Requests for information
The type of request made will indicate what legislation the request falls under:
- Requests for copies of personal data, whether made directly by the individual concerned or by a third-party organisation, will be handled in accordance with the requirements of the UK GDPR.
- Requests for environmental information held by us will be dealt with under the EIR.
- Requests for information not subject to either UK GDPR or EIR will be regarded as a request for recorded information under FOI.
- Information subject to EIR and FOI that can be provided within a normal customer enquiry will be dealt with under the usual customer service procedures.
UK General Data Protection Regulation
Requests from Individuals
We will provide individuals with a copy of the personal data we hold about them (known as a subject access request), together with other supplementary information, unless there is a good reason for us not to.
Requests for personal data under UK GDPR can be made verbally or in writing, including via social media.
We will respond to third parties acting on behalf of the individual if we are satisfied that the third party making the request is entitled to act on behalf of the individual. It is the third party’s responsibility to provide evidence of their authority.
If a request is made by or on behalf of a child, we will make reasonable efforts to assess the child’s competence and where a child is deemed competent to exercise their rights independently, we will respond directly to them.
If we are unsure about an individual's identity, we will ask for information to verify it. The timescale for responding to a subject access request does not begin until we have received the requested information.
Where required, we will seek clarification or further information to help identify the personal data or the processing activity that the request relates to. The timescale for responding to the request is paused on the day that clarification is sought and resumes on the day the clarification is received. This is known as ‘stopping the clock’.
We do not usually charge a fee to comply with a subject access request. However, we may charge a ’reasonable fee’ for the administrative costs of complying with a request if it is manifestly unfounded or excessive, or if an individual requests further copies of their data.
We will make reasonable efforts to find and retrieve the requested information. However, we are not required to conduct searches that would be unreasonable or disproportionate to the importance of providing access to the information.
We will provide the information in a commonly used electronic format, unless you request otherwise.
Where an exemption applies, we may refuse to provide all or some of the requested information, depending on the circumstances.
If we refuse to comply with a request, we must inform the individual of:
- the reasons why
- the existence of other relevant data protection rights and how to exercise them
- how to complain to us if they believe their request has not been handled correctly
- their right to make a complaint to the information commissioners office or another supervisory authority
- their ability to seek to enforce this right through the courts
We will normally respond to a request within one month. We may extend the time to respond by a further two months if either:
- the request is complex
- we have received a number of requests from the same person
If an extension is applied, we will inform the individual within one month.
Requests from third parties
Requests for disclosure of personal data from anyone other than the individual it relates to (or their appointed representative) will be considered on a case-by-case basis. We will carefully consider the circumstances of the request and will only disclose personal data where there is lawful justification to do so.