Data Protection legislation is designed to protect personal data about living individuals (data subjects). The Data Protection Act 2018 also places obligations on those organisations that process personal data (data controllers). As a data controller, Surrey County Council (SCC) is committed to complying with the legislation by applying the principles of good information handling across all its services.
Please scroll down the page or use the content list to jump to information within this page.
Page contents
- Why do we hold personal information about you?
- What types of information does the council hold?
- What are your rights?
- Making a request for access
- CCTV applications
- If you have a complaint
- Contacts
Why do we hold personal information about you?
We keep personal information about you so that we can provide and maintain a record of those services that you need. As a local authority we need to collect, process and keep data in relation to our statutory duties such as in the provision of social care services, education, sustainable development, trading standards, and births, deaths and marriages.
What types of information does the council hold?
The council has registered its use of personal information through the notification process to the Information Commissioner's office (ICO). The Information Commissioner's office is the governing body that oversees the act. The register entry shows what the organisation is registered to do, it does not reveal whether or not personal data is held about you. If you wish to have a copy of the SCC entry on the register you can obtain a copy from the Information Commissioner.
What are your rights and how to make an application?
There is some useful guidance and assistance which you may find helpful on the Information Commissioner's website. See also the Council's Corporate Privacy Notice for information about how we use information about you and how we protect your privacy.
Under the Data Protection Act 2018 you have the following rights:
- To be informed if your personal data is being used – an organisation must inform you if it is using your personal data
- To get copies of your data – you have the right to find out if an organisation is using or storing your personal data
- To get your data corrected – you can challenge the accuracy of personal data held about you by an organisation
- To get your data deleted – you can ask an organisation to delete personal data that it holds about you
- To limit how organisations use your data – you can limit the way an organisation uses your data
- To data portability – you have the right to get your personal data from an organisation in a way that is accessible
- To object to the use of your data – you have the right to object to the processing or use of your personal data in some circumstances
- Relating to decisions being made about you without human involvement – where decisions are made about you when your personal data is processed automatically and in profiling
- To raise a concern – if you are concerned about how an organisation is using your data
If you would like to make a request to update, correct or remove your data, you can use the online request to access, update or remove data form.
Making a request for access
You have the right to request a copy of the information that is held about yourself. You may, if you wish, appoint someone else to apply on your behalf such as a parent/guardian or a solicitor. However, we will need a Letter of Authority from you in order to process your request.
If you would like to make a request for a copy of the information that is held about yourself, you can use the subject access online request form.
Alternatively you can make a request by email to corporateig@surreycc.gov.uk or apply in writing at the following address:
Corporate Information Governance Manager
Legal and Democratic Services
Surrey County Council
Woodhatch Place
11 Cockshot Hill
Reigate
Surrey
RH2 8EF
Verbal requests are acceptable via the Contact Centre, who will forward your request to the Corporate Information Governance Team, but please note that your verification contact details and supplementary documents are required in order to process your request. Please see What information will I need to provide to make a subject access request?
The majority of responses are sent via secure electronic mail. However, if you wish to collect a copy of the response to your request in person at one of our offices, you will need to bring with you proof of identity (ID).
Adoption Team requests
If you would like to see your adoption records you will need to contact the Adoption Team directly.
What information will I need to provide to make a subject access request?
You will need the following information uploaded into the form (or sent to us with your request if you are contacting us by email or post).
- Completed form or letter detailing the information requested
- Relevant supporting evidence, which includes two separate and different documents each showing name and address (guidance is on the form). Photocopies or photographic copy from a mobile device of original documents are acceptable.
One form of proof of ID such as:
- Valid Driving Licence
- Valid Passport
- NHS card
- National Insurance card
- Valid Government issue photo identification
Together with one proof of address such as:
- Recent building or bank statement
- Recent Council Tax bill
- Recent landline telephone bill
- Recent utility bill
- Current benefits or pension statement
- Current rent statement or tenancy agreement
In order to validate your identity we will keep copies of the proof of your ID. These copies will be destroyed once your request has been closed.
Please note your request will be closed after 1 month if we do not receive the details requested.
How long do I have to wait for my data protection subject access request?
As an organisation we normally have to respond to your request within one month. However, if you have made a number of requests or your request is complex, we may need extra time to consider your request and this can take up to an extra two months to respond.
If we are going to do this, we will let you know within one month that we need more time and why.
Will I always receive everything I asked for?
Not always. Depending on the circumstances:
- you may receive only part of the information you asked for; or
- we may not provide you with any personal information at all.
As an organisation we can refuse to comply with your subject access request if we think it is 'manifestly unfounded or excessive'.
There can be other reasons why you may not receive all the information you expect, such as when an exemption applies, or the type of information you asked for is not covered by a subject access request.
