Subject Access Request Policy

This document sets out Island Advice Centre’s policy in dealing with a subject access request.

A subject access request is a written request for personal information (known as personal data) held about you by Island Advice Centre’s policy. Generally, you have the right to see what personal information we hold about you. You may make a request by emailing us at admin@island-advice.org.uk or writing to us, stating that you are making a ‘Subject Access Request’ and letting us know how to contact you and how you wish to receive the information.

The GDPR gives individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly. However, this right is subject to certain exemptions that are set out in the GDPR.

The GDPR works in two ways.

Firstly, it states that anyone who processes personal data must comply with eight principles, which make sure that personal data is:

Fairly and lawfully processed
Processed for specific and lawful purposes
Adequate, relevant, and not excessive
Accurate and up to date
Not kept for longer than is necessary
Processed in line with the individuals’ rights
Secure
Not transferred to other countries without adequate protection

Secondly, it provides individuals with important rights, including the right to find out what personal data is held on computer and most paper records.

Personal data will cover basic details and will include details such as name, address, telephone number, attendance at events, medical and consent information and information held about that person in files, etc.

When we receive a subject access request, we will first check that we have enough information to be sure of your identity. Often, we will have no reason to doubt a person’s identity, for example, if we have regularly corresponded with you.

However, if we have good cause to doubt your identity we can ask you to provide any evidence we reasonably need to confirm your identity.

We will gather any manual or electronically held information (including emails) and identify any information provided by a third party or which identifies a third party.

If we have identified information that relates to third parties, we will write to them asking whether there is any reason this information should not be disclosed. We do not have to supply the information to you unless the other party has provided their consent, or it is reasonable to do so without their consent. If the third-party objects to the information being disclosed, we may seek legal advice on what we should do.

We have 30 calendar days starting from when we have received all the information necessary to identify you, to identify the information requested, to provide you with the information or to provide an explanation about why we are unable to provide the information. In many cases, it will be possible to respond in advance of the 30-calendar day target, and we will aim to do so where possible. Copies of the information will be sent to you in electronic form or permanent form, depending on your preference and our ability to extract it.

The GDPR contains a number of exemptions to our duty to disclose personal data, and we may seek legal advice if we consider that they might apply. An example of an exemption is information which is subject to ongoing criminal investigation.

If we agree that the information is inaccurate, we will correct it and where practicable, destroy the inaccurate information. If we do not agree or feel unable to decide whether the information is inaccurate, we will make a note of the alleged error and keep this on file.

If you are not satisfied by our actions, you can seek recourse through our internal complaints procedure. If you remain dissatisfied, you have the right to refer the matter to the Information Commissioner. The Information Commissioner can be contacted at:

Information Commissioner Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 01625 545745 Fax: 01625 524510

Email: enquiries@ico.gsi.gov.uk

Island Advice Centre Privacy Policy

Island Advice Centre is committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection. We have always had a robust and effective data protection program in place which complies with existing law and abides by the data protection principles. However, we recognise our obligations in updating and expanding this program to meet the demands of the General Data Protection Regulations and the UK’s Data Protection Act 2018. We are dedicated to safeguarding the personal information under our remit and in developing a data protection regime that is effective, fit for purpose and demonstrates an understanding of, and appreciation for the new Regulation.

When you access our services, we will collect and use your personal information in order to help solve your problems, improve our services, and campaign for wider issues in society that affect people’s lives. We will only access your information when we have good reason to do so, will only share what is necessary and relevant, and will not sell it to anyone else.

What is personal data and what do we need it for?

Personal data includes any information about you that can be used to identify you, including your name and address, date of birth, work, family, financial and health.

We need to collect this information in order to

Keep in touch with you about your case
Give you advice and carry out casework on your behalf
Keep statistics about the kind of people that access our services so that we can ensure that they are open to everyone
Report to our funders about how many people we have seen and what their circumstances are – this will be anonymised
To deal with complaints
To refer you to other agencies who can better advise or help you if we are unable to do so.

