Norfolk County Council collects and uses certain types of information about people we work with. The General Data Protection Regulation sets out that all personal information must be dealt with properly however it is collected, recorded and used – whether on paper, in a computer, or on other material. The Council is committed to only using your information for its intended purpose and to keeping your information safe at all times.
The Regulation gives anyone the right to find out about the information held about them.
How to ask for your information
You need to make your request to the Council and it would be helpful if you do this in writing. We have a downloadable information request form that you can fill in and send to us.
Alternatively you can write to us, providing enough information for us to identify you in our records – such as name, address and date of birth. You need to tell us whether you are interested in all the information we hold about you or just specific areas eg from a certain department, date range etc.
If you prefer, you can send an email to firstname.lastname@example.org with details of your request. This method of communication is not secure and there is a small risk that your email could be seen by other people before it reaches us, with the consequence that your personal details could become known to that person
Proof of identity and address
When we receive a request for information, we must make sure that you are who you say you are.
Unless the staff handling your request know you and recognise you, we need to see proof of identity. This can be a copy of your passport, birth certificate or other official document bearing your signature. We also need to see proof of your current address. This can be a copy of your driving licence or utility bill for example.
Making a request on behalf of a child
Children have the right to request their own information. Adults with parental responsibility can apply on their child’s behalf where the child is too young to understand. It is important for you to know that even when a child is too young to understand, an adult making the request is acting on behalf of the child and not in their own right.
Before responding to a request for information about a child, we will consider whether the child is mature enough to understand their rights. If we can be confident the child does broadly understand what it means to make a subject access request and how to interpret the information they receive we will respond directly to them.
The information the Council holds about children is mainly in areas such as social care but it does hold some educational information, such as special educational needs.
Most educational records are maintained by schools; as such, any requests should normally be made to the relevant school, not to the Council.
Parents interested in their children’s educational records have a separate right of access to these under the Education (Pupil Information) (England) Regulations 2005 regardless of their children’s ages, and they should normally apply to the school for these records. Requests for educational records should be fulfilled within 15 school days, whether they are made under the Regulation or under the Education (Pupil Information) (England) Regulations 2005
Acting on behalf of someone else
You may ask someone else to make a request on your behalf. This might be a family member or professional person, such as your solicitor.
If you ask someone else to act on your behalf, we will need to be satisfied that the person making the request is entitled to do this and it will be their responsibility to provide evidence of this entitlement. For example, this could be a letter providing your consent for the person to make the request or a legal power such as a Power of Attorney (for Health and Welfare).
Where requests are made on behalf of adults, the Council needs to check that the person making the request has the right to do so and the request is made in the person’s best interests. If the data subject has capacity he or she can fill in a downloadable personal information authorisation form and give it to the person making the request on their behalf.
What the Council does to provide the information
Norfolk County Council is obliged by the General Data Protection Regulation to comply with your request within one month of receipt (or of receiving proof of identity or clarification of what is required).
We will tell you whether we hold the information requested, and, if we do, we will give you a description of the information, the purposes for which it is being processed, the types of people to whom the information may be disclosed, and the source of the information. We will do this by providing you with our privacy notice, you can read all our privacy notices on our website or ask for a copy to be given to you.
We should give you a copy of the information, but there may be occasions when you agree to visit us to view the information instead.
We are obliged to check whether any of the information is exempt as defined in the Data Protection Act 2018 and cannot be provided.
In particular we must consider other people’s rights under the Data Protection Act 2018, and if your information contains information about other living individuals, we must consider whether it would be lawful and fair to them to disclose it. We will ask you about seeking consent from other people.
What should you do if you’re not satisfied
If you are not satisfied with the way we have handled your request, you should write to the Information Compliance Manager at email@example.com.
If you are still not satisfied, you can ask the Information Commissioner to carry out an assessment.
The Information Commissioner is an independent supervisory authority responsible for data protection and freedom of information.
Other rights under the General Data Protection Regulation
The Regulation gives you the right to ask us to delete information about you, this is often known as the right to be forgotten. It is important for you to know that the right to request deletion of your information is not the same as a right to demand it is done and there may be some circumstances when we cannot meet a request for erasure.
If we refuse your request for the right to erasure we will tell you why and what steps you can take next.
The regulation also gives you the right to ask us to stop doing something with your information, this is known as the right to restrict processing. As described above, this is a right to make the request not an automatic right for it to be done and is subject to certain circumstances.
If we refuse your request for the right to restrict processing we will tell you why and what steps you can take next.
The Regulation also gives you the right to receive your information in a format that you can easily use, to request that we stop processing altogether and to prevent automatic decision-making that has no human involvement.
This information was updated in May 2018