This Privacy Notice is divided into three parts:

Part 2: your rights around personal data

Under the DPA, GDPR, Environmental Information Regulations 2004 and the Freedom of Information Act 2000, you have a number of information rights.

The rights under the DPA and the GDPR are similar but not identical. Those under the DPA apply where personal data is used by Kent Police for Law Enforcement Purposes, and those under the GDPR apply when it is used for General Purposes (see section 1 above).

The DPA and GDPR provide that in some circumstances your rights may be limited by Kent Police. These limitations are described at the end of the explanation of each right (below).

The Information Commissioner has produced detailed guidance on the rights, for where Kent Police processes your personal data for Law Enforcement Purposes, and for where Kent Police process your personal data for General Purposes.

Rights applications are free of charge.

Applications to these rights are administered by the Kent Police Public Disclosure Team (PDT). The team may be contacted as follows:

Public Disclosure team
Kent Police 
Coldharbour
London Road
Aylesford
Kent
ME20 7SL

The rights are described in more detail below, split into those that apply if your personal data is used in Law Enforcement Processing or General Processing. Contact details pertaining to exercising your rights are detailed in each section.

Rights under the DPA (Law Enforcement Processing):

DPA Right to be Informed
DPA Right of Access
DPA Right to Rectification
DPA Right to Erasure or Restriction of processing
DPA Rights relating to Automated Decision-Making
DPA Exercise of Rights through the Information Commissioner’s Office

Rights under the GDPR (General Processing):

GDPR Right to be Informed
GDPR Right of Access
GDPR Right to Rectification
GDPR Right to Erasure (‘Right to be Forgotten”) 
GDPR Right to Restriction of Processing
GDPR Right to Data Portability
GDPR Right to Object
GDPR Right not to be subject to Automated Decision-Making

 

DPA Right to be Informed

This right is set out at Section 44 of the DPA and applies where the processing of your personal data is for Law Enforcement Purposes.

It requires Kent Police to make the following information available to you, either by making it generally available to the public or in any other way:

  • The identity and contact details of the controller (Chief Constable of Kent Police)
  • The contact details for the Kent Police Data Protection Officer
  • The purpose(s) of the processing of your personal data
  • The existence of your rights of Access, Rectification and Erasure
  • The existence of your right to lodge a complaint with the Information Commissioner’s Officer and their contact details

This Privacy Notice is intended to meet those five obligations (above).

In addition, Kent Police are required in specific cases to give you the following to help you exercise your data protection rights under the DPA:

  • Information about our legal basis for processing your personal data
  • The retention period or criteria used to determine how long your personal data will be retained
  • Where applicable, information about the categories of recipients of your personal data, including overseas transfers
  • Any further information to enable you to exercise your data protection rights, particularly where your personal data is processed without your knowledge,

except where necessary to:

  • avoid obstructing an official or legal inquiry, investigation or procedure
  • avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties
  • protect public security
  • protect national security
  • protect the rights and freedoms of others

Where Kent Police has restricted this right because of any of the five circumstances listed immediately above Kent Police must write to you without undue delay and tell you:

  • That Kent Police have restricted the information to be provided to you
  • The reasons for that restriction
  • That you have a right under Section 51 of the DPA to make a request to the Information Commissioner’s Office
  • That you have a right to lodge a complaint with the Information Commissioner’s Office
  • That you have a right to apply to a court under Section 167 of the DPA

However, it is not necessary to inform you where Kent Police have restricted the information to be provided to you and the reasons for that restriction if, and to the extent that, doing so would undermine the purpose of the restriction.

Kent Police are obliged to keep records of the use of any restrictions and provide them to the Information Commissioner’s Office should they wish to see them.

DPA Right of Access

This right is set out at Section 45 of the DPA and applies where the processing of your personal data is for Law Enforcement Purposes.

You have the right to be given confirmation of whether or not your personal data is subject of law enforcement processing by Kent Police.

Where processing is occurring, you have a right of access to that information, be given a copy of it, and be provided with supplementary information associated with the processing within a statutory timescale of between one and three months.

The supplementary information you have a right to is:

  • the purpose and legal basis of the processing
  • the categories of personal data concerned
  • the recipients or categories of recipients to whom the personal data has been be disclosed, in particular recipients in third countries or international organisations
  • the envisaged period that your personal data will be stored, or, if not possible, the criteria used to determine that period
  • the existence of the rights to request from Kent Police the rectification and erasure of personal data
  • the existence of the right to lodge a complaint with the Information Commissioner’s Office and their contact details
  • communication of your personal data and of any available information as to its origin

Restrictions - the right of access can be limited by Kent Police in certain circumstances specifically, where necessary to:

  • avoid obstructing an official or legal inquiry, investigation or procedure
  • avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties
  • protect public security
  • protect national security
  • protect the rights and freedoms of others

When Kent Police have limited your right of access Kent Police must write to you without undue delay and tell you:

  • that Kent Police have restricted your right of access
  • the reasons for that restriction
  • that you have a right under Section 51 of the DPA to make a request to the Information Commissioner’s Office
  • that you have a right to lodge a complaint with the Information Commissioner’s Office
  • that you have a right to apply to a court under Section 165 of the DPA

However, it is not necessary to inform you where Kent Police have restricted your right of access and the reasons for that restriction if, and to the extent that, doing so would undermine the purpose of the restriction.

Kent Police are obliged to keep records of the use of any restrictions and provide them to the Information Commissioner’s Office should they wish to see them.

Criminal Offence – It is a criminal offence under Section 184 of the DPA for an employer to require employees or contractors, or for a person to require another person who provides goods, facilities or services, to provide certain records obtained via right of access applications as a condition of their employment or contract. It is also an offence for a provider of goods, facilities or services to the public to request such records from another as a condition for providing a service.

Verbal applications – The right may be exercised verbally or in writing. If you make an application verbally you may be asked to validate any written record of the application Kent Police make at the time it is made by a police officer or member of staff.

Confirmation of identity – A right of access application cannot be regarded as valid until your identity is confirmed. There will be circumstances where your identity is already confirmed (e.g. you are a police employee or detained person) and consequently there is no further requirement to confirm identity. In other cases, there will be a need to obtain that confirmation, ideally at the time the request is made. The law does not set out any standard for confirming your identity, but typically you will be required to provide documentary evidence of your full name and current address. If you seek access to images a provision of a photograph of yourself is likely to be necessary and this may also assist identification.

Sufficient information to locate personal data – It is in the interests of both yourself and Kent Police for there to be sufficient information within your right of access application to enable your personal data to be located. Consequently, should your request be vague, excessive, or ambiguous Kent Police will contact you to seek necessary clarity or narrowing of the application.

