Statutory Information - Yoxford Village Website

The General Data Protection Regulation (GDPR) is a regulation which was incorporated into the Data Protection Act (DPA) 2018 and came into effect on 25th May 2018.

The GDPR:

strengthens the previous Data Protection Act 1998 and gives individuals more rights and protections;
sets out the requirements for how all organisations handle personal data;
applies to personal data which covers any information relating to an identifiable person who can be directly or indirectly identified in particular to a reference to an identifier;
requires personal data to be processed in a manner that ensures its security. This must include protection against unauthorised or unlawful processing and against accidental loss, destruction or damage;
requires organisations to have a valid basis in order to process personal data. There are six lawful bases for processing data and the Parish Council will ensure that it uses the basis the most appropriate when processing such data.

Lawful Bases for Processing Data:

Consent
Contract
Legal Obligation
Vital Interests
Public Task
Legitimate Interests

The GDPR creates new rights for individuals and strengthens some of the rights that currently exist under the DPA.

Individual Rights:

The right to be informed
The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling

Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the GDPR. The Privacy Notice (attached below) sets out the Parish Council’s purposes for processing data and who it will be shared with.

The Parish Council’s Data Retention and Disposal Policy (attached below) sets out the retention periods for all data, including personal data. The Parish Council’s Personal Data Audit (attached below) records the type of data processed, the nature and purpose of the processing, the legal basis for processing, the identity of the data subjects and the controls operating to protect the data.

The GDPR introduces the ‘right of access’ for individuals and data subjects have the right to request:

the reasons why their data is being processed;
the description of the personal data concerning them;
anyone who has received or will receive their personal data; and
details of the origin of their data if it was not collected from them.

A Subject Access Request (SAR) is a request for personal information that the Parish Council may hold about an individual. If an individual wishes to exercise their subject access right, the request must be made in writing. The purpose of a SAR is to make individuals aware of and allow them to verify the lawfulness of processing their personal data. Under the GDPR and the DPA, individuals have the right to obtain confirmation as to whether personal data is being processed. The Parish Council’s Subject Access Request Policy and Procedure is attached below.

The Freedom of Information Act 2000 provides public access to information held by public authorities. It does this in two ways –

(1) public authorities are obliged to publish certain information about their activities and
(2) members of the public are entitled to request information from public authorities.

The Act covers any recorded information that is held by a public authority in England, Wales and Northern Ireland, and by UK-wide public authorities based in Scotland. Public authorities include government departments, local authorities, the NHS, state schools and police forces. Recorded information includes printed documents, computer files, letters, emails, photographs, and sound or video recordings. The Parish Council’s Freedom of Information Act Policy is attached below.