Purpose and legal basis for processing
Our purpose for processing your personal data is so that we can respond to your information request.
The legal basis for this is article 6(1)(c) of the GDPR, which relates to processing necessary to comply with a legal obligation to which we are subject.
If any of the information you provide us in relation to information request contains special category data, such as health information, the legal basis we rely on to process it is article 9(2)(g) of the GDPR, which also relates to our public task and Schedule 1 part 2(6) of the DPA2018 which relates to statutory and government purposes.
What we need and why we need it
We need information from you to respond to you and to locate the information you are looking for. This enables us to comply with our legal obligations under the following legislation:
- General Data Protection Regulation (2016)
- Data Protection Act (2018)
- Freedom of Information Act (2000)
- Environmental Information Regulations (2004)
What we do with it
When we receive a request from you, we’ll set up an electronic case file containing the details of your request. This normally includes your contact details and any other information you have given us. We’ll also store on this case file a copy of the information that falls within the scope of your request.
If you are making a request about your personal data, or are acting on behalf of someone making such a request, then we may ask for information to satisfy us of your identity. If it’s relevant, we’ll also ask for information to show you have authority to act on someone else’s behalf.
How long we keep it
For information about how long we hold personal data, please contact our Data Protection Officer
What are your rights
For more information on your rights, please see Your rights on the corporate privacy notice.