Manifestly unfounded or excessive – If Kent Police consider your application to be ‘manifestly unfounded’ or ‘excessive’ the Section 53 of the DPA states that [Kent Police] is able to refuse to act on the application. The terms ‘manifestly unfounded’ and ‘excessive’ (which are not defined in the DPA) are likely to encompass:

  • an application that sought information available or previously supplied via an alternative route e.g. pre-trial disclosure under Criminal Procedure and Investigations Act 1996 or disclosure of a custody record under the Police and Criminal Evidence Act 1984
  • an application that sought information previously supplied under the right of access
  • an application that came from a requestor already in dispute with the police force where there is evidence of a malicious, disruptive or time-wasting intent on their part
  • an application that is for reasons other than enabling the data subject to be aware of and verify the lawfulness of the processing
  • an application from a parent purporting to be on behalf of a child when the circumstances suggest this is not the case
  • an application displaying characteristic indicators of a vexatious request under the Freedom of Information Act 2000 set out in the Information Commissioner’s guidance on dealing with vexatious requests
  • an application that would take in excess of 30 man-hours to respond to in the initial month or multiples of that thereafter

Timescales – All right of access applications must be progressed promptly upon receipt and the personal data supplied within one month. The DPA does not give us an opportunity to extend that deadline.

When determining whether an extension is required Kent Police will consider factors such as:

  • which elements of the right of access you wish to exercise
  • the time already expended on the application
  • the volume of information that must be searched to identify information pertinent to your application
  • the structure of the information to be searched and the personal data within it
  • the sensitivity, purpose and nature of the processing
  • the practicalities of extracting or copying the personal data from its source
  • the practicalities of identifying potential redactions and then applying redactions
  • the level of resource available to conduct the work
  • the overall projected timescale for completing the response to the application, including searching, consideration of redactions, applying redactions, checking and issuing the response
  • whether you are prepared to reduce the scope of your application

Communications – Kent Police will ensure that any communication with you arising from this right is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to you if you are a child (aged less than 16 years). Responses will usually be in writing but may be verbal, where requested by you, provided Kent Police have first confirmed your identity when speaking with you.

Collection/delivery – If you require Kent Police to deliver your right of access response via a courier, Royal Mail Special Delivery Guaranteed or Royal Mail Signed For, as opposed to Royal Mail First or Second Class Kent Police are able to charge a delivery fee for that enhanced service which takes into account the price differential from Royal Mail First Class and the cost of any associated administrative work. However, where Kent Police determine, having considered the nature of the personal data contained in the response, that use of Royal Mail First or Second Class is not an appropriate and that Royal Mail Special Delivery Guaranteed, Royal Mail Signed For, or a courier is the most appropriate means of response then that additional cost will not be passed on to the data subject. Responses may also be provided via email or through personal collection from designated police premises, where requested by you.

Applications via Solicitors – Kent Police may receive an application on your behalf from a solicitor. This will be accepted once the solicitors have provided confirmation that they have confirmed your identity and are acting on behalf of you in respect of the right of access request.

Applications from children – This right may be exercised by children (those aged less than 16). If you are a child any right of access application received directly from you will be accepted, provided that Kent Police are content that you are capable of understanding this right and that the application has been freely made by you. Responses to such applications will go back directly to you.

Where an adult, usually a parent, exercises the right of access of a child Kent Police will not accept that application if there is any doubt that the adult is genuinely seeking to exercise the child’s right for the child. Responses to such application may go back to the child or the adult acting on their behalf.

Joint Controllers – Where Kent Police acts with one or more other organisations as joint controllers, it is ensured that any documentation between the parties sets out the respective responsibilities under the DPA and shows how a right of access application by you to personal data that is jointly processed will be managed.

 Record keeping – Kent Police will maintain records that provide information concerning:

  • contact with you
  • searches made to locate your personal data
  • results of those searches
  • any redactions applied
  • any decision-making or rationale setting out why exemptions or limitations have been applied or the application has been considered as manifestly unfounded or excessive
  • the response(s) to you

These records are intended to be able to withstand Information Commissioner and legal scrutiny and will be retained in accordance with the National Police Chief’s Council’s National Retention Schedule.

Application form – Although an application form is not required under the DPA for you to exercise this right, it is a useful administrative device for providing a definitive record of any request made that can confirm the scope of the request, assist the processing of the request, and provide useful evidence in cases should a dispute arises between the you and Kent Police.

Kent Police has created a right of access application form.

Alternatively, to exercise this right please email: public.disclosure@kent.pnn.police.uk

Or you can make a right of access application for information on the Police National Computer.

 

DPA Right to Rectification

This right is set out at Section 46 and 48 of the DPA and only apply where the processing of your personal data is for Law Enforcement Purposes.

When Kent Police process your personal data for Law Enforcement Purposes you have the right to request that Kent Police rectifies without undue delay any inaccurate personal data relating to you.

Where the inaccuracy is because the information is incomplete Kent Police must – if requested by you – complete it. The obligation to complete the information can be fulfilled by us adding supplementary information to the incomplete personal data.

However, Kent Police do not have to rectify personal data used for evidence, but instead restrict its processing as set out under the right to erasure or restriction.

When you have made an application under this right Kent Police must inform you in writing the following without delay and in any case within a month:

  • whether your application has been granted, or
  • if it has been refused, the reasons for the refusal, your right to make a request to the Information Commissioner’s Office under Section 51 of the DPA, your right to lodge a complaint with the Information Commissioner’s Office, and your right to apply to a court under Section 167 of the DPA.

However, Kent Police does not have to tell you the reasons that your application has been refused if not providing the reasons is necessary to:

  • avoid obstructing an official or legal inquiry, investigation or procedure
  • avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
  • protect public security
  • protect national security
  • protect the rights and freedoms of others

Where Kent Police have restricted this right Kent Police must inform you in writing without undue delay:

  • that your rights have been restricted
  • the reasons for the restriction
  • your right to lodge a complaint with the Information Commissioner’s Office
  • your right to apply to a court under Section 167 of the DPA.

However, Kent Police does not have to tell you that your rights have been restricted or the reasons for the restriction if doing so would undermine the purpose of the restriction.

Kent Police are obliged to keep records of the use of any restrictions and provide them to the Information Commissioner’s Office should they wish to see them.

If Kent Police have rectified information originally received from another police force or any other competent authority Kent Police are obliged to notify them of the rectification.

If Kent Police have rectified your personal data that Kent Police has disclosed to anyone else, Kent Police must inform them of the rectification, and they must also rectify that information if they still have responsibility for it.

