Search Site

9. What are the rights of the individuals whose personal data is handled by West Mercia Police?

The GDPR provides certain rights for individuals however all of these rights do not apply when it comes to Law Enforcement processing and even then the applicable rights do not apply in all circumstances, there are exemptions and restrictions that can be legitimately applied to prevent individuals from exercising rights, see below:

The right to be informed - this area is covered by this privacy notice

The right of access - Also known as a Subject Access request.  The most commonly exercised right is that used by individuals to obtain a copy, subject to exemptions, of their personal data processed by West Mercia Police as detailed under Article 15 of the GDPR.  Details of the application process, known as 'Right of Access' can be found from the force internet at: https://www.westmercia.police.uk/roa

Alternatively individuals may contact West Mercia Police in person or via telephone to make the request, however the preferred method is via the application process.

Right of access do not apply to the processing of 'relevant personal data' [1], i.e. we can limit confirmation that we are processing data and access to personal data if it is necessary and proportionate in order to;

  • Avoid obstruction an official or legal inquiry, investigation or procedure;
  • Avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
  • Protect public security;
  • Protect national security; or
  • Protect the rights and freedoms of others.

Where a limitation is in place the individual must be given an explanation of the reasons, unless providing this information undermines the purpose of imposing the restriction.

The right to rectification - Under Article 16 of the GDPR, individuals have the right to have inaccurate or incomplete personal data rectified. West Mercia Police can refuse this request where it is necessary and proportionate or relates to 'relevant personal data', i.e. to avoid obstructing an official or legal inquiry, investigation or procedure, or to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, as detailed above.

The request must be processed within one month, or three months in complex cases. Where a request is refused the individual must be notified and where no action is taken individuals have the right to be informed of how to seek a judicial remedy.

The right to erasure - Under Article 17 of the GDPR, individuals have the right to have personal data erased and to prevent processing in specific circumstances:

  • Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed;
  • When the individual withdraws consent;
  • When the individual objects to the processing and there is no overriding legitimate interest for continuing with the processing;
  • When the personal data was unlawfully processed;
  • When the personal data has to be erased in order to comply with a legal obligation;
  • When the personal data is processed in relation to the offer of information society services to a child

West Mercia Police can refuse this request where it is necessary and proportionate or relates to 'relevant personal data', i.e. to avoid obstructing an official or legal inquiry, investigation or procedure or to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, as detailed above. The erasure of personal data relating to criminal offences cannot be considered until its full period of retention has been reached (as detailed in the National Retention and Disposal Schedule which has been adopted by West Mercia Police).

The right to restrict processing - Under Article 18 of the GDPR, individuals have the right to restrict the processing of personal data, for example, if an individual believes that the data is incorrect but it is not possible to confirm the accuracy of the data. West Mercia Police can refuse this request where it is necessary and proportionate or relates to 'relevant personal data', i.e. to avoid obstructing an official or legal inquiry, investigation or procedure or to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, as detailed above.

Where a request is receive the individual must be informed in writing as to whether you have granted the request; and if you have refused, the reasons why.

The right to data portability - not applicable to law enforcement processing

Under Article 20 of the GDPR, individuals have the right to data portability which allows individuals to obtain and reuse their personal data for their own purposes across different service. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way without hindrance to usability. The personal data must be provided in a structured, commonly used and machine readable form. The information must be provided free of charge.

The right to object - not applicable to law enforcement processing

Under Article 21 of the GDPR, individuals have the right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling), and processing for purposes of scientific research and statistics.

Rights in relation to automated decision making including profiling - Under Article 22 of the GDPR, individuals have the right to object to decisions made about them on the basis of automated processing including profiling, where those decisions have legal or other significant effects. This includes processing where there is no human intervention, for example where automated processes are used to sift recruitment applications.

An individual has the right to withdraw their consent - This does not apply to offenders or suspected offenders as the processing is necessary to perform a task within the public interest without their consent being given. This does apply to victims who have consented to their personal data being processed i.e. victim services, this consent can be withdrawn at any time by contacting Victim Support:

West.Mercia@victimsupport.org.uk

Telephone: 01905 726896

Individuals have the right to complain to the Information Commissioner's Office if they believe that they are/have been adversely affected by the handling of personal data by West Mercia Police. Such complaints should be made direct to the Information Commissioner:

Web: www.ico.org.uk

The Information Commissioner's Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Telephone: 0303 123 1113


[1] 'Relevant personal data' means personal data contained in a judicial decision or in other documents relating to the investigation or proceedings which are created by or on behalf of a court or other judicial authority.  Access to 'relevant personal data' is governed by the appropriate legislation covering the disclosure of information in criminal proceedings, such as (in England and Wales) the Criminal Procedure and Investigations Act 1996.