Information rights policy

Contents

1. Introduction
2. Roles and Responsibilities
3. Information Rights under Data Protection Law
4. FOI and EIR
5. Complaints and Internal Reviews
6. Monitoring and Review

1. Introduction

This policy formalises Torbay Council’s (the Council) approach in promoting and facilitating our citizen’s information rights. In particular, it sets out the Council’s commitment to the following principles:

• To respect and promote the rights of individuals in accordance with the General Data Protection Regulation (GDPR) and Data Protection Act 2018.
• To advise and assist people in exercising their information rights under Data Protection Law in relation to the personal information the Council holds and processes.
• To respect, promote and facilitate rights of individuals in respect of The Freedom of Information Act (FOIA) 2000 and the Environmental Information Regulations (EIR) 2004
• To maximise the publication of information through the Council’s Publication Scheme, FOI Disclosure Log and Transparency Code.
• To conduct business in an open, accountable and transparent way in order to promote trust in how the Council operates.

Back to top

2. Roles and Responsibilities

Chief Executive and Senior Leadership Team

The Chief Executive and the Senior Leadership Team have ultimate responsibility for ensuring all departments across the Council comply with the requirements of access to information legislation, and must ensure an effective Council-wide information management approach. 

Caldicott Guardian

The Caldicott Guardian is a senior officer responsible for protecting the confidentiality of information about our customers as well as enabling appropriate information sharing specifically in relation to information processed by social care services. 

Senior Information Risk Owner (SIRO)

The SIRO has ownership of the risks associated with the information assets we hold and should act as an advocate for the organisation's information risk.

Data Protection Officer (DPO)

This is a mandatory requirement for all public authorities, therefore we must have in place a Data Protection Officer who is responsible for monitoring our compliance to data protection law and advising the senior leadership team and all staff of their roles and responsibilities.  

Information Governance Team

The Information Governance Team supports the Data Protection Officer in ensuring that the Council complies with access to information legislation. They support the whole Council in ensuring that requests made for information are carried out in accordance with the legislation and local policies.

Back to top

3. Information Rights under Data Protection Law

The GDPR provides the following rights for individuals in respect of the personal information an organisations holds and processes:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure (right to be forgotten)
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling

3.1 The right to be informed

Individuals have the right to be informed about the collection and use of their personal data. The Council is committed to ensuring that we are transparent and open about how we use the information we hold about our customers and our staff.

We will:

• Provide you with a ‘Privacy Notice’ which explains why we are processing your information (purpose), whether we will share your information with anyone else, how it will be stored and how long we will keep the information. On this notice we will also tell you about your rights and how you can exercise these rights and/or raise a complaint.
• Provide you with a privacy notice if we receive your information from a third party such as another organisation.
• Ensure that the privacy notice is specific in relation to the type of information we are processing and the department you are in contact with.
• Ensure that this privacy notice is concise and easy to understand.
• Ensure our privacy notices are reviewed on a regular basis and kept up to date.
• Ensure our privacy notices are available online.

There may be some instances where we are not able to provide a privacy notice, these instances could include:

• Where it would involve disproportionate effort to provide it, i.e. to write to hundreds of individuals who have signed a petition which has been submitted to the Council.
• Where you have already been informed about your rights and how we will process your information, i.e. if you have opened a claim for benefits and are providing further evidence, we will not provide you with a privacy notice each time we receive information from you.
• Where an exemption might apply, i.e. where information has been provided or collected for the purposes of preventing and detecting crime.

3.2 The right of access

Individuals have the right to access their personal data and further information. The right of access also allows individuals to be aware of and verify the lawfulness of the processing.  Individuals have the right to:

• Confirmation that their data is being processed
• Access to their personal data (a copy of their personal data)
• Other supplementary information, which corresponds to the information which should be provided within our privacy notices.

The right to access personal data can be exercised by anyone through a subject access request submitted to the Council. In order to process a request under this right, The Council will require the following:

• The request to be made in writing providing enough detail to assist us in locating the information.
• Two forms of identification so that we can be assured we are disclosing information to the correct person.

Although a request can be made to the Council verbally, we will only accept requests made in writing that clearly set out the information being requested.

The Council will provide you with a response to your subject access request via either secure email or in the post via special delivery. Where any exemptions have been applied to the request these will be communicated to you as part of the response.

3.3 The right to rectification

Individuals have the right to request that information about them be corrected (rectified) where it has been established that it is inaccurate, or incomplete.

Although a request can be made to the Council verbally, we will only accept requests made in writing that clearly set out the information to be rectified and why. This ensures the Council has an audit trail of any changes which are made to personal data. If a request is received verbally, we will confirm to you the changes being requested, in writing, before the request is processed.

There may be times at which we will request that you provide identification before any changes are made to your personal data, for example, to request changes to children’s social care files, or for historical data / information. 