Verbal applications – The right may be exercised verbally or in writing. If you make an application verbally you may be asked to validate any written record of the application Kent Police make at the time it is made by a police officer or member of staff.

Confirmation of identity – A right to rectification application cannot be regarded as valid until your identity is confirmed. There will be circumstances where your identity is already confirmed (e.g. you are a police employee or detained person) and consequently there is no further requirement to confirm identity. In other cases, there will be a need to obtain that confirmation, ideally at the time the request is made. The law does not set out any standard for confirming your identity, but typically you will be required to provide documentary evidence of your full name and current address.

Application form – Kent Police does not currently have an application form for you to exercise this right.

Sufficient information to locate personal data etc. – It is in the interests of both yourself and Kent Police for there to be sufficient information within your right of rectification application to enable the personal data in question to be located, the need for rectification or completion to be evidenced and for there to be clarity as to the rectification or completion required. Kent Police may contact you to seek additional information to achieve this.

Restricting Access – Once a valid application has been received and is being considered but it is not practical to restrict access to your inaccurate or incomplete personal data Kent Police will, where possible, append or signpost a report to alert officers and staff of the application. This alert will also indicate the grounds of challenge.

Manifestly unfounded or excessive – If Kent Police consider your application to be ‘manifestly unfounded’ or ‘excessive’ the Section 53 of the DPA states that [Kent Police] is able to refuse to act on the application. Our view is that the terms ‘manifestly unfounded’ and ‘excessive’ (which are not defined in the DPA) are likely to encompass:

  • an application that repeated a previous right to rectification application (unless the application included information not previously provided to us)
  • an application where there is evidence of a malicious, disruptive or time-wasting intent on their part
  • an application displaying characteristic indicators of a vexatious request under the Freedom of Information Act 2000 set out in the Information Commissioner’s guidance on dealing with vexatious requests

Timescales – All right to rectification applications must be progressed promptly upon receipt and the response supplied within one month. The DPA does not give us an opportunity to extend that deadline.

When determining whether an extension is required, Kent Police will consider factors such as:

  • the time already expended on the application
  • the volume of information that must be searched to identify information pertinent to your application
  • the structure of the information to be searched and the personal data within it
  • the sensitivity, purpose and nature of the processing
  • the practicalities of amending or appending your personal data
  • the level of resource available to conduct the work
  • the overall projected timescale for completing the response to the application
  • whether you are prepared to reduce the scope of your application

Communications – Kent Police will ensure that any communication with you arising from this right is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to you if you are a child (aged less than 16 years). Responses will usually be in writing but may be verbal, where requested by you, provided Kent Police have first confirmed your identity when speaking with you.

Applications via Solicitors – Kent Police may receive an application on your behalf from a solicitor. This will be accepted once the solicitors have provided confirmation that they have confirmed your identity and are acting on behalf of you in respect of the right to rectification application.

Applications from children – This right may be exercised by children (those aged less than 16). If you are a child any application received directly from you will be accepted, provided that Kent Police are content that you are capable of understanding this right and that the application has been freely made by you. Responses to such applications will go back directly to you.

Where an adult, usually a parent, exercises the right of rectification of a child Kent Police will not accept that application if there is any doubt that the adult is genuinely seeking to exercise the child’s right for the child. Responses to such application may go back to the child or the adult acting on their behalf.

Joint Controllers – Where Kent Police acts with one or more other organisations as joint controllers, it is ensured that any documentation between the parties sets out respective responsibilities under the DPA and shows how a right to rectification application by you to personal data that is jointly processed will be managed.

Record keeping – Kent Police will maintain records that provide information concerning:

  • contact with you
  • searches made to locate your personal data
  • results of those searches
  • any rectifications or completions made to your personal data
  • any decision-making or rationale setting out why exemptions or limitations have been applied, why rectification or completion was not undertaken, or the application has been considered as manifestly unfounded or excessive
  • the response(s) to you

These records are intended to be able to withstand Information Commissioner and legal scrutiny and will be retained in accordance with the National Police Chief’s Council’s National Retention Schedule.

To exercise this right please email: public.disclosure@kent.police.uk

DPA Right to Erasure or Restriction of processing

This right is set out at Section 47 and 48 of the DPA and only applies where the processing of your personal data is for Law Enforcement Purposes.

When Kent Police processes your personal data for Law Enforcement Purposes, Kent Police must erase personal data without undue delay if there is a legal obligation to do so or the processing would infringe any of the following provisions of the DPA – except where the personal data is required for evidence:

  • First Law Enforcement Principle (Section 35)
  • Second Law Enforcement Principle - partial (Section 36(1) to (3))
  • Third Law Enforcement Principle (Section 37)
  • Fourth Law Enforcement Principle – partial (Section 38(1))
  • Fifth Law Enforcement Principle – partial (Section 39(1))
  • Sixth Data Protection Principle (Section 40)
  • Safeguards: Archiving (Section 41)
  • Safeguards: Sensitive Processing (Section 42)

If you contest the accuracy of your personal data and it is not possible to determine whether or not it is inaccurate Kent Police must restrict its processing.

You may request that Kent Police erase or restrict the processing of your personal data but Kent Police are under an obligation to meet this right irrespective of whether you had contacted us about it.

When you have made an application under this right Kent Police must inform you in writing the following without delay and in any case within a month:

  • whether your application has been granted, or
  • if it has been refused, the reasons for the refusal, your right to make a request to the Information Commissioner’s Office under Section 51 of the DPA, your right to lodge a complaint with the Information Commissioner’s Office, and your right to apply to a court under Section 167 of the DPA.

However, Kent Police does not have to tell you the reasons that your application has been refused if not providing the reasons is necessary to:

  • avoid obstructing an official or legal inquiry, investigation or procedure
  • avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
  • protect public security
  • protect national security
  • protect the rights and freedoms of others

Where Kent Police have restricted this right, Kent Police must inform you in writing without undue delay:

  • that your rights have been restricted
  • the reasons for the restriction
  • your right to lodge a complaint with the Information Commissioner’s Office
  • your right to apply to a court under Section 167 of the DPA.

However, Kent Police does not have to tell you that your rights have been restricted or the reasons for the restriction if doing so would undermine the purpose of the restriction.

Kent Police are obliged to keep records of the use of any restrictions and provide them to the Information Commissioner’s Office should they wish to see them.

If Kent Police have erased or restricted processing of your personal data that Kent Police have disclosed to anyone else, Kent Police must inform them of the erasure or restriction, and they must also erase or restrict the processing of that information if they still have responsibility for it.

If Kent Police have restricted the processing of your personal data but intend to lift that restriction, Kent Police must inform you before doing so.

Verbal applications – The right may be exercised verbally or in writing. If you make an application verbally you may be asked to validate any written record of the application Kent Police make at the time it is made by a police officer or member of staff.

