email with details of your request. Bear in mind that this method of communication is not secure and there is a small risk that your email could be intercepted before it reaches us, with the consequence that your personal details could become known to others.

We make no charge for providing this information to you.

Proof of identity and address

When we receive a request for information, we must make sure that you are who you say you are.

Unless the staff handling your request know you and recognise you, we need to see proof of identity. This can be a copy of your passport, birth certificate or other official document bearing your signature. We also need to see proof of your current address. This can be a copy of your driving licence or utility bill for example.

Acting on behalf of someone else

The right to request personal information under the Data Protection Act 1998 applies only to the data subject (the person about whom the information is held).

There is no automatic right, for example, for a family member to request personal information about an elderly relative, for a solicitor to request personal information about a client, or for parents to request personal information about their children.

Where data protection requests are made on behalf of adults, the Council needs to check that the person making the request has appropriate authority and that the request is made in the data subject’s interest. If the data subject is competent, he or she can fill in a downloadable personal information authorisation form and give it to the person making the request on their behalf.

Children have the right to request their own information themselves. People with parental responsibility can, however, apply on their child’s behalf where the child is too young to understand. Where a child cannot understand, which usually means they are under the age of twelve, the Council must satisfy itself that the parents’ request is made in the child’s interest. There may be occasions when we decide not to give information to a parent or when we may ask a child to make a request on their own behalf.

The personal information the Council holds about children is mainly in areas such as social care but it does hold some educational information, particularly with regard to special educational needs.

Most educational records are maintained by schools; as such requests should normally be made to the appropriate school, not to the Council.

Parents interested in their children’s educational records have a separate right of access to these under the Education (Pupil Information) (England) Regulations 2005 regardless of their children’s ages, and they should normally apply to the school for these records. Requests for educational records should be fulfilled within 15 school days, whether they are made under the Data Protection Act 1998 or under the Education (Pupil Information) (England) Regulations 2005.

What the Council does to provide the information

Norfolk County Council is obliged by the Data Protection Act 1998 to comply with your request within 40 calendar days of receipt (or of receiving proof of identity or clarification of what is required).

We must tell you whether we hold the information requested, and, if we do, we should give you a description of the information, the purposes for which it is being processed, the types of people to whom the information may be disclosed, and the source of the information.

We should give you a copy of the information, but there may be occasions when you agree to visit us to view the information instead.

We are obliged to check whether any of the information is exempt as defined in the Data Protection Act and cannot be provided after all.

The main exemption we must consider relates to other people’s rights under data protection. If your information contains information about other living individuals, we must consider whether it would be lawful and fair to them to disclose it. We would normally seek their consent before making our decision.

Other exemptions we must consider relate to national security, crime, taxation, prejudice of regulatory activity, and legal professional privilege.

What should you do if you’re not satisfied

If you are not satisfied with the way we have handled your request, you should write to the Information Compliance Manager - Data Protection.

If you are still not satisfied, you can ask the Information Commissioner to carry out an assessment.

The Information Commissioner is an independent supervisory authority responsible for data protection and freedom of information.

Other rights under the Data Protection Act 1998

If you find that some information we hold about you is incorrect, you can apply to us (or to the courts if necessary) to have it corrected or deleted. This applies to inaccurate information or opinions based on inaccurate information.

If you consider that the way we handle your personal information, in whole or in part, is causing you or someone else substantial damage or substantial distress, you can write to us specifying the reasons why we should stop. We must comply with your request (known under the Act as a “data subject notice”) unless we consider that your request is unjustified. We must write to you within 21 days to let you know how we are complying with your request or why we are not complying.

You can claim compensation from us through the courts if you have suffered damage as a result of our contravening the Act.

The Act also gives you the right to prevent processing for the purpose of direct marketing and to prevent automatic decision-making that has no human involvement.