Upon receipt of a valid request we will:

• Consider whether the processing of information should be temporarily restricted while the council considers the request.
• Inform you if we are satisfied that the information is accurate and therefore will not be changed with an explanation of our decision.

3.4 The right to erasure (right to be forgotten)

The GDPR has introduced a right for individuals to have personal data erased. This is also known as the right to be forgotten.  

Although a request can be made to the Council verbally, we will only accept requests made in writing that clearly set out your request. If a request is received verbally, we will confirm to you the information you have requested be erased, in writing, before the request is processed.

This right only applies in certain circumstances:

• The personal data is no longer necessary for the purpose which it was originally collected or processed it for;
• Where the Council has relied upon consent for the basis of processing and this consent is being withdrawn and there is no other legal basis on which to process the information;
• Where the Council has relied upon legitimate interests as the basis for processing and you object to the processing of your information and there is no overriding legitimate interest to continue processing the information;
• Where the Council is processing the personal information for the purposes of direct marketing and you object to that processing;
• The personal information has been unlawfully processed;
• The personal information has to be erased for compliance with a legal obligation;
• The personal information has been collected in relation to the offer of information society services to a child.

Where the processing of personal information for any of the following purposes is necessary, this right will not apply:

• To exercise the right of freedom of expression and information;
• To comply with a legal obligation;
• For the performance of a task in the public interest or in the exercise of official authority;
• For archiving purposes in the public interest, scientific research, historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing;
• For the establishment, exercise or defence of legal claims;
• If the processing is necessary for public health purposes in the public interest
• If the processing is necessary for the purposes of prevention or occupational medicine

Upon receipt of a valid request we will provide you with a unique reference number which, should your request be completed, be the only means of auditing that a request has been complied with as all other data will be erased.

3.5 The right to restrict processing

Individuals have the right to request that a data controller restricts or suppresses the processing of their personal data. This means that you can request that an organisation limits the way personal data concerning you is used, where you have a particular reason for wanting the restriction. This may be because you feel there are issues with the content of the information held or how it has been processed.

Although a request can be made to the Council verbally, only requests made in writing that clearly set out your request will be accepted. If a request is received verbally, we will confirm to you the processing you have requested be restricted, in writing before the request is processed, unless we stop processing immediately as is the case with right of objection under direct marketing.

This right only applies in certain circumstances:

• You wish to challenge the accuracy of their personal data and the Council is verifying the accuracy of the data;
• Where personal data has been processed unlawfully, you oppose the erasure of the personal data and requests restriction instead.
• The Council no longer needs the personal data but you need the Council to keep it in order to establish, exercise or defend a legal claim;
• You have objected to the Council processing your data under Article 21(1) (Right to object) and the Council is considering whether its legitimate grounds override this objection.

Upon receipt of a valid request, which meets the criteria set out above, we will:

• Stop all processing activities on the personal data in question, with the exception of storing that personal data.
• Throughout the restriction only process the personal data with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another individual or for the reasons of important public interest.
• Inform any third parties, with whom the personal data has been shared to, of the restriction which has been put in place, unless this would involve disproportionate effort or is impossible.
• Inform you before any restriction is lifted.

3.6 The right to data portability

The GDPR gives individuals the right to obtain and reuse their personal data for their own purposes across different services and organisations. This means that you can request personal data concerning yourself, previously provided by you and receive it in a commonly used and machine readable format. You also have the right to the transmission of that data via one service or organisation to another (data controller) without hindrance.

This right only applies in certain circumstances:

• The personal data has been provided by yourself;
• The processing is based on consent;
• The processing is necessary for the performance of a contract;
• The processing is carried out by automated means.

Upon receipt of a valid request we will provide you with your personal data in a structured, commonly used and machine-readable format, this may include a CSV file.

If requested by you, we will securely transmit the personal data to another organisation if this is technically possible.
Where the personal data concerned may include the personal data of other individuals, the Council will always consider whether complying with the request would impact on the rights of the other individuals.

3.7 The right to object

The right to object allows individuals to object to an organisation processing their personal data in the following circumstances:

• The processing is based on legitimate interests;
• The processing is necessary for the performance of a task carried out in the public interest/exercise of official authority (including profiling);
• The personal data is being used for direct marketing (including profiling);
• The processing is for the purposes of scientific or historical research and statistics.

In exercising this right, you as an individual must have an objection on ‘grounds relating to his or her particular situation’. The Council must comply with a request, unless:

• The council can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of you as the individual; or
• The processing is for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing, the Council will stop the processing activity as soon as it receives a request and will dealt with free of charge.

In order to exercise the right to object to processing for research purposes, you must have set out what the ‘grounds relating to his or her particular situation’ are. Where the processing for research is necessary for the performance of a public interest task, the Council is not required to comply with the request.