Confirmation of identity – A right to erasure or restriction application cannot be regarded as valid until your identity is confirmed. There will be circumstances where your identity is already confirmed (e.g. you are a police employee or detained person) and consequently there is no further requirement to confirm identity. In other cases, there will be a need to obtain that confirmation, ideally at the time the request is made. The law does not set out any standard for confirming your identity, but typically you will be required to provide documentary evidence of your full name and current address.

Application form – Kent Police does not currently have an application form for you to exercise this right.

Sufficient information to locate personal data etc. – It is in the interests of both yourself and Kent Police for there to be sufficient information within your right to erasure or restriction application to enable the personal data in question to be located, and the grounds for erasure or restriction to be evidenced. Kent Police may contact you to seek additional information to achieve this.

Manifestly unfounded or excessive – If Kent Police consider your application to be ‘manifestly unfounded’ or ‘excessive’ the Section 53 of the DPA states that [Kent Police] is able to refuse to act on the application. Our view is that the terms ‘manifestly unfounded’ and ‘excessive’ (which are not defined in the DPA) are likely to encompass:

  • an application that repeated a previous right to erasure or restriction application (unless the application included information not previously provided to us)
  • an application where there is evidence of a malicious, disruptive or time-wasting intent on their part
  • an application displaying characteristic indicators of a vexatious request under the Freedom of Information Act 2000 set out in the Information Commissioner’s guidance on dealing with vexatious requests

Timescales – All right to erasure or restriction applications must be progressed promptly upon receipt and the response supplied within one month. The DPA does not give us an opportunity to extend that deadline

Communications – Kent Police will ensure that any communication with you arising from this right is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to you if you are a child (aged less than 16 years). Responses will usually be in writing but may be verbal, where requested by you, provided Kent Police have first confirmed your identity when speaking with you.

Applications via Solicitors – Kent Police may receive an application on your behalf from a solicitor. This will be accepted once the solicitors have provided confirmation that they have confirmed your identity and are acting on behalf of you in respect of the application.

Applications from children – This right may be exercised by children (those aged less than 16). If you are a child any application received directly from you will be accepted provided that Kent Police are content that you are capable of understanding this right and that the application has been freely made by you. Responses to such applications will go back directly to you.

Where an adult, usually a parent, exercises the right of erasure of a child Kent Police will not accept that application if there is any doubt that the adult is genuinely seeking to exercise the child’s right for the child. Responses to such application may go back to the child or the adult acting on their behalf.

Joint Controllers – Where Kent Police acts with one or more other organisations as joint controllers, it will be ensured that any documentation between the parties sets out respective responsibilities under the DPA and shows how an application under this right by you to personal data that is jointly processed will be managed.

Record keeping – Kent Police will maintain records that provide information concerning:

  • contact with you
  • searches made to locate your personal data
  • results of those searches
  • any erasures or restrictions of your personal data
  • any decision-making or rationale setting out why exemptions or limitations have been applied, why erasure or restriction was not undertaken, or the application has been considered as manifestly unfounded or excessive
  • the response(s) to you

These records are intended to be able to withstand Information Commissioner and legal scrutiny and will be retained in accordance with the National Police Chief’s Council’s National Retention Schedule.

To exercise this right please email: public.disclosure@kent.police.uk

DPA Rights relating to Automated Decision-Making

These rights are set out in Sections 49 and 50 of the DPA and only apply where the processing of your personal data is for Law Enforcement Purposes.

Kent Police is prohibited from taking any significant decisions about you based only on automated processing of your personal data unless that decision is required or authorised in law. A significant decision is one that either has an adverse legal effect on you or significantly affects you.

If Kent Police make a significant decision about you that is required or authorised by law and that decision is based only on automated processing of personal data Kent Police must, as soon as is reasonably practicable, inform you in writing that such a decision has been made and that you can within 21 days of receiving that notification ask Kent Police to reconsider that decision or take a new decision which does not rely solely on automated processing of your personal data.

If you ask Kent Police to reconsider the original decision or ask for a new decision which does not rely solely on automated processing of your personal data Kent Police must, within 21 days:

  • consider your request, including any information you provide to us about it
  • comply with the request and write to you to tell you what has been done to comply with the request and the outcome of complying with your request.

These rights do not apply if Kent Police takes a significant decision about you, but the decision-making involves a person making the judgement (as opposed to it being done entirely by automated means).

Verbal applications – The right may be exercised verbally or in writing. If you make an application verbally you may be asked to validate any written record of the application Kent Police make at the time it is made by a police officer or member of staff.

Confirmation of identity – An application under these rights cannot be regarded as valid until your identity is confirmed. There will be circumstances where your identity is already confirmed (e.g. you are a police employee or detained person) and consequently there is no further requirement to confirm identity. In other cases, there will be a need to obtain that confirmation, ideally at the time the request is made. The law does not set out any standard for confirming your identity, but typically you will be required to provide documentary evidence of your full name and current address.

Application form – Kent Police does not currently have an application form for you to exercise this right.

Sufficient information to locate personal data etc. - It is in the interests of both yourself and Kent Police for there to be sufficient information within your application to enable the personal data in question to be located. Kent Police may contact you to seek additional information to achieve this.

Manifestly unfounded or excessive – Applications under this right cannot be considered ‘manifestly unfounded’ or ‘excessive’ as per Section 53 of the DPA.

Timescales – All applications must be progressed promptly by us upon receipt and the response supplied within one month. The DPA does not give us an opportunity to extend that deadline

Communications – Kent Police will ensure that any communication with you arising from this right is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to you if you are a child (aged less than 16 years). Responses will usually be in writing but may be verbal, where requested by you, provided Kent Police have first confirmed your identity when speaking with you.

Applications via Solicitors – Kent Police may receive an application on your behalf from a solicitor. This will be accepted once the solicitors have provided confirmation that they have confirmed your identity and are acting on behalf of you in respect of the application.

Applications from children – This right may be exercised by children (those aged less than 16). If you are a child any application received directly from you will be accepted provided that Kent Police are content that you are capable of understanding this right and that the application has been freely made by you. Responses to such applications will go back directly to you.

Where an adult, usually a parent, exercises the right of erasure of a child Kent Police will not accept that application if there is any doubt that the adult is genuinely seeking to exercise the child’s right for the child. Responses to such application may go back to the child or the adult acting on their behalf.

Joint Controllers – Where Kent Police acts with one or more other organisations as joint controllers it is ensured that any documentation between the parties sets out respective responsibilities under the DPA and shows how an application under this right by you to personal data that is jointly processed will be managed.

