Data Protection - your rights

You have the right to be informed about the collection and use of your personal data. We will provide you with information about the purposes for processing your personal data, the retention periods, and who it will be shared with.

More information about privacy notices, how we handle your data and to see the ones we publish can be found on our privacy statement page.

You have the right to access your personal data and this is generally referred to as subject access or subject access request (SAR).

You can make a subject access request verbally or in writing, but it is helpful if you follow our process as this ensures we have all the correct details and provide you with a copy of the personal data you wish to see.

You are only entitled to your own personal data, and not to information relating to other people (unless the information is also about you or you are acting on behalf of someone such as your child, or you have legal responsibility to act on their behalf).

More information on making a subject access request can be found on the Subject Access request webpage.

You have a right to have inaccurate personal data rectified, or completed if it is incomplete. In certain circumstances we may refuse a request for rectification but we will explain this to you.

You can make a request for rectification verbally or in writing but it would be helpful if you made the request in writing to ensure that we do not make the wrong corrections and we can check all spelling is correct.

We will respond to this request within one calendar month.

The right to erasure, more commonly referred to as the ‘right to be forgotten’, is not absolute and only applies in certain circumstances. If we do agree to erase your personal data, we will have to tell anyone that we have shared your data with. The right to erasure does not apply if our processing of your personal data is necessary for one of the following reasons:

• To exercise the right of freedom of expression and information
• To comply with a legal obligation
• For the performance of a task carried out in the public interest or in the exercise of official authority
• For archiving purposes in the public interest, scientific research historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing
• For the establishment, exercise or defence of legal claims

Where we process your personal data for public health reasons, occupational health, or for health & social care purposes, we may not be able to erase the data if it is being processed by a designated health professional.

Please note that in many instances, BCH will be processing your data for the performance of a “public task” and will not be able to erase your details. BCH must act upon any request within one calendar month of receipt.

You have the right to request the restriction of your personal data in certain circumstances and where you have a particular reason for wanting the restriction. This may be because you have issues with the content of the information that BCH holds or how we have processed your data.

In most cases we will not be required to restrict your personal data indefinitely, but we will need to have the restriction in place for a certain period of time. When processing is restricted, we are permitted to store the personal data, but not use it.

You can request restriction of processing in the following circumstances:

• You contest the accuracy of your personal data and BCH is verifying the accuracy of the data
• The data has been unlawfully processed (i.e. in breach of the lawfulness requirement of the first principle of the GDPR) and the individual opposes erasure and requests restriction instead
• We no longer need the personal data but you need us to keep it in order to establish, exercise or defend a legal claim; or
• You have objected to BCH processing your data and we are now considering whether our legitimate grounds override those of you as an individual.

As with the other rights, we will respond to your request within one calendar month.

The right to data portability gives you the right to receive personal data you have provided to BCH, in a structured, commonly used and machine readable format. It also gives you the right to request that BCH transmits this data directly to another organisation.

Data portability allows you to obtain and reuse your personal data for your own purposes across different services.

However, this right only applies to information you have provided to us with your consent or for the performance of a contract; and where BCH is carrying out the processing by automated means (i.e. not paper files).

The right to object to the processing of your personal data effectively allows you to ask us to stop processing your personal data.

This right only applies in certain circumstances and whether it applies depends on what we are processing your data for.

You have the absolute right to object to the processing of your personal data if it is for direct marketing purposes. If we are processing data for scientific or historical research, or statistical purposes, the right to object is more limited.

If we are unable to comply with your right to object we will tell you.

We are required to respond to an objection within one calendar month.