Personal Data

Under Data Protection laws, you have a right to have access to personal data the OPCC holds about you.  You have the right to obtain:

• Confirmation as to whether your personal data is being processed by the OPCC;
• Any available information as to its origin;
• Access to any personal data held about you.

The OPCC will provide the information requested free of charge. However, if the request is manifestly unfounded or excessive, or if you ask for additional copies of your personal data, the OPCC may require you to pay a reasonable fee based on the administrative cost of providing the information. On receiving your request, you will be advised whether this will apply and how much the fee will be.

If the information you request is not held by the Warwickshire OPCC, you will be notified and if the OPCC knows who might hold the personal data, you will be advised of which organisation to contact.

Where the OPCC is the data controller for your personal information, you can apply for access to this data using a process called a Subject Access Request.  You may make a subject access request by any means (such as by email or in person) but we require proof of your identity before it can be processed.  You should include with your Subject Access Request at least two official documents which between them show your name, date of birth, current address and signature.  Photocopies are acceptable as long as the copy is clear.

Examples of official documents for date of birth confirmation include:

• Birth/adoption certificate;
• Medical card;
• Passport;
• A photocard driving licence (counter-parts or paper versions are unsuitable as the date of birth is encoded).

Examples of official documents for address confirmation include:

• A utility bill (e.g. gas/electric or water);
• Council Tax bill
• Bank/credit card statement;
• Correspondence from HM Revenue & Customs or Benefit Agency, mortgage lender, professional body or a solicitor’s letter;
• Correspondence from your employer, e.g. a payslip or letter of appointment.

Failure to provide the correct proof of identity may prevent the OPCC from releasing the information if we cannot otherwise establish your identity. We may request additional information from you to help confirm your identity and your right to access, and to provide you with the personal data we hold about you. We reserve the right to refuse to act on your request if we are unable to identify you.

To help ensure you provide us with the relevant information to process your request, please complete our Subject Access Request form

Subject Access Requests Form

When you have completed and checked this form, send it together with copies of the two identification documents to the Data Protection Officer by email to [email protected]

What happens next

In response to your request, we will provide you with the information required by data protection law, including information on:

• The purposes of processing.
• Categories of personal data processed.
• Recipients or categories of recipients who receive personal data from us.
• How long we store the personal data, or the criteria we use to determine retention periods.
• Information on the personal data’s source if we do not collect it directly from you.
• Whether we use automated decision-making, including profiling, the auto-decision logic used, and the consequences of this processing.
• Your right to:
  • request correction or erasure of your personal data;
  • restrict or object to certain types of processing with respect to your personal data; and
  • make a complaint with the local data protection authority.

The information will be provided within one calendar month of receipt of your request, unless your request is complex or you send a large number of requests, in which case the OPCC may need more time to provide the information. You will be informed of this and provided with an explanation, along with anticipated timescales. In some cases, the OPCC may not be able to respond to your request; if this is the case you will be provided with an explanation why.

If the information you request reveals personal data about a third party, we will either seek that individual’s consent before responding to your request, or we will redact third parties’ personal data before responding. If we are unable to provide you with access to your personal data because disclosure would violate the rights and freedoms of third parties, we will notify you of this decision.

Applicable law may allow or require us to refuse to provide you with access to some or all of the personal data that we hold about you, or we may have destroyed, erased, or made your personal data anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal data, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

If you consider that a request by you for access to your personal data has not been dealt with properly by the OPCC, you may write to the Chief Executive or the Information Commissioner’s office. The Information Commissioner is empowered to assess whether there has been a failure to comply with Data Protection laws. The Commissioner can issue enforcement proceedings if satisfied that there has been a contravention of the data protection principles and can also recommend that you apply to court alleging a failure to comply with the provisions of the laws. The court may make an order requiring compliance with those provisions and may also award compensation for any damages you have suffered as well as any associated distress.