3.8 Automated individual decision making, including profiling

Individuals have the right not to be subject to a decision based solely on automated means, including profiling, where the automated process produces a legal effect for that individual or would significantly affect that individual.

This right does not apply if the decision:

• Is necessary for entry into, or performance of, a contract between the individual and the Council;
• Is authorised by UK law;
• Is based on the individual’s explicit consent.

Where a decision is based on the above points, we will ensure that you are able to request that human intervention is taken in respect of the decision and provide the opportunity for you to challenge a decision.
The Council will review systems regularly to ensure they are working as intended. Any new processes which include automated decision making will always be subject to a Data Protection Impact Assessment. 

3.9 Can the Council refuse to comply with a request made under these rights?

Where a request is manifestly unfounded or excessive Torbay Council reserves the right to charge a reasonable fee in order to provide a response. Any fee charged will be based on the administrative costs to process the request. In circumstances where a fee is charged, the individual will be informed promptly and the Council will not comply with the request until the fee has been received.

Torbay Council also reserves the right, in cases where a request is manifestly unfounded or excessive, to refuse response to a request. Where a request is refused the Council will provide an explanation and will inform the individual of their right to complain and how to properly do so.

3.10 Can the Council request identification to exercise these rights?

For requests made under the right of access (subject access requests) the Council will always ask for two forms of identification as to be assured that information is being disclosed to the correct individual.

In considering requests made in respect of any of the other rights outlined in this policy, the Council reserves the right to request identification as to be assured that the individual making the request is an individual who can exercise these rights.

If you are acting as a representative on behalf of an individual; the Council will always require proof that the representative can legally act in the interests on behalf of the individual, i.e. form of authority demonstrating consent.

3.11 Time limits for responding

Upon receiving requests the Council will:

• Acknowledge requests within 3 working days
• Provide a response within 1 month
• Keep you informed should an extension to the timescale is applied.

Where a request is complex or a number of requests have been received from a single individual, the Council may need to extend the timeframe by a further two months. We will always keep you informed if and when an extension is applied, providing the reason and clear expectation of when you should receive the response.

In relation to subject access requests, the Council may need to extend the timescales by where this is a significant amount of information to be reviewed, we may extend the timeframe by a further two months (62 calendar days). We will always keep you informed if and when we apply this extension.

Back to top

4. FOI and EIR

The Freedom of Information Act 2000 (FOI) and Environmental Information Regulations 2004 (EIR) provides individuals with a right of access to non-personal information held by the Council creating openness and transparency, unless an exemption applies.

4.1 What information is covered under FOI and EIR?

The legislation applies to all recorded information held by the Council where it is:

• Created in the conduct of the Council’s business.
• Created/processed by staff members and elected members regardless of office, mobile or home working.
• Created in any format e.g. paper, audio, video, electronic, email, etc.
• Regardless of the date the information is generated or received.
• Received from any person whether a private individual, commercial organisation or the media.

4.2 The Council’s obligations

If information is requested and is held by the Council, then it must be disclosed unless there is an exemption to restrict/prevent its release.

The Council is obliged under FOI and EIR to:

• Publish information in accordance with its approved Publication Scheme.
• Have clear arrangements for dealing with requests.
• Have a monitoring system to record and monitor requests.
• Have a clear process for dealing with complaints relating to FOI and EIR

4.3 Publication Scheme

Torbay Council is required to publish and maintain a Publication Scheme approved by the ICO.  The Publication Scheme is both a public commitment to make certain information available and a guide as to how that information can be obtained.  The Council’s Publication Scheme can be found on our website.

4.3.1 Disclosure Log

As part of its Publication Scheme and in accordance with ICO good practice, the Council also produces and maintains a log of requests called "the Disclosure Log". The Disclosure Log provides details of responses to information requests which have been received and are deemed to be of public interest.  In order to maintain our commitment to the public; these logs are depersonalised in accordance with Data Protection Law.

4.4 Making a request

To make a request under FOI you must:

• Submit your request in writing.
• Provide your name and address (postal or email).
• Clearly describe the information you are requesting to enable the Council to locate it.

Under Section 8(1) of the Act, in order for a request to be valid, an applicant must supply what is deemed to be a “real name”.  Therefore your title and/or first name along with your surname is required.

For example Mr Arthur Thomas Roberts could satisfy Section 8(1)(b) of the Act by stating his name in a request for information as “Arthur Roberts”, “A. T. Roberts”, or “Mr Roberts”, but not by stating his name as “Arthur” or “A.T.R”.

An EIR request can be made verbally or in writing, however we will require your contact details as we are required to respond to an EIR request in writing.