Record keeping – Kent Police will maintain records that provide information concerning:

  • contact with you
  • searches made to locate your personal data
  • results of those searches
  • any automated decisions made using your personal data
  • any decision-making or rationale setting out why exemptions or limitations have been applied, why the application was refused
  • the response(s) to you

These records are intended to be able to withstand Information Commissioner and legal scrutiny and will be retained in accordance with the National Police Chief’s Council’s National Retention Schedule. 

DPA Exercise of Rights through the Information Commissioner’s Office

This right is set out in Section 51 of the DPA and applies where the processing of your personal data is for Law Enforcement Purpose and where Kent Police has done any of the following:

  • Has restricted your right to be informed (Section 44 of the DPA) by not providing:
    • Information about the legal basis for processing your personal data
    • The retention period or criteria used to determine how long your personal data will be retained
    • Where applicable, information about the categories of recipients of your personal data, including overseas transfers
    • Any further information to enable you to exercise your data protection rights, particularly where your personal data is processed without your knowledge
  • Has restricted your right of access (Section 45 of the DPA) by not:
    • Confirming if your personal data is being processed by Kent Police
    • Providing access to it and supplementary information about the processing if Kent Police are processing it
  • Refuses a request to rectification (Section 46 of the DPA)
  • Refuses a request for erasure or restriction of processing (Section 47 of the DPA)

Where Kent Police have restricted any of those four rights you may request that the Information Commissioner’s Office checks that use of the restriction was lawful.

Having considered your request the Information Commissioner’s Office can then decide what steps to take, which may include issuing an Information Notice or Assessment Notice on Kent Police (Sections 142 and 146 of the DPA).

Finally, the Information Commissioner’ Office must inform you of the outcome of its assessment as to whether Kent Police’s use of the restriction was appropriate and of your right to apply to a court for a compliance order under Section 167 of the DPA.

If the Information Commissioner’s Office is not satisfied that the use of the restriction was lawful, they may also inform you about any enforcement action they were considering against Kent Police under Part 6 of the DPA.

Back to top

 

Rights under the GDPR (General Processing):

GDPR Right to be Informed
GDPR Right of Access
GDPR Right to Rectification
GDPR Right to Erasure (‘Right to be Forgotten”) 
GDPR Right to Restriction of Processing
GDPR Right to Data Portability
GDPR Right to Object
GDPR Right not to be subject to Automated Decision-Making

GDPR Right to be Informed

This right is set out at Articles 13 & 14 of the GDPR and only applies where the processing of your personal data is for General Purposes.

You have the right to be provided information about the use of your personal data when the personal data is obtained from you or from someone else. In some circumstances the right does not apply.

The information may be provided verbally or in writing.

The information to be provided is:

  • the identity and contact details of the controller (Chief Constable of Kent Police)
  • the contact details of Kent Police’s Data Protection Officer
  • the purpose(s) of the processing and the legal basis for the processing of your personal data
  • the categories of personal data collected (only if collected from someone else)
  • any recipients or categories of recipients of your personal data (if any)
  • details of any transfers of your personal data to ‘third countries’ and safeguards for that transfer (if any)
  • the retention period or criteria used to determine how long your personal data will be retained
  • the existence of all of your rights under GDPR
  • confirmation that you can withdraw your consent for the processing of your personal data where consent has been the legal basis for the processing
  • the source from where your personal data was obtained, including if it came from a publicly accessible source (only if collected from someone else)
  • whether the provision is part of a statutory or contractual requirement or obligation and the possible consequences of failing to provide the personal data (only if collected from you)
  • whether the personal data will be used for automated decision-making (including profiling), and information about how decisions are made, their significance and consequences.

When the personal data is collected from you the information should be provided to you at that time. When the personal data is collected from someone else it should be provided either (a) within a reasonable period after being obtained up to a maximum of one month; (b) when the communication first takes place with you if the personal data is used to communicate with you; or (c) before it is disclosed if it is envisaged the personal data will be disclosed to someone else.

Where the personal data is collected from you the first three bullets of information listed above do not have to be provided if you already have that information. Where the information is collected from you and is subsequently used for a different purpose from the initial purpose the final six bullets of information (except the source) must be provided to you before the personal data is used for the new purpose.

Where the information is collected from someone else the first four bullets of information listed above do not have to be provided if you already have that information or the obtaining or disclosing is required by law, or the personal data must remain confidential under an obligation of professional secrecy or providing the information would involve disproportionate effort. Where the information is collected from someone else and is subsequently used for a different purpose from the initial purpose the final six bullets of information (except the penultimate one) must be provided to you before the personal data is used for the new purpose.

Kent Police will ensure that any communication with you arising from this right is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to you if you are a child (aged less than 16 years).

Kent Police is currently developing specific privacy notices that will provide the information required by this right for the various scenarios where your personal data may be collected.

Limitations – This right to be informed can be restricted in certain circumstances, specifically where the application of the right:

  • would be likely to prejudice the prevention or detection of crime, apprehension or prosecution of offenders or the assessment or collection of a tax or imposition of a similar nature
  • would prevent disclosures required by law or legal proceedings
  • would prejudice functions designed to protect the public
  • applies to personal data subject of Legal Professional Privilege
  • would reveal the commission of a non-Data Protection offence by Kent Police
  • would be likely to prejudice management forecasting or planning
  • would be likely to prejudice negotiations with you
  • applies to personal data that consists of confidential references about you
  • would be incompatible with processing your personal data for journalistic, artistic or literary purposes in the public interest

Please view Kent Police’s Specific Privacy Notices, found under our FOI section

GDPR Right of Access

This right is set out in Article 15 of the GDPR and only applies where the processing of your personal data is for General Purposes.

You have the right to be given confirmation whether or not your personal data is subject of General Processing by Kent Police.

Where such processing is occurring, you have a right of access to that information, be given a copy of it, and be provided with supplementary information associated with the processing within a statutory timescale of between one and three months.

The supplementary information you have a right to is:

  • the purposes of the processing
  • the categories of personal data concerned
  • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
  • the existence of the right to request from Kent Police the rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing
  • the existence of the right to lodge a complaint with the Information Commissioner’s Office
  • where the personal data are not collected from you, any available information as to their source
  • the existence of automated decision-making, including profiling and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you
  • to be informed of the appropriate safeguards where your personal data is transferred to a third country or to an international organisation

The right may be exercised verbally or in writing. Where your right of access application is made electronically Kent Police must respond electronically in a commonly used form unless you require otherwise. Kent Police may charge a fee for additional copies of information disclosed to you under this right based on administrative costs.

