Data protection law grants the following rights to individuals regarding the processing of their personal data:
The right to be informed
The right for individuals to be informed about the collection and use of their personal data. This information is available on our Privacy Notice webpage.
The right of access
The right for individuals to have access to their personal data. Details about our procedure for handling access requests can be found on our Accessing health records and personal information webpage.
The right of rectification
The right for individuals to have inaccurate personal data rectified or completed if it is incomplete. Requests for rectification of data can in certain circumstances be refused for example if the request is manifestly unfounded or excessive.
The right of erasure
The right for individuals to have personal data erased; this is not an absolute right and only applies in certain circumstances. The right does not apply if the processing is necessary for public health purposes or for the purposes of preventative or occupational medicine.
The right to restrict processing
The right for individuals to request the restriction or suppression of their personal data; is not an absolute right and only applies in certain circumstances. For example, this right applies where the individual contests the accuracy.
The right of data portability
This right allows individuals to obtain and reuse their personal data for their own purposes across different services. This right only applies to the information an individual has provided to the data controller (organisation processing the data).
The right to object
The right for individuals to object to:
- processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority
- processing for direct marketing purposes
- processing for purposes of scientific/historical research and statistics.
Automated decision making
This right allows individuals to challenge a decision based solely on automated decision-making and to request human intervention.
Making a Data Processing Request
Requests can be made verbally or in writing and should be made to Information Governance
Fees & timescales
No charges apply unless the request is manifestly unfounded or excessive; the hospital may charge a reasonable fee to cover administrative costs for handling such requests.
Requests will be processed as soon as possible, and a response will be issued within one month from the date of receipt unless the request is complex or manifestly unfounded or excessive.
Where requests are refused, we will explain the reasons. If you are unhappy with the decision, you have the right under the Regulation to lodge a complaint with a supervisory authority, for the UK this is the Information Commissioner’s Office, contact details are below:
