On this page
What is happening?
An individual has a number of digital rights available to them under the Data Protection Act 2018 that could be relied upon if you are concerned:
- That your personal data is being used unlawfully.
- There is an error in your personal data that needs to be corrected.
- That you object to or want to restrict processing, or erase your personal data.
- That you are being subjected to profiling or automated decision-making (decisions made by an algorithm).
What are my rights?
An individual has the right to confirm from a data controller (any organisation that may have your personal data, such as a local authority, an employer, a landlord, a Doctor, or a school) whether or not their personal data is being processed, and where it is being processed, access to the personal data and the following information:
Information you should receive
- Why they are processing your data and what types of personal data they are processing.
- How long they are going to store your personal data.
- Your other rights under the Data Protection Act 2018 – The right to request rectification, erasure, restriction of processing, or objection to processing of your personal data.
- Who you can make complaints to – The right to make a complaint with a supervisory authority.
- When they haven’t collected the personal data from you, who they got it from – Any available information as to their source.
- Whether there has been a decision made about you by an algorithm, and information about how that decision was made. – The existence of automated decision-making, including profiling, and, in some cases, meaningful information about the logic involved as well as the significance and the envisaged consequences for the data subject.
You have a right to receive a copy of your personal data that is being processed and the above information free of charge.
I’ve seen a mistake in data held about me
You have a right to obtain from the controller without undue delay the correction of inaccurate personal data they hold about you (Article 16 GDPR). You can do this by providing a statement to the data controller. The controller must communicate that correction to you, and to each of the other organisations that they have disclosed your data to, unless it proves impossible or involves disproportionate effort, and they should inform you who those organisations are if you request it.
I would like personal data erased
You have the right to request erasure (‘right to be forgotten’) (Article 17) if the data is no longer necessary for the purposes for which it was collected, or if the data controller are processing the data based on your consent, you remove that consent and there is no other legal ground for processing.
I would like to restrict or object to the processing of personal data
You have the right to restrict processing (prevent it being processed) (Article 18) if for example you argue the data is inaccurate and the data controller needs to check
You have a right to object to processing of personal data of personal data if it is being processed for specific reasons:
- A task in the public interest or exercise of official authority (lots of processing by public authorities will be done under this as they will process).
- It is necessary for the purposes of the legitimate interests pursued by the controller (this is not available for activities public tasks so is unlikely to )
If you do object it is for the data controller to show that there is a compelling reason to continue processing the data that overrides your fundamental rights and freedoms.
A decision about me has been made automatically
You have a right to not be subjected to a decision based solely on automated decision-making if it produces legal or similarly significant effects, unless specific conditions apply.
If the data controller is the Home Office, they should inform you that the restriction applies and all data controllers should tell you that you have a right to complain or appeal against the decision to restrict your data rights.
- The Information Commissioner’s Office is the regulator for data protection law in the United Kingdom and can receive individual complaints.
- Organisations like Open Rights Group, Foxglove and Privacy International are all seeking to support immigration organisations and will be happy to provide further support.
- Open Rights Group would be particularly interested to hear if you’re concerned that the Immigration Exemption is restricting your data rights.