4.5 Processing a request

On receipt of a valid request, the Council will:

• Acknowledge your request within 3 working days
• Provide a response within 20 working days of receipt unless the Public Interest Test needs to be considered in which case an extension of a further 20 working days may be applied. In these circumstances, we will advise you as soon as possible.
• Where an exemption has been applied to any information we will notify you of the exemption being applied
• Advise you as soon as possible if the information requested is held by a different organisation
• Provide you with advice on how to make a complaint if you are dissatisfied with how your request has been handled

4.6 Exemptions

Under FOI and EIR there are a number of exemptions that remove the right of access, these are:

Where an exemption is used to withhold information we will issue a refusal notice in response to a request.

4.7 Public Interest Test

Where the Council is applying an exemption to any information requested and the exemption is qualified, it is required to consider the public interest test. The public interest test determines whether the public interest is best served by, withholding or releasing the information.

4.8 Fees and Charges under FOI and EIR

When the cost of providing information rises above the appropriate limit the Council is not obliged, under the Freedom of Information Act 2000, to respond to your request under Section 12(1) of the legislation.

The appropriate limit is specified in regulations for local government as £450 which represents the estimated cost of spending eighteen hours in determining whether the Council holds the information, locating, retrieving and extracting it.

The Council has discretion whether to proceed with a request which exceeds the appropriate limit. If so, there is no requirement to issue a fees notice as there is no obligation to comply with the request.

Under EIR there is no “cost limit” for dealing with requests. However, requests that cost a disproportionate amount can be refused on the basis they are manifestly unreasonable or too general, subject to the public interest test (Regulation 12). We may also charge a fee for providing information in a certain format as detailed in the Council’s published Charging Policy.

Back to top

5. Complaints and Internal Reviews

If a customer is unhappy with the Council’s response to a request they have made, they have a right to make a complaint. These complaints will be processed as Internal Reviews in line with this policy.

Although the Council only has a statutory duty to have an Internal Review Procedure in place for use with complaints about requests made under the Environmental Information Regulations 2004, the Council also adopts these procedures for complaints about Freedom of Information Act Requests and requests made under the Data Protection Law.

To request an internal review, the customer must contact the Council in writing within 40 working days after the date on which the response is sent or when the request was due. The customer must set out the reasons why they are requesting a review.  

5.1 What is an internal Review?

The Information Governance Team considers an internal review will be where a customer advising us that they are unhappy about the Council’s decision to withhold information or about the way in which their request has been dealt including where the customer considers that the Council has:

• Failed to provide the information asked for;
• Failed to tell them whether or not we hold information;
• Failed to respond to their request within time limits;
• Failed to give them proper advice and help;
• Failed to give information in the form in which they requested it;
• Failed to properly explain the reasons for refusing a request;
• Failed to correctly apply an exemption under the relevant Act – in other words, we have witheld information for the wrong reason.

Where a complaint does not fall under the examples given above, we may deal with the complaint under the Council’s Corporate Complaint Procedures. Visit our website for more information about our Corporate procedures.

5.2 How your complaint will be handled

If possible, the Information Governance Team will try to resolve your complaint informally and provide you with a response within 15 working days. We will consider whether we can handle a complaint informally based on the information requested, the exemptions applied, or any other related circumstances. If we consider we cannot handle the complaint informally we will carry out an Internal Review and will:

• Acknowledge your complaint within 3 working days advising you that it will be dealt with as an Internal Review;
• Provide you with a date for a response (either 20 working days or 40 working days depending on which piece of legislation your complaint falls under).
• Pass the complaint to an officer who is senior to the original decision maker (“appointed officer”) and who was not involved in the original decision.

The appointed officer will:

• Thoroughly reconsider the original request and make their decision;
• Provide a response informing you of their decision within the appropriate response time (see response times below).

5.3 Response times

• Freedom of Information Act 2000 - 20 working days*
• Environmental Information Regulations 2004 - 40 working days
• Requests made under Data Protection Act Law - 40 working days*

* In exceptional circumstances it may be necessary to extend the response time by a further 20 working days. If this is the case you will be notified as soon as possible with the reasons why alongside a revised response date.

5.4 If you remain unhappy with the Council’s response

If, after going through the Council’s Internal Review Procedure, you remain unhappy with our decision you can contact the Information Commissioner’s Office, whose contact details are available on their website www.ico.org.uk

5.5 Role of the Information Commissioner

FOIA, EIR and DPA are enforced by the Information Commissioner. The Information Commissioner is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

Complaints about decisions made by the Council relating to any of the Access to Information legislation can be made to the Information Commissioner who will make a decision as to whether the Council has dealt with the request in accordance with the relevant legislation.

The Information Commissioner can however refuse to investigate a complaint where a customer has not been through the Council’s own Internal Review Procedure.

For more information about the Information Commissioner please visit www.ico.org.uk.

Back to top

6. Monitoring and Review

This policy and those policies which sit underneath this framework will be reviewed every two years and updated accordingly.

For further information please contact Infocompliance@torbay.gov.uk

Back to top