Consent

Some information will only be collected with your explicit consent – this includes information about your gender, ethnicity, marital status or sexual orientation. With your consent, we will also collect and store your data in order to evaluate and improve our services:

Get feedback from you about your experience of our services
Improve our training and other resources

We will normally only share your data with third parties with your written consent and only for the purpose of progressing your advice or case, except in certain exceptional cases for example where we suspect that someone may be at risk of serious harm we have a legal duty to disclose this to police or social services.

We will also ask your consent to allow your file to be looked at by an external reviewer for the purpose of maintaining the quality of our advice; these will always be carried out by someone we trust, who has signed a confidentiality agreement with us.

As an organisation, we are committed to achieving the best possible outcome for our clients. We strive to maintain the highest possible levels of quality across our service delivery and as such, may seek external endorsement on the quality of our work through achievement of publicly recognised quality standards. As part of this external assessment, we are required to make a sample of client files available to an independent Assessor in order for them to verify the quality of our advice and file management. External Assessors are required to maintain confidentiality in relation to your file, and it is important to note that they are assessing us as an organisation and not you as an individual. If you preferred that your file did not form part of this process, please let your adviser know so that this can be recorded on your file.

With your consent, we may also contact you from time to time in order to ask for feedback about the service you received from us.

How do we store your information?

Whether you get advice face to face, over the phone or by email, our adviser will log all your information, correspondence, and notes about your problem into our secure case management system AdvicePro. Information will only be uploaded when a consent form is signed or legitimate interest is established. All data is held within the UK on servers based in Dundee and Aberdeen. All storage is secure, and their hosting provider has GDPR procedures in place. Advice Pro has a notification process in place for any breach and provides appropriate tools to allow all customers to properly enact the right to erasure process. Their full privacy policy is available to read on the below link.
https://www.advicepro.org.uk/privacy-policy/

If you have seen our adviser at a GP surgery session, the data and case notes are stored on a different case management system called Salesforce. Salesforce limits exposure of data to its users and implements appropriate security controls. Information is again put on when a consent form is signed or when legitimate interest is established. Their full privacy policy is available to read on
https://www.salesforce.com/uk/gdpr/platform/

Other information may be held on our IT systems stored in our secure server or on emails stored by Microsoft Office 365. Paper records of your case may be kept in locked offices or filing cabinets and securely shredded once they have been uploaded to one of our case management systems.

We will keep your information for 6 years after which time it will be deleted. We keep data for this length of time in case it is subject to a complaint or insurance claim.

More information about how we manage your data

Our data controller is Suna Mala who can be contacted on admin@island-advice.org.uk. For further information, please ask to see our Data Protection Policy.

By clicking continue, you are acknowledging that you have read and understood our privacy policy.

Continue

Subject Access Request Policy

About Us

Volunteering Opportunities

Contact Us

Our Policies

Subject Access Request Policy

Subject Access Request Policy

Island Advice Centre Privacy Policy

What is personal data and what do we need it for?

Consent

How do we store your information?

More information about how we manage your data

Accessibility

Browsers

Changing browser settings to suit you :-

Internet Explorer

Font size and colour

Enlarging text

To prevent graphics from appearing on web pages:

To change the text and background colours:

Other Changes

Cookie Policy of island-advice.org.uk

Technical Cookies and Cookies serving aggregated statistical purposes

Activity strictly necessary for the functioning of the Service

Activity regarding the saving of preferences, optimization, and statistics

Other types of Cookies or third parties that install Cookies

Analytics

Analytics collected directly (This Application)

Google Analytics (Alphabet Inc.)

Content Commenting

Disqus (Disqus)

Interaction with external social networks and platforms

Google+ +1 button and social widgets (Google Inc.)

Facebook Like button and social widgets (Facebook, Inc.)

LinkedIn button and social widgets (LinkedIn Corporation)

Twitter Tweet button and social widgets (Twitter, Inc.)

SPAM protection

Google reCAPTCHA (Google Inc.)

How to provide or withdraw consent to the installation of Cookies

Owner and Data Controller

Definitions and legal references

Personal Data (or Data)

Usage Data

User

Data Subject

Data Processor (or Data Supervisor)

Data Controller (or Owner)

This Application

Service

European Union (or EU)

Cookies

Legal information

Subject Access Request Policy