Kent Police must consider the privacy and other rights and freedoms of other individuals when considering disclosure of your personal data to you and any disclosure must be limited as far as is necessary to preserve the rights and freedoms of those individuals. In practical terms this will mean that some responses to right of access requests will need to be redacted to obscure the identity of such individuals and preserve their privacy. Judgements in this area must be made on a case-by-case basis, looking at the specific circumstances and the role and relationship between you and the other individuals.

Limitations – the right of access can be limited by Kent Police in certain circumstances specifically, where the application of the right:

  • would be likely to prejudice the prevention or detection of crime, apprehension or prosecution of offenders or the assessment or collection of a tax or imposition of a similar nature
  • would prevent disclosures required by law or legal proceedings
  • would prejudice functions designed to protect the public
  • would reveal information about another person who can be identified from that information (unless that other person had consented to the disclosure or it was reasonable in all the circumstances to comply with the application without their consent)
  • applies to personal data subject of Legal Professional Privilege
  • would reveal the commission of a non-Data Protection offence by Kent Police
  • would be likely to prejudice management forecasting or planning
  • would be likely to prejudice negotiations with you
  • applies to personal data that consists of confidential references about you
  • would be incompatible with processing your personal data for journalistic, artistic or literary purposes in the public interest
  • applies to personal data processed for scientific, historical or research purposes
  • applies to personal data processed for archiving in the public interest

 

Criminal offence – It is a criminal offence under Section 184 of the DPA for an employer to require employees or contractors, or for a person to require another person who provides goods, facilities or services, to provide certain records obtained via right of access applications as a condition of their employment or contract. It is also an offence for a provider of goods, facilities or services to the public to request such records from another as a condition for providing a service.

Verbal applications – The right may be exercised verbally or in writing. If you make an application verbally you may be asked to validate any written record of the application Kent Police make at the time it is made by a police officer or member of staff.

Confirmation of identity – A right of access application cannot be regarded as valid until your identity is confirmed. There will be circumstances where your identity is already confirmed (e.g. you are a police employee or detained person) and consequently there is no further requirement to confirm identity. In other cases, there will be a need to obtain that confirmation, ideally at the time the request is made. The law does not set out any standard for confirming your identity, but typically you will be required to provide documentary evidence of your full name and current address. If you seek access to images a provision of a photograph of yourself is likely to be necessary and this may also assist identification.

Sufficient information to locate personal data - It is in the interests of both yourself and Kent Police for there to be sufficient information within your right of access application to enable your personal data to be located. Consequently, should your request be vague, excessive, or ambiguous Kent Police will contact you to seek necessary clarity or narrowing of the application.

Manifestly unfounded or excessive - If Kent Police consider your application to be ‘manifestly unfounded’ or ‘excessive’ the GDPR states that [Kent Police] is able to refuse to act on the application. Our view is that the terms ‘manifestly unfounded’ and ‘excessive’ (which are not defined in the GDPR) are likely to encompass:

  • an application that sought information available or previously supplied via an alternative route e.g. material associate with a grievance already supplied under Human Resources processes
  • an application that sought information previously supplied under the right of access
  • an application that came from a requestor already in dispute with the police force where there is evidence of a malicious, disruptive or time-wasting intent on their part
  • an application that is for reasons other than enabling the data subject to be aware of and verify the lawfulness of the processing
  • an application from a parent purporting to be on behalf of a child when the circumstances suggest this is not the case
  • an application displaying characteristic indicators of a vexatious request under the Freedom of Information Act 2000 set out in the Information Commissioner’s guidance on dealing with vexatious requests
  • an application that would take in excess of 30 man-hours to respond to in the initial month or multiples of that thereafter

Timescales – All right of access applications must be progressed promptly by us upon receipt and the personal data supplied within one month, but Kent Police are able to extend the deadline for a further two months, where necessary, having taken into account the complexity and number of requests you; but notification of this extension by us to you must occur within the initial month.

When determining whether an extension is required Kent Police will consider factors such as:

  • which elements of the right of access you wish to exercise
  • the time already expended on the application
  • the volume of information that must be searched to identify information pertinent to your application
  • the structure of the information to be searched and the personal data within it
  • the sensitivity, purpose and nature of the processing
  • the practicalities of extracting or copying the personal data from its source
  • the practicalities of identifying potential redactions and then applying redactions
  • the level of resource available to conduct the work
  • the overall projected timescale for completing the response to the application, including searching, consideration of redactions, applying redactions, checking and issuing the response
  • whether you are prepared to reduce the scope of your application

Communications – Kent Police will ensure that any communication with you arising from this right is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to you if you are a child (aged less than 16 years). Responses will usually be in writing but may be verbal, where requested by you, provided Kent Police have first confirmed your identity when speaking with you.

Collection/delivery – If you require Kent Police to deliver your right of access response via a courier, Royal Mail Special Delivery Guaranteed or Royal Mail Signed For, as opposed to Royal Mail First or Second Class Kent Police are able to charge a delivery fee for that enhanced service which takes into account the price differential from Royal Mail First Class and the cost of any associated administrative work. However, where Kent Police determine, having considered the nature of the personal data contained in the response, that use of Royal Mail First or Second Class is not an appropriate and that Royal Mail Special Delivery Guaranteed, Royal Mail Signed For, or a courier is the most appropriate means of response then that additional cost will not be passed on to the data subject. Responses may also be provided via email or through personal collection from designated police premises, where requested by you.

Applications via Solicitors – Kent Police may receive an application on your behalf from a solicitor. This will be accepted once the solicitors have provided confirmation that they have confirmed your identity and are acting on behalf of you in respect of the right of access request.

Applications from children – This right may be exercised by children (those aged less than 16). If you are a child any right of access application received directly from you will be accepted, provided that Kent Police are content that you are capable of understanding this right and that the application has been freely made by you. Responses to such applications will go back directly to you.

Where an adult, usually a parent, exercises the right of access of a child Kent Police will not accept that application if there is any doubt that the adult is genuinely seeking to exercise the child’s right for the child. Responses to such application may go back to the child or the adult acting on their behalf.

Joint Controllers – Where Kent Police acts with one or more other organisations as joint controllers it is ensured that any documentation between the parties sets out respective responsibilities under the GDPR and shows how a right of access application by you to personal data that is jointly processed will be managed.

No action taken – If Kent Police decide to take no action on your application Kent Police will inform you of that decision without delay and in any case within one month of receiving your application. Kent Police will also inform you of the reasons for not taking action and advise you that you may lodge a complaint with the Information Commissioner’s Office and seek a judicial remedy to challenge our decision.

