Your individual rights
The data protection legislation provides the following rights for individuals:
Right to be informed
At a glance:
- Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the data protection legislation.
- We must provide individuals with information including: the purposes for processing their personal data, our retention periods for that personal data, and who it will be shared with.
- We must provide privacy information to individuals at the time we collect their personal data from them.
- If we obtain personal data from other sources, we must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month.
Right of access
At a glance:
- Individuals have the right to access and receive a copy of their personal data, and other supplementary information.
- This is commonly referred to as a subject access request or ‘SAR’.
- Individuals can make SARs verbally or in writing.
- A third party can also make a SAR on behalf of another person.
- In most circumstances, we cannot charge a fee to deal with a request.
- We should respond without delay and within one month of receipt of the request.
- We may extend the time limit by a further two months if the request is complex or if we receive a number of requests from an individual.
- We should perform a reasonable search for the requested information.
- You should provide the information in an accessible, concise and intelligible format.
- Any information should be disclosed securely.
- We can only refuse to provide the information if an exemption or restriction applies, or if the request is manifestly unfounded or excessive.
Right to rectification
At a glance:
- The data protection legislation includes a right for individuals to have inaccurate personal data rectified, or completed if it is incomplete.
- An individual can make a request for rectification verbally or in writing.
- We have one calendar month to respond to a request.
- In certain circumstances we can refuse a request for rectification.
Right to erasure
At a glance:
- The data protection legislation introduces a right for individuals to have personal data erased.
- The right to erasure is also known as ‘the right to be forgotten’.
- Individuals can make a request for erasure verbally or in writing.
- We have one month to respond to a request.
- The right is not absolute and only applies in certain circumstances.
Right to restrict processing
At a glance:
- Individuals have the right to request the restriction or suppression of their personal data.
- This is not an absolute right and only applies in certain circumstances.
- When processing is restricted, we are permitted to store the personal data, but not use it.
- An individual can make a request for restriction verbally or in writing.
- We have one calendar month to respond to a request
Further information your rights
For further information on your rights you can contact our Data Protection Officer at DPO-DHSC@gov.im or contact the Information Commissioner’s office at ask@inforights.im