Subject Access Request privacy notice

When you make a subject access request, you will need to provide us with some personal data or information.

As the 'data controller' for the personal information - or data - we hold about you, South Ayrshire Council decides how your personal information is used/processed and what it is used for.

This statement provides more details about this and provides information on how to get in touch with us if you need to know more.

Your personal data - what is it?

Personal data is information relating to a living person who can be identified from that data. Identification can be based on the information alone, or in conjunction with any other information. The processing of personal data is governed by the General Data Protection Regulation 2016 (GDPR) and supplemented by the Data Protection Act 2018.

What Personal Data will we collect from you?

We will only collect the personal data we need to provide you with relevant information, services and support. The personal data we may collect includes:

• Name
• Address
• Email
• Telephone number (landline/mobile)
• Date of Birth
• Photographic Identification (such as a copy drivers' licence or passport)
• Identification disclosing your above mentioned name and address (e.g. a copy utility bill)

We will log and keep your personal data on our Subject Access Request electronic filing and computer systems.

How will we use your information?

All personal data is processed only by our Data Protection staff as part of the Subject Access Request process. We will only collect the personal data we need in order to provide you with access to the South Ayrshire Council's Subject Access Request Service, and oversee the provision of this service to you. We will use this personal data to contact you; to verify your identify; to clarify any issues we have with your Subject Access request; and to provide our response.

What is the legal basis for using/sharing your information?

Processing is necessary under a legal obligation granted under the GDPR to comply with your rights to provide access to information held by us about you.

Who will we share your information with?

The Data Protection Team will share your name, address and date of birth internally with Council services where it is established they hold the personal data you have requested under Subject Access request. This is to allow your data to be located, retrieved and provided to you. The information that is held at service level will then be shared with nominated officers within the Council to allow third-party information to be redacted prior to releasing data to you.

How long do we keep hold of your information?

We keep your personal data for no longer than reasonably necessary. We will retain your information for the current year plus three years from the time of your information request. If you make an appeal to the Information Commissioner's Office (the ICO) we will retain your information for the current year plus six years, from the outcome appeal date.

What are your rights?

The lawful basis for processing/using your personal data directly impacts which rights are available to you. For example, some rights will not apply, in this case we are not required to:

• erase your personal information.
• enable the right to data portability
• the right to object to the processing of your personal information However, you do have the following rights and can ask us to:
• correct your personal information if it is inaccurate;
• complete your personal information if it is incomplete;
• restrict the processing of your personal information in certain circumstances

What are the consequences of failing to provide personal information?

Legislation  imposes  a  statutory  requirement  upon  the  Council  to  receive  at  a minimum  your  name,  contact  details  and  reasonable  identification  to  allow the Council  to  process  and  respond  to  your  Subject  Access  request.  Without  this personal  data  we  cannot  validate,  search for  and  locate  your personal  data  to provide a response to your Subject Access Request.

Do you require this statement in a different format?

Please contact us if you require this information in an alternative format.

How can you get in touch with us?

If you wish to obtain any records held by the Council relating to you, or if you have any general data protection queries, please contact the Council's Data Protection Service at:

Data Protection Officer
South Ayrshire Council
County Buildings
Wellington Square
Ayr
KA7 1DR

Email: DataProtection@south-ayrshire.gov.uk
Telephone: 01292 612 223

If you have a complaint

If you are unhappy with the way the Council has dealt with your personal information, you can complain to the Data Protection Officer using the contact details noted above. If you remain dissatisfied, you have the right to complain to the Information Commissioner:

Information Commissioner's Office
45 Melville Street
Edinburgh
EH3 7HL

Email: scotland@ico.org.uk
Telephone: 0303 123 1113