Record keeping – Kent Police will maintain records that provide information concerning:

  • contact with you
  • searches made to locate your personal data
  • results of those searches
  • any redactions applied
  • any decision-making or rationale setting out why exemptions or limitations have been applied or the application has been considered as manifestly unfounded or excessive
  • the response(s) to you

These records are intended to be able to withstand Information Commissioner and legal scrutiny and will be retained in accordance with the National Police Chief’s Council’s National Retention Schedule.

Application form – Although an application form is not required under the GDPR for you to exercise this right, it is a useful administrative device for providing a definitive record of any request made that can confirm the scope of the request, assist the processing of the request, and provide useful evidence in cases should a dispute arises between the you and Kent Police.

Kent Police has created a right of access application form.

Alternatively, to exercise this right please email: public.disclosure@kent.pnn.police.uk

 

GDPR Right to Rectification

This right is set out in Article 16 of the GDPR and only applies where the processing of your personal data is for General Purposes.

You have the right to apply to have personal data rectified if it is inaccurate or incomplete. Kent Police are obliged to carry out the rectification within one month, or three months in complex cases. Taking into account the purposes of the processing, you also have the right to have your incomplete personal data completed, including by means of providing a supplementary statement.

Kent Police are also obliged (by Article 19 of the GDPR) to inform anyone else Kent Police had disclosed your personal data the fact that the personal data has been rectified, unless it was impossible or disproportionate to do so. Where specifically requested, you can be informed about those recipients.  Where the rectified personal data had been published online by Kent Police will inform, where possible, anyone who has links to or copies of the rectified personal data. Kent Police is not obliged to comply with Article 19 if doing so would be likely to prejudice the prevention or detection of crime, apprehension or prosecution of offenders or the assessment or collection of a tax or imposition of a similar nature, or involves personal data archived in the public interest.

Limitations – your right to rectification can be limited by Kent Police in certain circumstances, specifically where the application of the right:

  • would be likely to prejudice the prevention or detection of crime, apprehension or prosecution of offenders or the assessment or collection of a tax or imposition of a similar nature
  • would prevent disclosures required by law or legal proceedings
  • would prejudice functions designed to protect the public
  • would be incompatible with processing your personal data for journalistic, artistic or literary purposes in the public interest
  • applies to personal data processed for scientific, historical or research purposes
  • applies to personal data processed for archiving in the public interest

Verbal applications – The right may be exercised verbally or in writing. If you make an application verbally you may be asked to validate any written record of the application Kent Police make at the time it is made by a police officer or member of staff.

Confirmation of identity – A right to rectification application cannot be regarded as valid until your identity is confirmed. There will be circumstances where your identity is already confirmed (e.g. you are a police employee or detained person) and consequently there is no further requirement to confirm identity. In other cases, there will be a need to obtain that confirmation, ideally at the time the request is made. The law does not set out any standard for confirming your identity, but typically you will be required to provide documentary evidence of your full name and current address.

Application form – Kent Police does not currently have an application form for you to exercise this right.

Sufficient information to locate personal data etc. – It is in the interests of both yourself and Kent Police for there to be sufficient information within your right of rectification application to enable the personal data in question to be located, the need for rectification or completion to be evidenced and for there to be clarity as to the rectification or completion required. Kent Police may contact you to seek additional information to achieve this.

Restricting Access – Once a valid application has been received and is being considered but it is not practical to restrict access to your inaccurate or incomplete personal data Kent Police will, where possible, append or signpost a report to alert officers and staff of the application. This alert will also indicate the grounds of challenge.

Manifestly unfounded or excessive – If Kent Police consider your application to be ‘manifestly unfounded’ or ‘excessive’ the GDPR states that [Kent Police] is able to refuse to act on the application. Our view is that the terms ‘manifestly unfounded’ and ‘excessive’ (which are not defined in the GDPR) are likely to encompass:

  • an application that repeated a previous right to rectification application (unless the application included information not previously provided to us)
  • an application where there is evidence of a malicious, disruptive or time-wasting intent on their part
  • an application displaying characteristic indicators of a vexatious request under the Freedom of Information Act 2000 set out in the Information Commissioner’s guidance on dealing with vexatious requests

Timescales – All right to rectification applications must be progressed promptly by us upon receipt and the response supplied within one month, but Kent Police are able to extend the deadline for a further two months, where necessary, having taken into account the complexity and number of requests you; but notification of this extension by us to you must occur within the initial month.

When determining whether an extension is required Kent Police will consider factors such as:

  • the time already expended on the application
  • the volume of information that must be searched to identify information pertinent to your application
  • the structure of the information to be searched and the personal data within it
  • the sensitivity, purpose and nature of the processing
  • the practicalities of amending or appending your personal data
  • the level of resource available to conduct the work
  • the overall projected timescale for completing the response to the application
  • whether you are prepared to reduce the scope of your application

Communications – Kent Police will ensure that any communication with you arising from this right is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to you if you are a child (aged less than 16 years). Responses will usually be in writing but may be verbal, where requested by you, provided Kent Police have first confirmed your identity when speaking with you.

Applications via Solicitors – Kent Police may receive an application on your behalf from a solicitor. This will be accepted once the solicitors have provided confirmation that they have confirmed your identity and are acting on behalf of you in respect of the right to rectification application.

Applications from children – This right may be exercised by children (those aged less than 16). If you are a child any application received directly from you will be accepted provided that Kent Police are content that you are capable of understanding this right and that the application has been freely made by you. Responses to such applications will go back directly to you.

Where an adult, usually a parent, exercises the right of rectification of a child Kent Police will not accept that application if there is any doubt that the adult is genuinely seeking to exercise the child’s right for the child. Responses to such application may go back to the child or the adult acting on their behalf.

Joint Controllers – Where Kent Police acts with one or more other organisations as joint controllers it is ensured that any documentation between the parties sets out respective responsibilities under the GDPR and shows how a right to rectification application by you to personal data that is jointly processed will be managed.

No action taken – If Kent Police decide to take no action on your application Kent Police will inform you of that decision without delay and in any case within one month of receiving your application. Kent Police will also inform you of the reasons for not taking action and advise you that you may lodge a complaint with the Information Commissioner’s Office and seek a judicial remedy to challenge our decision.

Record keeping – Kent Police will maintain records that provide information concerning:

  • contact with you
  • searches made to locate your personal data
  • results of those searches
  • any rectifications or completions made to your personal data
  • any decision-making or rationale setting out why exemptions or limitations have been applied, why rectification or completion was not undertaken, or the application has been considered as manifestly unfounded or excessive
  • the response(s) to you

These records are intended to be able to withstand Information Commissioner and legal scrutiny and will be retained in accordance with the National Police Chief’s Council’s National Retention Schedule.

