Data Protection

Data Protection

Data Protection

The Data Protection Act (DPA) applies to anyone who handles or has access to information about individuals. The DPA gives rights to the people the information is about and helps ensure that the information held on computers and in paper-based systems is managed properly. Kent County Council is a data controller and has two main obligations under the Act:

  1. To notify the Information Commissioner that information about individuals is being collected, processed and held
  2. To follow the eight principles set out in the Act – which are that all personal information about individuals should be:
  •     Processed fairly and lawfully (this means making people aware of why we are collecting their information, what we intend using it for, and who else we may be sharing it with)
  •     Processed for limited purposes and in an appropriate way (this means only using the information we’ve collected for the purpose we said)
  •     Relevant and sufficient for the purpose (this means only asking for information we need as opposed to information that may be useful in the future for something else)
  •     Accurate (this means a regular scheduled review of the information we hold – maybe annually ensuring personal data is kept up-to-date)
  •     Kept for as long as is necessary and no longer (however, this may be a very long time if statute says records should be keep for a particular number of years)
  •     Processed in line with individuals’ rights (this means we should deal with your information the same way we would like our own personal information to be treated)
  •     Secure (this means we must ensure that your information cannot be accessed by anyone that isn’t authorised)
  •     Only transferred to other countries that have suitable data protection controls.

Personal data

Personal data is any information including facts and opinions and any indication of intentions, which relates to a living individual who could then be identified from that information. For example, name, address, date of birth, National Insurance number, bank account details. Personal data can also be ‘sensitive’. This is information about your racial or ethnic origin, political opinions, religious beliefs, trade union membership, physical or mental health or condition, sexual life, criminal offences, proceedings and convictions. We can only collect and hold this information for specific purposes (for example equal opportunities monitoring). Information disclosure Personal information cannot usually be released to anyone else without your consent or knowledge. There are, however, certain circumstances when a third party (specifically a government agency or law enforcement agency) can request information about you and we would be obliged to give it. For example:

  •     When the disclosure is for the purposes of preventing or detecting crime and to obtain your consent first would be likely to prejudice those purposes
  •     Where the disclosure is required by law or by a court order.

Likewise, if you ask for information about another person other than yourself, your request will be rejected except in the following situations:

  •     Parents can request information about their children if the children concerned are under 12
  •     The person you are asking about has given their written consent allowing us to disclose their information to you
  •     You are legally allowed to act on their behalf (Power of Attorney).

To request access to information that the council may hold about yourself, you need to complete a subject access request form (PDF, 48k) and post it to us together with £10 payment to the address on the left of the screen. Cheques and postal orders should be made payable to Kent County Council. Remember that if you are applying on someone else’s behalf, you must also enclose either their signed, written consent, or proof that you are legally entitled to act for them. Please note that there are different fee structures for some records; for example education and social services. We will advise you if you need to pay us more money and likewise, we reserve the right to waive any fees. You will receive a response within 40 days of us receiving your written request and the fee. If we do not have enough information we will contact you and ask for more details. The 40 day period of response will begin from the day we receive sufficient information to enable a search and the fee. (Please also bear in mind that there are five directorates within Kent County Council, and these are made up of many units consisting of about 30,000 employees in total. We also work in partnership with many companies, agencies and other local authorities, many of which process personal information on our behalf, so it is important to be as specific as possible when requesting your personal information to ensure that you receive all the relevant documents that you require.) The information that you can expect to receive from us is a copy of anything we can locate in whatever format we hold it in; for example, screen prints of databases, copies of documents held in manual filing, CCTV footage. We will explain any jargon or abbreviations and will provide a summary sheet detailing what we have used the information for, and what information we have withheld and why (if applicable). There are some instances where we may not be able to release some of the information we hold about you to you. The main reasons for not disclosing information to you are:

  •     Personal Information (if the release of documents containing your information would disclose the identity of someone else).
  •     Examination marks and examiners comments.
  •     Information given in confidence (e.g. references).
  •     Crime and taxation – (if the release of information would prejudice the prevention/detection of crime, the prosecution of offenders, or the assessment/collection of any tax or duty).
  •     National Security (if National Security would be compromised by the release of the information).

Occasionally your records may contain elements that it would not be appropriate for you to see (e.g: personal information about other individuals). Rather than withhold the whole record or document, we will redact it if we can to depersonalise or anonymise it, in which case there may be some blacked-out sections within the records. If you find incorrect information held about you then please write and tell us what is wrong and how it should be corrected. We must not, knowingly, give the information to the wrong person. As a Data Controller, we must do our best to ensure that the information asked for is given only to the person to whom it refers, or their authorised representative. We may therefore ask for some form of identification before we hand any information over. If we are posting information we will send it to the address of the person requesting it, or their authorised representative, as shown on the form. Your signature at the bottom of the form declares that you are that person requesting your own information, or authorising a representative to act on your behalf. To access your child’s school records, you should submit your request in writing to the headteacher of the school or educational establishment that your child attends/attended. Parents have their own independent right of access to the official educational records of their children under separate education regulations.