Your rights – HR

There are two ways in which we can obtain personal information:

• we collect it from you directly
• we obtain it from a third party such as a referee

We collect it from you directly

At the time we obtain the personal information, we must provide you with information in our privacy notice.

We do not obtain it from you directly

We must provide you with the information in our privacy notice:

• • within a month of obtaining the personal data
  • on our first contact with you
  • if we think we will disclose to another recipient when the personal information is first disclosed, unless
  • you have already been provided with the privacy notice information as above.

You have a right to access your personal data information in our privacy notice.

You have the right to obtain:

• confirmation that your personal data is being processed
• access to that personal data
• information provided in the privacy notice

You have the right to have inaccurate or incomplete personal data concerning yourself amended.

We must also tell you about the third parties to whom the data has been disclosed.

If we have disclosed the personal information in question to others, we must contact those recipients and inform them of the amendments. Unless, this proves impossible or involves a disproportionate effort. If you ask us we must also inform you about those recipients.

This right enables an individual to request deletion or removal of personal data where there is no compelling reason for its continued processing.

The right to erasure does not provide an absolute ‘right to be forgotten’. You have a right to have personal data erased and to prevent processing in specific circumstances:

• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
• When you withdraw consent
• When you object to the processing and there is no overriding legitimate interest for continuing the processing
• The personal information was unlawfully processed
• The personal information has to be erased in order to comply with a legal obligation

If we have disclosed personal information to others we must contact those third parties and inform them of the erasure, unless that proves impossible or involves disproportionate effort. If you ask us we must also inform you about those recipients.

You have the right to restrict the processing of your personal information. We can continue to store the personal information but not to process it further.

We can retain enough information about you to ensure that the restriction is respected in future.

We are required to restrict processing of personal information in the following circumstances:

• You dispute the accuracy of the personal information we hold, while we verify its accuracy
• You object to our processing while we consider if our legitimate grounds for processing override your right to object
• If we no longer need the personal data but you require the data to begin, complete or defend a legal claim.

If the personal information has been disclosed to a third party, we must inform them about the restriction unless it is impossible or involves disproportionate effort to do so. If you ask us we must also inform you about those recipients.

We must inform you when we decide to lift a restriction on processing.

The right to data portability only applies:

• to personal data an individual has provided to us
• where the processing is based on the individual’s consent for the performance of a contract and
• when the processing is carried out by automated means.

This right does not apply to us as processing is not carried out by automated means.

You have a right to object to our processing of your personal information on grounds relating to your ‘particular situation’. We must comply with your objection and stop processing personal information unless

• we have compelling grounds for processing which override your rights and freedoms, or
• the processing is to begin, complete or defend a legal claim.

You can request that we provide information on how we process personal data and how you can exercise your rights.

The information may be provided in writing or by other means including by electronic means.

If you request the information orally we will verify your identity first or may seek additional information from you to verify your identity.

If you make requests in relation to the rights which apply to us, we must provide the information within one month of receipt of your request.

This may be extended by two months taking into account the complexity and number of requests.

We will inform you of any such extension together with the reasons within one month of receipt of your request.

We will inform you within one month of the date of receipt of your request together with the reasons for not taking action.

You may complain to the Information Commissioner and seek a judicial remedy.

No. We must provide the information or any communications and actions taken free of charge.

If requests made are clearly unfounded or excessive (for example, because they are repetitive), we may either:

• charge a reasonable fee taking account of the administrative costs of providing information, communications or taking the action requested or
• refuse to act on the request.

We must evidence that the request is clearly unfounded or excessive.

Requests can be submitted to:

Data Protection Officer
Housing Ombudsman Service
PO Box 1484
Unit D
Preston
PR2 0ET

Telephone: 0300 111 3000

Calls to and from the 0300 111 3000 number are recorded for training and quality monitoring purposes.

Lines are open Monday to Friday from 9:15am to 5:15pm (except public holidays).

Email: dpo@housing-ombudsman.org.uk

If you have a complaint about how we have handled your personal data or dealt with your request under the Data Protection Act 2018, you can lodge a complaint with the Information Commissioner:

Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 01625545700

www.ico.org.uk