People have rights as to how their information is used. These are:
Individuals continue to have a right to be given fair processing information, usually through a privacy notice. Under the GDPR you will also have to explain the lawful basis for the processing of their data; your data retention periods and that individuals have a may complain to the ICO if they think that there is a problem in the way that you deal with their personal data.
The right to access. Any data subject has a right to access the data which a data controller holds about them, to satisfy themselves it is being processed lawfully. This is known as a Subject Access Request: it may be submitted verbally or in writing; data controllers have one calendar month to provide a copy of the data; and there is no fee for doing this.
The right to rectification means that individuals have the right to have their personal data corrected if it is inaccurate or incomplete. If the data has already been given to third parties, you must tell those third parties of the correction. You must also tell the individuals about the third parties to whom the data has been given.
The right to erasure gives people the right to request the removal of their personal data. Not only will parishes need to comply with such requests but they will also need to ensure that any third party with whom the data was shared also deletes the data. This does not mean that a person can immediately request that his/her personal data is deleted. If the purposes for which the data was collected still exist, then a person will not be able to request the deletion of that data, unless it was given by consent and they are withdrawing their consent. For instance, an employer needs an employee’s personal data in order to pay the employee, as per their contract of employment.
The right to restrict processing means that individuals may request their personal data can be stored but not used.
The right to data portability gives data subjects the right to request that their personal data be provided to them (or a third party) in a machine readable portable format free of charge. It is not likely to affect parishes.
The right to object provides that individuals have the right to object to data processing in certain circumstances, eg if a parish has relied on legitimate interest to process data without consent and an individual is not happy with this.
The right not to be subject to automated decision-making including profiling.
Jun 2023 – Reviewed and checked