Subject Access Request (D/SAR)
Subject Access Request
The Data Protection Act (DPA) 2018 and the UK General Data Protection Regulation 2020 creates the legal basis under which MDDC can process your personal information. For the purpose of the Acts personal information is defined as any information that relates to a living individual from which they can be identified directly or indirectly. For more information, please see ICO guidance.
Any member of the public is entitled to request copies of all personal information that the Council holds about them. This is called a Subject Access Request (SAR).
If you wish to make a SAR, please complete our Exercising your Rights Form and submit it together with proof of identification. Once a SAR has been received along with proof of ID, we will provide you with the information that you have requested within one month.
The legal basis for processing your sensitive personal data, or data about criminal convictions, is that processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department (paragraph 6, schedule 1, Data Protection Act 2018). The function is meeting our legal obligations to answer subject access requests.
MDDC will provide the finished SAR in a commonly used electronic format (PDF), unless the data subject request prior to completion of the SAR another electronic format.
The costs of producing hard copies of documents on councils are well documented. Considering this, and the wider impact that ink and paper usage has on the environment, MDDC will charge a reasonable fee for paper copies.
SAR |
TYPE |
Unit |
Cost |
|---|---|---|---|
|
A |
Photocopies A4 B&W |
Per copy |
£0.30 |
|
B |
Photocopies A4 Colour |
Per copy |
£1.00 |
How many requests can I make?
MDDC is not obliged to respond to vexatious or repeated requests. This may include repeated requests from the same person for the same information, or requests which are intended to disrupt MDDC's work.
How long will MDDC keep your information?
Personal data held in relation to subject access requests will be kept by the department for up to two years from the date the case has been closed on our system, unless the case has escalated to the Information Commissioner’s Office (ICO). In the event of the latter, we shall retain your data for two years from the date the ICO case has been closed on our system in order to maintain an appropriate record in case of further appeals.
Complaints
If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF
Telephone: 0303 123 1113
Email: icocasework@ico.org.uk
Email: icocasework@ico.org.uk
Note: Documents or files may contain the personal information of several different people. In accordance with legislation, MDDC will redact any third party personal information, including staff details before releasing it in response to a request. All documents will be watermarked to indicate redaction may have been applied and an inference cannot be taken so should not be used for legal matters.
Further information
If you require any further information regarding making a Subject Access Request or any other aspect of the Data Protection Act, please contact us.