Your rights

The General Data Protection Regulation (GDPR) gives individuals several rights regarding their personal information. This summary table (pdf format, 202Kb) explains your rights and when they apply.

You have the right to request and amend the personal information Oxfordshire County Council holds about you.

To be informed

You have the right to be informed about the collection and use of your personal data.

A privacy notice will be provided to you at the time your personal data is collected and will explain simply and clearly how and why we intend to process your data. This information will be on the website, on the form you complete or you will be told verbally over the phone.

Access to your personal information

You have a right to get access to the personal information we hold about you. 

We must provide a copy of your information to you free of charge. However, we may be able to charge a reasonable fee if a request is manifestly unfounded or excessive. We can charge a fee if you request further copies of the information we have already provided to you. Any fee will be based on the administrative cost of providing the information to you.

Change inaccurate personal information

You have a right to rectification of inaccurate personal information and to update incomplete personal information.

If you believe that any of the information that we hold about you is inaccurate, you have a right to request that we restrict the processing of that information and to rectify the inaccurate personal information.

Rectification can be achieved by adding to the record or creating a supplementary record. Even if we decide that the information is correct, we will place a statement from you on the record with the data you believe to be correct or stating your dispute.

Request the council to delete your information

You have a right to request that we delete your personal information.

You may request that we delete your personal information if you believe that:

• we no longer need to process your information for the purposes for which it was provided
• we have requested your permission to process your personal information and you wish to withdraw your consent; or
• we are not using your information in a lawful manner

Request the council to restrict the processing of your information

You have a right to request the council to restrict the processing of your personal information. 

You may request the council to restrict processing your personal information if you believe that:

• any of the information that we hold about you is inaccurate
• we no longer need to process your information for the purposes for which it was provided, but you require the information to establish, exercise or defend legal claims; or
• we are not using your information in a lawful manner

Request personal information provided in a portable format

You have a right to data portability.

Where we have requested your permission to process your personal information, you have a right to receive the personal information you provided to us in a portable format.

You may also request the council to provide it directly to a third party, if technically feasible. We’re not responsible for any such third party’s use of your information, which will be governed by their agreement with you and any privacy statement they provide to you.

Please note that this right only applies to data that is being processed electronically.

Object to the processing of your personal information

You have a right to object to the processing of your personal information.

You must tell us your circumstances justifying your objection to processing. Please be aware that we can still process personal information where there are compelling grounds, or it is necessary for legal claims.

You can also object separately to your data being used for direct marketing and for research. Your objection to your data being processed for a research purpose may be overridden if the council has public interest justification for this.

Rights in relation to automated decision making and profiling

You have three rights in relation to automated decision taking, including profiling, where the result will have legal or other significant effects on you.

• The first is the right to prevent such a decision being taken. You can give the council written notice asking us not to take an automated decision.
• The second right applies where no such notice has been given. You must be informed by the council, as soon as is practicable in the circumstances, that an automated decision has been made.
• The third right relates to the options available to you on receiving notification of an automated decision. If you are unhappy that an automated decision has been taken, you have 21 days to ask the council to reconsider the decision or to take a new decision on a different basis

Withdraw consent

You have a right to withdraw your consent.

Where we rely on your permission to process your personal information, you have a right to withdraw your consent at any time. We will always make it clear where we need your permission to undertake specific processing activities.

Please be aware that you will not be able to withdraw your consent if we do not rely on your permission to process your personal information i.e. to use a service we are required to provide by law.

Lodge complaints

You have a right to lodge a complaint with the regulator.

If you wish to raise a complaint on how we have handled your personal information, you can contact our Complaints Team who will investigate the matter. We hope that we can address any concerns you may have.

Telephone: 01865 815906 

Complaints Team
Oxfordshire County Council
County Hall
New Road
Oxford
OX1 1ND

You can also complete the online complaints form. 

If you are still unhappy, you may contact our Data Protection Officer.

Information Management Team
Oxfordshire County Council
County Hall
New Road
Oxford
OX1 1ND

dataprotectionofficer@oxfordshire.gov.uk

If you are unhappy with the outcome or do not wish to raise this with us in the first instance, you can directly contact the Information Commissioner’s Office (ICO) which is the UK supervisory authority for data protection issues

0303 123 1113
https://ico.org.uk/