Subject Rights Request Policy

4.1.1 Subject Access Requests (SAR’s)

• If a SAR is requested as a FOI we will contact the individual to confirm that we are dealing with this as a SAR and clarify the time limit for responding (FOI requests have a 20 working day limit);
• We will provide the information free of charge (please also see point 4.2 below for circumstances where we may charge a fee);
• We will make any reasonable adjustments required for disabled people and respond in a format that is accessible to that person, i.e. braille, large print, audio formats;
• We may delete names or edit documents if they include third party information;
• We may tell the individual we will comply within 3 months of receipt of the request, where a request is complex or numerous. We will inform the individual of this within 1 month, and explain why the extension is necessary.

• Might cause serious harm to the physical or mental health of the data subject or another individual
• Would reveal that the data subject is at risk of abuse, where the disclosure of that information would not be in the data subject’s best interests;
• Is given to a court in proceedings concerning the data subject.
• Supplying information to the requester
• When responding to a request we will:
• Confirm whether any personal data is being processed – e.g. if we hold no personal data about the requester, we will still respond to let them know this;
• Follow Plymouth Active Leisure’s Subject Access Request Procedures that ensures we meet our obligations and maintain the security of personal information during the process of gathering information requested.

4.1.2 Rectification

• We will take reasonable steps to satisfy ourselves that the data is accurate.
• We will take into consideration whether information is incorrect or misleading.
• We will restrict the use of the information disputed whilst we are verifying its accuracy.
• We may decide that the information is not inaccurate, for example where this is the opinion of a person.
• If we are satisfied that the data is accurate we will let the individual know and tell them that we will not be amending the data and explain why.
• Where information has since been corrected but there is a need for the incorrected information to be retained we will let the individual know and explain why.

4.1.3 Erasure

• We will erase personal data if:
  • the data is no longer necessary for the purpose which we originally collected or processed it for;
  • We are relying on consent as our lawful basis for holding the data and the individual withdraws consent;
  • We are relying on legitimate interests as our basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing;
  • We are processing the personal data for direct marketing purposes and the individual objects to that processing;
  • We have processed the personal data unlawfully (i.e. in breach of the lawfulness requirement of the 1st principle);
  • We have to do it to comply with a legal obligation; or
• If we have shared personal data that we have agreed to erase we will tell the other organisation.
• If the personal data has been made public in an online environment we will ensure that it is removed from these platforms.
• We may not be able to comply with a request for erasure where rights do not apply, for example where personal data is being processed to comply with a legal obligation, or where an exemption applies.
• If we decide that we cannot erase personal data we will let the individual know and explain why.

4.1.4 Restriction or suppression

• We will restrict the processing of personal data if:
  • The individual contests the accuracy of their personal data and we are verifying the accuracy of the data;
  • The data has been unlawfully processed (i.e. in breach of the lawfulness requirement of the first principle of the GDPR) and the individual opposes erasure and requests restriction instead;
  • We no longer need the personal data but the individual needs us to keep it in order to establish, exercise or defend a legal claim; or
  • The individual has objected to us processing their data under Article 21(1), and we are considering whether our legitimate grounds override those of the individual.
• If we restrict personal data we may store the personal data but will not use it unless:
  • We have the individual’s consent;
  • It is for the establishment, exercise or defence of legal claims;
  • It is for the protection of the rights of another person (natural or legal); or
  • It is for reasons of important public interest.
• If we have disclosed the personal data that we have agreed to restrict to others we will notify the other organisations.
• We may lift the restriction, for example if we make a decision on the accuracy of personal data or whether our legitimate grounds override those of the individual.
• If we do decide to lift the restriction we will inform the individual before we do this. We will inform them of the reasons and of their right to make a complaint to the ICO or another supervisory authority and their ability to seek a judicial remedy.

4.1.5 Data Portability

• Where we are the data controller for personal data we will:
  • Directly transmit requested data to the individual; or
  • Provide access to an automated tool that allows the individual to extract the requested data themselves;
  • We will ensure any transfer of data is secure;
  • We will provide data in a structured, commonly used and machine readable format, i.e. CSV files.
• If we provide information directly to an individual or to another organisation in response to a data portability request, we are not responsible for any subsequent processing carried out by the individual or the other organisation.
• If we have legitimate reasons why we cannot undertake a transmission, for example if this would adversely affect the rights and freedoms of others, we will inform the individual and explain what the legitimate reasons are.

4.1.6 Object

• An individual has an absolute right to object to personal data being processed for direct marketing purposes and a right to object to processing for:
  • A task carried out in the public interest;
  • The exercise of official authority vested in us; or
  • Our legitimate interests (or those of a third party).

4.1.7 Automated decision making including profiling

• We do not use any automated decision making processes or profiling.

4.2 If the subject rights request is unfounded or excessive:

• We may refuse to act on it, or charge a reasonable fee which takes into account administrative costs.
• A request will be deemed to be unfounded or excessive if it is repetitive, or asks for further copies of the same information.
• When we refuse a request, we will tell the individual why, and tell them they have the right to complain to the ICO.