Making a subject access request for information about your child
Children who are younger than 13 years old
You can request your child's information on their behalf if they are younger than 13 years old, or if they are not capable of understanding the request. You will need to provide verification documents. Additionally you will need to provide proof of parental responsibility. This could be
- Child's full birth/adoption certificate naming you as the parent
- Valid Court Order naming you as the parent
- Valid Court Order granting you parental responsibility
Children who are 13 years old or older
If you are requesting information about your child and they are 13 years old or over and are capable of understanding the request, you will need to upload verification documents.
You will also need to upload a signed and dated letter from you child giving their consent for you to act on their behalf and a copy of their valid photographic ID.
Making a subject access request for information for your partner/spouse
If you are making a request on behalf of another person, for example, your partner/spouse, you will need their consent and ID documentation. You will need to provide verification documents and include sufficient signed and dated letters of authority from the data subject.
Solicitors and legal representatives
If you are acting on behalf of the data subject, you will need to provide verification documents and include sufficient signed and dated letters of authority.
If the child is under 13 years old we require a signed and dated letter of authority from the parent(s) and confirmation from yourself that you have seen verification that they have parental responsibility.
If the child is 13 years old or over we require their own signed and dated letter of authority and a copy of their ID.
Requests if you are currently in prison
If you are currently in prison and your request is for your own information, we will require a letter or email from your Prison Governor to confirm your identity.
If you are currently in prison and your request is for your child's information, we will require evidence of parental responsibility and a letter or email from your Prison Governor to confirm your identity.
You can nominate another person to act on your behalf, we will require a signed and dated letter from yourself giving consent to the named person and we will also require the nominated person to provide us with a copy of their photographic ID.
Access to deceased person's records
We are in some cases able to provide some information where relevant to support individuals in administering probate responsibilities and settling the affairs of someone who is deceased.
To make a request of this nature you can use the subject access online request form.
Alternatively you can make a request by email to corporateig@surreycc.gov.uk or apply in writing at the following address:
Corporate Information Governance Manager
Legal and Democratic Services
Surrey County Council
Woodhatch Place
11 Cockshot Hill
Reigate
Surrey
RH2 8EF
You will need to provide us with the following details and documentation:
In relation to the deceased:
- Full name and any other names they were known by
- Date and place of Birth
- Date of Death
- Copy of death certificate
- Last known address
In relation to you and your role:
Your information including your name and a return address (postal or electronic) and copies of two forms of identity and address. For example, a copy of a passport or driving licence and a copy of a utility bill or bank statement.
- Evidence that you have executor status within a will
- Evidence that you are the personal representative of the deceased person such as:
- Certified copy of the grant of probate
- Certified copy of letters of administration
If there are personal representatives/executors other than yourself, we require written, recent, dated consent from each of the appointed personal representatives of the deceased person, consenting to the release of his/her personal information to you.
CCTV applications
Please note that Surrey County Council does not administer CCTV on the highways or in town centres. This is the responsibility of the district councils and the police.
If your request is to see images that may have been recorded about you on closed circuit television cameras on SCC properties please use the Data Protection subject access online request form.
Alternatively you can make a request by email to corporateig@surreycc.gov.uk or apply in writing at the following address:
Corporate Information Governance Manager
Surrey County Council
Legal and Democratic Services
Woodhatch Place
11 Cockshot Hill
Reigate
Surrey
RH2 8EF
As well as the verification documents for the subject access request, we will require from you:
- The exact date, time and location of the CCTV system containing the footage required.
- Sufficient information to enable identification of the Data Subject: a full description including clothing and/or photograph.
Please note that in the event that information supplied would seriously prejudice the prevention of detection of crime, Surrey County Council have the right under the Data Protection Act to refuse requests for access.
For further information please see the County Council's Surveillance Camera Data Governance Policy.
If you have a complaint
Please note that if you are not satisfied with the way your request was handled or you have a complaint about access please write to the Corporate Information Governance Manager.
Contacts
Corporate Information Governance Manager
Grisilda Ponniah
Corporate Information Governance Manager
Legal and Democratic Services
Woodhatch Place
11 Cockshot Hill
Reigate
Surrey
RH2 8EF
- Telephone: 03456 009 009
- Email: corp.infogov@surreycc.gov.uk
Data Protection Officer
The role of the Data Protection Officer is to manage the council's compliance with data protection legislation, inform and advise on data protection obligations, provide advice regarding Data Protection Impact Assessments (DPIAs) and act as an escalation point for data subjects and the supervisory authority.
If you have any concerns or questions about how your personal information is handled please contact Surrey County Council's Data Protection Officer by emailing DPO@surreycc.gov.uk
Information Commissioner
- Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Information Commissioner website
