Article 15 of the General Data Protection Regulation (GDPR) grants you the right to access your personal data held by the Office of the Police and Crime Commissioner for Warwickshire (OPCC), including the right to obtain confirmation that we process your personal data, receive certain information about the processing of your personal data, and to obtain a copy of the personal data we process.
You have the right to expect the OPCC, as a data controller (a person or organisation which controls the purpose and manner in which data is processed), to ensure that personal data is:
- Processed fairly, lawfully and transparently;
- Obtained for specific, explicit and lawful purposes;
- Adequate, relevant and not excessive;
- Not kept for longer than is necessary;
- Processed in accordance with the rights of the data subject;
- Kept secure;
- Not transferred abroad unless to countries or organisations with adequate data protection laws.
As a data controller, the OPCC is required to inform you:
- Why we use your personal data and the legal reasons we use for doing so;
- What categories of personal data we process;
- Who we share your personal data with, including if we share your data with recipients in third countries or international organisations;
- How long we envisage storing your personal data, or if that it not possible, the criteria we use to determine that period.
The way in which information held by and created by the OPCC is classified will determine how it is treated. There are two key policies that govern how information will be classified:-
Access to personal data
Under Data Protection laws, you have a right to have access to personal data the OPCC holds about you. You have the right to obtain:
- Confirmation as to whether your personal data is being processed by the OPCC;
- Any available information as to its origin;
- Access to any personal data held about you.
The OPCC will provide the information requested free of charge. However, if the request is manifestly unfounded or excessive, or if you ask for additional copies of your personal data, the OPCC may require you to pay a reasonable fee based on the administrative cost of providing the information. On receiving your request, you will be advised whether this will apply and how much the fee will be.
Requesting access to your personal data
Where the OPCC is the data controller for your personal information, you can apply for access to this data using a process called a Subject Access Request.
Before making your request, please contact the office to establish if we do in fact hold the information you are requesting – this will help to save time for you, particularly if we do not hold the information and need to refer you to another organisation.
You may make a subject access request by any means (such as by email or in person) but we require proof of your identity before it can be processed. You should include with your Subject Access Request at least two official documents which between them show your name, date of birth, current address and signature. Photocopies are acceptable as long as the copy is clear.
Examples of official documents for date of birth confirmation include:
- Birth/adoption certificate;
- Medical card;
- A photocard driving licence (counter-parts or paper versions are unsuitable as the date of birth is encoded).
Examples of official documents for address confirmation include:
- A utility bill (e.g. gas/electric or water);
- Council Tax bill
- Bank/credit card statement;
- Correspondence from HM Revenue & Customs or Benefit Agency, mortgage lender, professional body or a solicitor’s letter;
- Correspondence from your employer, e.g. a payslip or letter of appointment.
Failure to provide the correct proof of identity may prevent the OPCC from releasing the information if we cannot otherwise establish your identity. We may request additional information from you to help confirm your identity and your right to access, and to provide you with the personal data we hold about you. We reserve the right to refuse to act on your request if we are unable to identify you.
To help ensure you provide us with the relevant information to process your request, a Subject Access Request form is available from the OPCC. Please contact the office for more information at:
Office of the Police and Crime Commissioner,
3 Northgate Street,
Tel: 01926 412 322
What happens next
In response to your request, we will provide you with the information required by data protection law, including information on:
- The purposes of processing.
- Categories of personal data processed.
- Recipients or categories of recipients who receive personal data from us.
- How long we store the personal data, or the criteria we use to determine retention periods.
- Information on the personal data’s source if we do not collect it directly from you.
- Whether we use automated decision-making, including profiling, the auto-decision logic used, and the consequences of this processing.
- Your right to:
- request correction or erasure of your personal data;
- restrict or object to certain types of processing with respect to your personal data; and
- make a complaint with the local data protection authority.
The information will be provided within one calendar month of receipt of your request, unless your request is complex or you send a large number of requests, in which case the OPCC may need more time to provide the information. You will be informed of this and provided with an explanation, along with anticipated timescales.
In some cases, the OPCC may not be able to respond to your request, for example, if the request is unfounded, excessive or repetitive. When the OPCC cannot respond to your request, you will be provided with an explanation why.
If the information you request reveals personal data about a third party, we will either seek that individual’s consent before responding to your request, or we will redact third parties’ personal data before responding. If we are unable to provide you with access to your personal data because disclosure would violate the rights and freedoms of third parties, we will notify you of this decision.
Applicable law may allow or require us to refuse to provide you with access to some or all of the personal data that we hold about you, or we may have destroyed, erased, or made your personal data anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal data, we will inform you of the reasons why, subject to any legal or regulatory restrictions.
If your are not happy with our response
If you consider that a request by you for access to your personal data has not been dealt with properly by the OPCC, you may write to either of the following:
- Data Protection Officer for Warwickshire OPCC, Warwickshire Legal Services, Resources Group, Warwickshire County Council, Warwick CV34 4RL.
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
The Information Commissioner is empowered to assess whether there has been a failure to comply with Data Protection laws. The Commissioner can issue enforcement proceedings if satisfied that there has been a contravention of the data protection principles and can also recommend that you apply to court alleging a failure to comply with the provisions of the laws. The court may make an order requiring compliance with those provisions and may also award compensation for any damages you have suffered as well as any associated distress.
If the information you request is not held by the Warwickshire OPCC, you will be notified and if the OPCC knows who might hold the personal data, you will be advised of which organisation to contact.
If the information you require is in relation to data held on the Police National Computer, such as, information on prosecutions, convictions and cautions, this is held by the police. The relevent force will be able to advise of their process for subject access requests and details of information types that they can and cannot release for legal reasons.