Home chevron_right Data protection and privacy chevron_right Data protection rights

Your data protection rights

Under the General Data Protection Regulation 2016 and Data Protection Act 2018, you have a number of rights where Middlesbrough Council is ‘processing’ your personal data. These include:

The right to be informed
The right of access (subject access request)
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling.

How do you exercise your data protection rights?

You can make a request to exercise your data protection rights verbally or in writing. However, to help us to find your data and understand your request more effectively, we ask that you complete our ‘Exercise of Rights request form’.

The more specific you are about your request and what information it relates to, the quicker we will be able to locate it and provide you with our response. When making your request, please specify what format you want to receive it in - electronic or hard copy.

There are two ways to complete the form:

Fill in the Exercise of Rights request form electronically and send it by email to foi@middlesbrough.gov.uk
Print, fill in, and return the Exercise of Rights request form by post to: Information Requests Team, PO Box 500, Middlesbrough, TS1 9FT

Exercise my data protection rights

Requests for CCTV footage

If your request is for CCTV footage, a list of all of our CCTV camera locations is available on the CCTV and surveillance page. All data from the CCTV system is stored for a maximum of 28 days. If your request is for any of your personal data captured by our CCTV systems:

Fill in the Exercise of Rights request form electronically and send it by email to cctv@middlesbrough.gov.uk
Print, fill in, and return the Exercise of Rights request form by post to: CCTV Unit, Middlesbrough Bus Station, Middlesbrough, TS1 5EA

Please make sure you send your form to the right address, as listed above.

Please note that Middlesbrough Council cannot guarantee that the contents of your email will be safe in transit.

Exercise my data protection rights

We have a responsibility to verify the identity of the individual making the request. Please provide two forms of ID, one of which should be a personal identity document, for example a passport or driving license, and the other should show that you're 'active in the community', for example, a utility bill or Council Tax bill.

If your request is about information about another person, then we may need you to provide evidence that you are legally authorised to exercise that person’s rights for them.

The Council will aim to respond to Data Protection Rights requests without undue delay and within one month of receipt of the request. If the request is deemed complex, then the Council may need to extend this by up to two further months where necessary. If we do this we will always inform you and provide the reasons for the delay.

What data protection rights exist?

Right to be informed

add

You have the right to be told whether we are processing your personal data and, if so, to be given specific information about what, how, and why we use your personal data. We maintain an over-arching privacy notice and a list of service specific privacy notices which you can view on the data protection page.

Right of access (subject access request)?

add

You can request a copy of the information that Middlesbrough Council holds about you by making a Subject Access Request (SAR). When making your request, please specify what format you want to receive the response in i.e. electronically or hard copy.

Right to rectification

add

If you believe that information we hold about you is inaccurate, you can contact us and let us know and we will try to put it right. You can also request that we complete any incomplete data. Once we have determined what we are going to do to rectify the data, we will contact you to let you know.

Right to erasure (right to be forgotten)

add

You can ask us to erase your personal data. Please note that under the data protection laws, this right does not always apply. If you ask for your data to be deleted and we believe that this right does not apply in the circumstances, we will always let you know as soon as possible.

This right can apply in the following circumstances:

We no longer need the personal data for the purpose it was originally collected;
You withdraw your consent (if we relied on this in the first place) and there is no other legal basis for the processing;
You object to the processing and there are no overriding legitimate grounds for the processing;
The personal data have been unlawfully processed;
The personal data have to be erased for compliance with a legal obligation; and
The personal data have been collected in relation to the offer of information society services (information society services are online services such as banking or social media sites).
Once we have determined whether we are going to erase the data, we will contact you to let you know.

Right to restrict processing

add

You can ask us to restrict the processing of your information in the following circumstances:

You believe that the information is inaccurate and you want us to restrict processing until we determine whether it is indeed inaccurate
The processing is unlawful and you want us to restrict processing rather than erase it
We no longer need the information for the purpose we originally collected it but you need it in order to establish, exercise or defend a legal claim, and
You have objected to the processing and you want us to restrict processing until we determine whether our legitimate interests in processing the data override your objection.

Once we have determined how we propose to restrict processing of the data, we will contact you to discuss and agree this with you. We will communicate this to any organisation that we have disclosed your personal data to, unless this proves impossible or would involve ‘disproportionate effort’.

Right to data portability

add

You have the right to get your personal data from the council in a way that is accessible and machine-readable, for example as a csv file. You also have the right to request that we transfer your data to another organisation.

Please note that under the data protection laws, this right does not always apply. If you ask for your data to be ported and we believe that this right does not apply in the circumstances, we will always let you know as soon as possible.

This right applies in where the personal data:

Is automatically processed i.e. excludes hardcopy/paper records
Was provided to us directly by you
Is being processed on the basis of your consent or for the performance of a contract between us and you.

Right to object

add

You have the right to object to an organisation processing your personal data. Please note that under the data protection laws, this right does not always apply. If you object to use of your data and we believe that this right does not apply in the circumstances, we will always let you know as soon as possible.

This right can apply when personal data is being used:

For a task carried out in the public interest
For the exercise of official authority
For their legitimate interests
For scientific or historical research, or statistical purposes, or
For direct marketing purposes

Rights in relation to automated decision making and profiling

add

Where we process personal data to make automated decisions or for profiling, you have the following rights:

To be given specific information about the processing (see Right to be informed)
To challenge and request a review of the decision.

This right only applies where the personal data is being used solely for automated individual decision-making, including profiling, with legal or similarly significant effects.