What is the Data Protection Act?
How does it protect personal data about you?
What are your rights?
Why do we keep personal information?
Does the Council need your consent to use information about you for any of these purposes?
Does the Council provide help in understanding the information?
 
 
 

What is the Data Protection Act?

 
The Data Protection Act 1998 regulates the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information. The act is enforced by the  Information Commissioner’s Office and Cardiff Council is registered with the Information Commissioner as a Data Controller. The council's entry on the register includes a general description of the processing of personal data which the Council carries out as part of its public duties. 
 
 

How does it protect personal data about you?

 
By setting rules and conditions which all users of personal information such as this Council must obey when obtaining and using information about you.  The Act also provides you with certain rights which any organisation must respect.
 
 

What are your rights?

 
  •  To ask the Council if it holds personal information about you.
  • To ask what it uses the information for.
  • To be given a copy of the information.
  • To be given details about the purposes for which the Council uses the information and of other organisations or persons to whom it is disclosed.
  • To ask for incorrect data to be corrected.
  • To ask the Council not to use personal information about you for direct marketing, which is likely to cause damage or distress or to make decisions about you based on the automatic processing of the data.
  • To compensate for damage or distress should these be caused by our failure to comply with certain requirements of the Act.
  •  
 

Why do we keep personal information?

 
So that we can provide you with the services you require, collect Council tax, collect rent, calculate housing benefit etc. and maintain a record of the services provided.  The Council provides a number of different services which are listed on the Subject Access Request form.
 
Completed forms can be emailed to foi@cardiff.gov.uk or sent to:
 
The Data Protection Officer
Improvement and Information 
County Hall
Atlantic Wharf
Cardiff
CF10 4UW
 
 

Does the Council need your consent to use information about you for any of these purposes?

 
Usually but not always.  We will normally obtain your consent only if we are going to process data about you for purposes other than those we are required to provide by law.  Occasionally the law will allow us to do this without your consent if it is reasonable and will not cause you any prejudice, but even then the requirement of fairness means we will take reasonable steps to tell you what we are doing. 
All our application forms and requests for information explain why we require the information. They explain how and for what other lawful purposes your information may be used which do not require your explicit consent.  When the Council collects personal data it should say how this data may be used and kept.  This information is what we call a Fair Processing Disclaimer.  In some cases you may be given the option of opting in or out of the Council purposing information for other purposes – where this is the case this will be explained on the Fair Processing Disclaimer.
 
 

How do you ask to see information about you?

 
You must write to the Council, we recommend that you use the Subject Access Request form (264kb DOC)Link opens in a new window  to help us identify the information you wish to obtain.
 
Completed forms can be emailed to foi@cardiff.gov.uk or sent to:
 
The Data Protection Officer
Improvement and Information 
County Hall
Atlantic Wharf
Cardiff
CF10 4UW
 
When asking to see your records tell us as much as possible about the information you require.  You will need to provide your name and address, date of birth, details of the service(s) you are receiving and any other information (e.g. rent or Council tax number) that could help the Council find your information. 
 
If you call at any of the Council’s offices, you will be given a copy of the ‘Subject Access Request Form’.  Help is available with filling in this form should you need it.  The request form will also be sent to you if you have not provided the Council with enough detail and we will ask that you fill this in to help identify where we may hold your information.
 

Making a request for disclosure of CCTV Footage

 
If you would like to make a request for CCTV footage you will need to complete the Request for CCTV Footage form.
 
Information requested is provided to you at the discretion of the City of Cardiff Council in line with our statutory requirements under the Data Protection Act.
 
 
 

 

Do you have to pay to see your information?

 
Under the Data Protection Act 1998 Act a £10 fee is payable. 
 
Once you have been issued with an Information Request Reference number, please use our secure online payment system to make a payment to the council.
 
The reference number will start with IR.
 
 
Alternatively you can send a cheque made payable to The City of Cardiff Council, to the address below.
 
The Data Protection Officer
Improvement and Information 
County Hall
Atlantic Wharf
Cardiff
CF10 4UW
 
The information cannot be provided until the fee has been paid and the 40 days response time commences from date of receipt of the fee.
In the case of a request for an educational record, a fee up to a maximum of £50, depending on the number of pages, may be required.  
Information may be exempt from disclosure under the Data Protection Act 1998, so please be aware that paying this fee does not guarantee that any information that we may hold will be released.
 
