The UK General Data Protection Regulation (UK GDPR) gives people the right to know what personal information Hart District Council holds about them. Access to non-personal information is managed under the Freedom of Information Act. For information about Freedom of Information requests and to make a request please visit our Freedom of Information webpage.
A request for personal information under UK GDPR can be made verbally or in writing. This is known as a subject access request. We do not charge for providing your information to you. In order to make a subject access request you will need to provide the following information:
- your name
- your address
- proof of identity
- enough information to identify your records
You will also need to tell us what kind of information you are requesting to enable us to locate the information.
Once you have made a request you will receive an acknowledgement and your request should be answered within one month. Please be aware that in certain circumstances, this may take longer. For more details about what you can expect from us, see the Information Commissioner's website.
If you would like to make a request, please contact us by email to data.protection@hart.gov.uk or in writing to:
Data Protection Officer
Hart District Council
Harlington Way
Fleet
Hampshire
GU51 4AE
Proof of identity
When we receive a request for information, we must make sure you are who you say you are by confirming:
You must visit the Council offices in person with your proof of identify and show this to the relevant Council Officer for verification.
The following documents can be accepted to verify your identity. We require two forms of identification (ID. You must provide at least one form of ID from each group below:
Group 1
- Current UK or EEA passport
- UK photocard driving licence (full or provisional)
- Full UK paper driving licence
- UK Birth Certification issued within 12 months of date of birth
Group 2
- Utility bill for supply of gas, electric, water or telephone landline*
- Financial statement issued by bank, building society or credit card company*
- P45 or P60 Statement
- Credit Card Statement
- Council Tax Bill
* These documents must be less than three months old.
We will accept copies of these documents, but only if they are certified.
Acting on behalf of someone else
Where data protection requests are made on behalf of adults, the Council needs to check that the person making the request has appropriate authority and that the request is made in the data subject’s interest.
Children have the right to request their own information themselves. People with parental responsibility can apply on their child's behalf where the child is too young to understand. Where a child cannot understand, which usually means they are under the age of 12, the Council must be satisfied that the request is being made in the child's interest. There may be occasions when we decide not to give information to a parent or when we may ask a child to make a request on their own behalf.
What the Council does to provide information
Hart District Council is required to comply with your request within 1 month of receiving proof of identity (the time limit can be paused if clarification is asked for).
We must tell you whether we hold the information requested and, if we do, should provide you with purposes of processing, the categories of personal data being processed, the recipients or categories of recipient, the retention period, the lawful basis for processing, the source of data, whether automated decision-making is used or not and the safeguards provided where personal data is transferred to a third country (if applicable).
We should give you a copy of the information, but there may be occasions when you agree to visit us to view the information instead.
We are obliged to check whether any of the information is exempt as defined in the UK GDPR and cannot be provided after all.
The main exemption we must consider relates to other people’s rights under data protection. If your information contains details about other individuals, we must consider whether it would be lawful and fair to them to disclose it. We would normally seek their consent before making our decision.
Other exemptions we must consider relate to national security and defence, crime, taxation, prejudice of regulatory activity, legal professional privilege, the social work records exemption and health and education work records exemption.
