For personal data being processed under GDPR the following rights are applicable to individuals in certain circumstances, as noted below.
The right to rectification
You shall have the right to obtain from the Police Service of Northern Ireland without undue delay the rectification of inaccurate or incomplete personal data concerning you. Also included in this right is to have a supplementary statement added to your personal information.
The right to erasure
In certain instances individuals can ask that their personal data is erased. Those which may be relevant to the Police Service of Northern Ireland are noted below:
- When personal data is no longer necessary for the original purpose.
- Consent is withdrawn and there is no other basis for processing.
- The data subject objects under “Right to Object” and there is no overriding legitimate interest.
- Personal data has been unlawfully processed.
- The data needs to be erased to comply with a legal obligation.
Any deletion of personal data by the Police Service of Northern Ireland will be carefully considered. Where there is an underlying business requirement we may reject this request and continue to process the data for the following reasons:
- A legal obligation
- A task carried out in the public interest/exercise of official authority
- The establishment, exercise or defence of legal rights
- Archiving purposes.
The right to restrict processing
Where it is claimed that data is inaccurate or the “Right to Object” has been exercised individuals can require the Police Service of Northern Ireland to restrict processing until verification checks have been completed. Individuals may also require us to restrict processing where there is no legal basis (unlawful) however you oppose erasure, or if it is only needed for legal claims.
In certain circumstances, you shall have the right to obtain from the Police Service of Northern Ireland restriction of processing. “Restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future. Where it has been restricted, processing other than storage should only occur for a number of specific reasons, namely – your consent, legal claims of yourself, to protect rights of others or in the public interest.
The right to data portability
The right to data portability allows individuals to obtain and reuse, for free, their personal data for their own purposes across different services. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability. The personal data must be provided in a structured, commonly used and machine readable form.
The right to portability does not apply to all data. The data must have been obtained through consent or contract and the processing of such needs to be automated. Data applicable to this right must have been knowingly and actively provided by you, the individual.
This right will not apply to the data if processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Police Service of Northern Ireland.
The right to object
Objection on grounds relating to your own situation
Individuals have the right to object to the Police Service of Northern Ireland processing their personal data where processing is necessary for the performance of a tasked carried out in the public interest or in the exercise of official authority vested in us, or when processing is based on legitimate interests.
To continue processing, we have to be able to demonstrate compelling legitimate grounds, which override the interests, rights and freedoms of the data subject. Or it must be necessary for the establishment, exercise or defence of legal claims.
Rights in relation to automated decision making and profiling
The GDPR gives individuals the right to object to decisions made about them solely on the basis of automated processing, where those decisions have legal or other significant effects. This includes processing where there is no human intervention. Where a significant decision has been taken based solely on automated processing we must, as soon as practicable, advise data subject with regards to this.
Whilst we rarely use these technical features, we do have in place provisions which allow us to safeguard our processes and ensure the possibility of human intervention if required.
Processing by these means can continue if it is:
- Necessary for entering into, or the performance of a contract between the Police Service of Northern Ireland and yourself
- Authorised by UK law
- Based on your explicit consent.