Data Protection - How to Invoke Your Rights

Under Data Protection Law (UK GDPR and Data Protection Act 2018) the Council has a duty to protect the personal data it processes. The following rights are provided to individuals.

Your Rights

• Right to be Informed - You have the right to be informed about the collection and use of your personal data. Please see our Privacy Notice for details
• Right of Access (Subject Access Request) - You have the right to request a copy of personal data held about you
• Right to Rectification - You have the right to request that inaccurate personal data be rectified, corrected or completed
• Right to Erasure - You have the right to request that personal data about you is deleted or destroyed in certain circumstances. This is sometimes called the “right to be forgotten”
• Right to Restrict/Cease/Object to Processing - You have the right to request that inaccurate personal data about you is restricted, limited or suppressed in certain circumstances. Under this right you can also request your data is not deleted or destroyed
• Right to Data Portability - You have the right to request data portability of personal data in certain circumstances. This means you can receive personal data about yourself in machine readable common format, you may request that personal data is sent to another organisation
• Right in relation to automated decision making and profiling - Torfaen County Borough Council does not carry out automated decision making or profiling that comes under this definition.

How can you make a Rights Request from us?

It would assist us greatly if you could make your request in writing (by letter or e-mail) or you can make a Data Protection Rights Request here. If you would like advice or assistance in completing this form or submitting a request please contact the Data Protection & Information Governance Team on 01495 762200.

You can email us at DPA@torfaen.gov.uk

You can write to us at: Data Protection Officer, Torfaen County Borough Council, Civic Centre, Pontypool, NP4 6YB.

Is there a fee?

For requests listed above, the authority will provide a copy of the information free of charge. However, we can charge a ‘reasonable fee’ (based on the administrative cost of providing this information) when a request is manifestly unfounded or excessive, particularly if it is repetitive.

We may also charge a reasonable fee to comply with requests for further copies of the same information.

What is the time frame for responses?

We aim to acknowledge requests or ask for more information to clarify requests within five working days of receiving it.  We will provide responses within one month of receiving the necessary information and proof of identity documents. 

Where requests are complex or numerous and we feel the need to extend the period of compliance by a further two months we will inform the individual within one month of the receipt of the request and explain why the extension is necessary.

What information is required when submitting a Rights Request?

It would assist us if you completed a Rights Request form as comprehensively as possible and we will use the information supplied by you to search our files and systems for data relating to you. You can make a Data Protection Rights Request here.

We will require proof of ID, one copy of photographic ID such as a copy of the requestor’s passport or a driving licence, and proof of residency such as copy of a utility bill.

A letter of authority will be required if acting on behalf of someone else, a verification process is in place.

Can we supply all the information requested from us?

It is in the public interest that we are open, transparent and accountable for the work we do.

It is important that the disclosures we make do not undermine the confidence and trust in the authority or those who correspond with us.

We will give access to personal information in accordance with the requirements of Data Protection Law (UK GDPR and Data Protection Act 2018).

However, there will be occasions where it would be wrong for us to disclose everything eg 3rd party information and exemptions will be applied. A copy of the Data Protection Act Exemptions can be viewed here under schedules 2,3 and 4.

Appeals and Complaints

If you are unhappy with the reply you have received, please let us know in writing, stating clearly what the issue is.

You can email us at DPA@torfaen.gov.uk

You can write to us at Data Protection Officer, Torfaen County Borough Council, Civic Centre, Pontypool, NP4 6YB

We will endeavour to resolve any problems, including an internal review of our original decision, which would be led by senior legal services staff.

As part of that review, if it is agreed that the information is incomplete or inaccurate, we will correct it.

Please note you may apply directly to the Information Commissioner for a decision at any time during this process. Generally, the Information Commissioner’s Office (Wales) cannot make a decision unless you have exhausted the internal review process provided by this Council.

The Information Commissioner can be contacted at: The Information Commissioner’s Office (Wales), 2nd Floor, Churchill House, Churchill Way, Cardiff, CF10 2HH. Telephone 0330 414 6421 or e-mail wales@ico.org.uk.

Last Modified: 05/05/2023 Back to top