Personal information is information about an identifiable living person, a ‘data subject’. NCAS’ Privacy Notice sets out how we collect, use and share personal information. NCAS/NHS LA’ s notification can be found in the Data Protection Public Register.
Under the DPA, a data controller is required to comply with eight principles in its processing of personal information. In summary, you can expect us to ensure that your personal information is:
1. processed fairly and lawfully
2. obtained for specific and lawful purposes
3. adequate, relevant and not excessive for those purposes
4. accurate and, where necessary, kept up to date
5. not kept for longer than is necessary
6. processed in accordance with your rights as a data subject (please see below)
7. kept secure
8. not transferred abroad unless to a country with adequate data protection laws.
The rights of a data subject are:
-
a right of access to a copy of the information comprised in their personal information;
-
a right to object to processing that is likely to cause or is causing damage or distress;
-
a right to prevent processing for direct marketing;
-
a right to object to decisions being taken by automated means;
-
a right in certain circumstances to have inaccurate personal information rectified, blocked, erased or destroyed; and
-
a right to claim compensation for damages caused by a breach of the Act.
If you wish to seek access to personal information about you held by us, please see making a subject access request. If you wish to exercise any of the other rights, please contact the information access team.
The Information Commissioner’s Office website contains further information on the DPA.