 
 
 

How do we know that you are the person referred to in the Subject Access Request?

 
Before any information which may be held can be released we require proof of an individual’s identity therefore you need to provide us with:
 
  • A clear copy of a recent bank statement, or a utility bill, (within the last three months), and
  • A clear certified copy of valid Photographic ID - i.e. Passport, Drivers Licence
  •  
 

Can somebody make a request for information on my behalf?

 
If you would prefer for somebody else to act on your behalf then we are happy to process this request, however we require a signed Subject Access Request Consent Form as well as ID for both yourself and the person acting on your behalf.
 
If you have a legal authority such as Power of Attorney we will require proof of this authority before being able to deal with the request.
 
However if you are a solicitor/insurance company acting on behalf of a client please complete the  Subject Access – Representing Another Form and follow the instructions outlined on the form. 
 
 
 

What information will you receive?

 
Unless we are entitled to withhold it, you will receive all of the information you have requested which the Council holds about you on both its computer and manual records.  We will also provide a description of the purposes for which we process your data together with a list of others to whom it is disclosed and information about sources.
 
 

What information may be withheld?

 
In some very rare circumstances the Council may not be able to comply with your request in full as there are exemptions within the act. If this is the case you will be given a full explanation.
 
You should also be aware that some types of information we hold, which may identify you, may not be covered by the act. For example, if you lodge an objection to a planning application, although we may have your name and address on the objection, this is not necessarily 'personal data' as the objection is about the planning application, not about you.
 
Although in principle you are entitled to have access to all the personal data held on you there are a few exceptions. In particular personal data may be withheld if:
 
  • It might prejudice the prevention and detection of crime, the prosecution or apprehension of offenders or the assessment or collection of any tax or duty to provide a copy
  • The data could identify other people who have not consented to the disclosure of their data and where, on balance, it appears wrong to provide it
  • The disclosure of the data might cause harm or distress to you or another individual
  • The data consists of information between client and legal adviser (legal professional privilege)
  •  
 

How will you be given the information?

 
You will be given a copy to keep and check for accuracy.  This will either be a printout from the computer or a photocopy of your manual records.
 
 

What do you do if the information is incorrect?

 
You must write to the Council telling us what information is incorrect and asking for it to be corrected.   The Council must tell you what it has done within 21 days of receiving your request.  If the Council does not agree that the information is incorrect you can ask us to record your disagreement on your records.   You can also appeal to the Information Commissioner or the Courts if the Council does not correct the information.
 
 

What do you do if you think you have not been given all of the information you asked for?

 
There is no right to an internal review to the Council under the Data Protection Act therefore if you remain unhappy and believe that the Council has not disclosed all information held relating to you should appeal to the Information Commissioner.  The Commissioner’s staff will look into the matter on your behalf.
 
 

How can you prevent the Council from using information about you for Direct Marketing or stop it from using information for a purpose which could cause you damage or distress?

 
The Council must ensure it complies with the Privacy and Electronic Communications Regulations 2003.  You should write to the Council asking it not to process your information for direct marketing purposes.  If you think that the use could cause you damage or distress you must also write to the Council providing a valid Section 10 notice giving your reasons for asking us to stop the processing.
The Council will tell you and ask you to write if you have any objections.  If you do object the Council will make a new decision but this time will not do so by automated means.
 
 

What can you claim compensation for? 

 
If the Council has broken any of the rules or conditions established by the Data Protection Act and you have suffered damage or distress you may be able to claim compensation.  You may also be able to claim compensation if the damage or distress was caused by our use of inaccurate data.
 
 

How do you make a claim for compensation?

 
Claims are made through the Courts which will only support these if you can show that the Council had not taken reasonable care to ensure it complied with the Act and in the case of the use of inaccurate data it is satisfied that you have suffered damage as a result of our use of such data.
 
 

Does the Council provide help in understanding the information?

 
Yes, if you need help with the information provided or the application form, please let us know and someone will to assist you.   A translation service is also available.