Individuals have various rights enshrined in the Data Protection legislation, these are detailed below. Further detail on these rights can be accessed within Articles 15 – 23 of the GDPR and Part 3 of the Data Protection Bill. The Police Service of Northern Ireland are permitted to ask data subjects to provide proof of their identity before giving effect to their rights. This ensures the security of your personal information. Requested information or responses to individuals requesting their rights are enacted should be provided, subject to exemptions, to the individual without undue delay and in any event within one month of receipt of the request and free of charge. Where a controller receives large numbers of requests from individuals, or they are especially complex, the time limit may be extended by a maximum of two further months. Requests deemed excessive or manifestly unfounded will not be processed. Individuals will be made aware of this extension and the reasons for delay explained. The Police Service of Northern Ireland will process any requests from individuals in relation to these rights; however, where the Police Service of Northern Ireland have a legitimate business purpose for processing this data, or an exemption applies, the Police Service of Northern Ireland does not have to give effect to the right. We will communicate this to you and highlight our reliance on the Data Protection legislation for this. By requesting your rights are enacted, the Police Service of Northern Ireland will be required to further process your personal information in order to keep a record of what amendments, if any, have been made and the justification for any decisions made. Where the Police Service of Northern Ireland need to enact the rights of rectification, erasure and restriction, we will do so as far as is reasonably practicable.
The Right to Access
Subject Access is the most commonly exercised right. Individuals can request a copy of their personal data and other information about how the Police Service of Northern Ireland processes your information. Where the Police Service of Northern Ireland withholds some or all of the requested information we will provide details, where possible, around the decision in line with Data Protection legislation.
The right to rectification
Individuals are entitled to have personal data rectified if it is inaccurate or incomplete. If the Police Service of Northern Ireland has disclosed the personal data in question to third parties; we must inform them of the rectification where possible. We will also inform the individuals about the third parties to whom the data has been disclosed, where appropriate. Where the Police Service of Northern Ireland is not taking action in response to a request for rectification, we will provide details around the decision.
The right to erasure
The right to erasure does not provide an absolute ‘right to be forgotten’. Individuals have a right to have personal data erased and to prevent processing in specific circumstances including, if consent is withdrawn, the data was processed unlawfully, compliance with legal obligation, and where processing if no longer necessary for the purpose it was originally collected.
There are some specific circumstances where the right to erasure does not apply and the Police Service of Northern Ireland can refuse to deal with a request including, if it is necessary to meet a legal obligation or defend a legal claim.
The right to restrict processing
In certain conditions individuals have a right to request the Police Service of Northern Ireland ‘block’ or suppress/restrict processing of personal data such as where individuals dispute the accuracy of their information or the processing is no longer needed.
Once processing is restricted, the Police Service of Northern Ireland is permitted to store the personal data, but not process it further except on limited grounds such as with individual’s consent or in relation to legal claims. If the Police Service of Northern Ireland has disclosed the personal data in question to third parties, we must inform them about the restriction on the processing of the personal data, unless it is impossible or involves disproportionate effort to do so.
The Police Service of Northern Ireland must inform individuals before any restriction is lifted.
As above, the Police Service of Northern Ireland may be required to restrict processing when an individual has contested the accuracy of data or has objected to the processing and these issues are being investigated. Or when the data subject has opposed erasure or requires the data to be retained in order to progress a legal claim.
The right to data portability
The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services, this includes individuals being provided with their data in a commonly used electronic format in order that it can then be easily transferred or ‘ported’ to another data controller as and when required (either by the individual themselves, or the Police Service of Northern Ireland). This right only applies to personal data which an individual has provided to the Police Service of Northern Ireland which is processed by automated means; by virtue of the individual’s consent or for the performance of a contract. The right to data portability does not extend to processing of personal information for law-enforcement processing.
The right to object
Individuals have the right to object to processing unless the Police Service of Northern Ireland can demonstrate explicitly how it is linked to the purposes described under paragraph 1 or the processing is for the establishment, exercise or defence of legal claims. Individuals have the right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling), and processing for purposes of scientific/historical research and statistics. The right to object does not extend to processing of personal information for law-enforcement processing.
Rights in relation to automated decision making and profiling
Although the Police Service of Northern Ireland is unlikely to carry out any automated decision-taking or automated profiling that does not involve some human element, an individual has the right to require that PSNI ensures that no decision that would significantly affect them is taken by the Police Service of Northern Irelandor on its behalf purely using automated decision making software.
Further details on all of the rights within Data Protection legislation can be found on the Information Commissioner’s Office website at www.ico.org.uk.