To exercise this right please email: public.disclosure@kent.pnn.police.uk

GDPR Right to Erasure (‘Right to be Forgotten”) 

This right is set out in Article 17 of the GDPR and only applies where the processing of your personal data is for General Purposes.

The Right to Erasure is also known as ‘the right to be forgotten’. This right enables you to request the deletion or removal of personal data where there is no compelling reason for its continued processing.

The right to erasure is not an absolute right and applies in the following circumstances:

  • where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
  • when you have withdrawn consent and there is no other legal basis for the processing
  • when you object to the processing and there is no overriding legitimate interest for continuing the processing
  • when the personal data was unlawfully processed
  • when the personal data has to be erased in order to comply with a legal obligation
  • when the personal data is processed in relation to the offer of information society services to a child

The right does not apply where the processing of your personal data is necessary for:

  • exercising the right of freedom of expression and information
  • compliance with a legal obligation placed upon Kent Police
  • the performance of a task carried out by Kent Police in the public interest or under official authority
  • reasons of public interest in relation to public health
  • archiving purposes in the public interest, scientific, historical research, or statistical purposes
  • the establishment, exercise or defence of legal claims

Kent Police are obliged (by Article 19 of the GDPR) to inform anyone else Kent Police had disclosed your personal data the fact that personal data has been erased, unless it was impossible or disproportionate to do so. Where specifically requested, you can be informed about those recipients. Where the erased personal data had been published online by Kent Police will inform, where possible, anyone who had links to or copies of the erased personal data. Kent Police is not obliged to comply with Article 19 if doing so would be likely to prejudice the prevention or detection of crime, apprehension or prosecution of offenders or the assessment or collection of a tax or imposition of a similar nature, or involves personal data archived in the public interest.

Limitations - Your right to erasure can be limited by Kent Police in certain circumstances, specifically where the application of the right:

  • would be likely to prejudice the prevention or detection of crime, apprehension or prosecution of offenders or the assessment or collection of a tax or imposition of a similar nature
  • would prevent disclosures required by law or legal proceedings
  • would prejudice functions designed to protect the public
  • would be incompatible with processing your personal data for journalistic, artistic or literary purposes in the public interest

Verbal applications – The right may be exercised verbally or in writing. If you make an application verbally you may be asked to validate any written record of the application Kent Police make at the time it is made by a police officer or member of staff.

Confirmation of identity – A right to erasure application cannot be regarded as valid until your identity is confirmed. There will be circumstances where your identity is already confirmed (e.g. you are a police employee or detained person) and consequently there is no further requirement to confirm identity. In other cases, there will be a need to obtain that confirmation, ideally at the time the request is made. The law does not set out any standard for confirming your identity, but typically you will be required to provide documentary evidence of your full name and current address.

Sufficient information to locate personal data etc. – It is in the interests of both yourself and Kent Police for there to be sufficient information within your right to erasure application to enable the personal data in question to be located, and the grounds for erasure to be evidenced. Kent Police may contact you to seek additional information to achieve this.

Manifestly unfounded or excessive – If Kent Police consider your application to be ‘manifestly unfounded’ or ‘excessive’ the GDPR states that [Kent Police] is able to refuse to act on the application. Our view is that the terms ‘manifestly unfounded’ and ‘excessive’ (which are not defined in the GDPR) are likely to encompass:

  • an application that repeated a previous right to erasure application (unless the application included information not previously provided to us)
  • an application where there is evidence of a malicious, disruptive or time-wasting intent on their part
  • an application displaying characteristic indicators of a vexatious request under the Freedom of Information Act 2000 set out in the Information Commissioner’s guidance on dealing with vexatious requests

Timescales – All right to erasure applications must be progressed promptly upon receipt and the response supplied within one month, but Kent Police are able to extend the deadline for a further two months, where necessary, having taken into account the complexity and number of requests you; but notification of this extension by us to you must occur within the initial month.

When determining whether an extension is required Kent Police will consider factors such as:

  • the time already expended on the application
  • the volume of information that must be searched to identify information pertinent to your application
  • the structure of the information to be searched and the personal data within it
  • the sensitivity, purpose and nature of the processing
  • the practicalities of erasing or restricting access to your personal data
  • the level of resource available to conduct the work
  • the overall projected timescale for completing the response to the application
  • whether you are prepared to reduce the scope of your application

Communications – Kent Police will ensure that any communication with you arising from this right is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to you if you are a child (aged less than 16 years). Responses will usually be in writing but may be verbal, where requested by you, provided Kent Police have first confirmed your identity when speaking with you.

Applications via Solicitors – Kent Police may receive an application on your behalf from a solicitor. This will be accepted once the solicitors have provided confirmation that they have confirmed your identity and are acting on behalf of you in respect of the application.

Applications from children – This right may be exercised by children (those aged less than 16). If you are a child any application received directly from you will be accepted provided that Kent Police are content that you are capable of understanding this right and that the application has been freely made by you. Responses to such applications will go back directly to you.

Where an adult, usually a parent, exercises the right of erasure of a child Kent Police will not accept that application if there is any doubt that the adult is genuinely seeking to exercise the child’s right for the child. Responses to such application may go back to the child or the adult acting on their behalf.

Joint Controllers – Where Kent Police acts with one or more other organisations as joint controllers it is ensured that any documentation between the parties sets out respective responsibilities under the GDPR and shows how an application under this right by you to personal data that is jointly processed will be managed.

No action taken – If Kent Police decide to take no action on your application Kent Police will inform you of that decision without delay and in any case within one month of receiving your application. Kent Police will also inform you of the reasons for not taking action and advise you that you may lodge a complaint with the Information Commissioner’s Office and seek a judicial remedy to challenge our decision.

Record keeping – Kent Police will maintain records that provide information concerning:

  • contact with you
  • searches made to locate your personal data
  • results of those searches
  • any erasures of your personal data
  • any decision-making or rationale setting out why exemptions or limitations have been applied, why erasure was not undertaken, or the application has been considered as manifestly unfounded or excessive
  • the response(s) to you

These records are intended to be able to withstand Information Commissioner and legal scrutiny and will be retained in accordance with the National Police Chief’s Council’s National Retention Schedule.

Application form – Kent Police does not currently have an application form for you to exercise this right.

To exercise this right please email: public.disclosure@kent.pnn.police.uk

 

GDPR Right to Restriction of Processing

This right is set out in Article 18 of the GDPR and only applies where the processing of your personal data is for General Purposes.

You have the right to require that Kent Police restricts the processing of your personal data in the following circumstances:

  • When you are contesting the accuracy of the personal data, for a period to allow Kent Police to verify the accuracy of the personal data
  • Where the processing is unlawful, but you oppose the erasure of the personal data but require the restriction instead
  • Where Kent Police no longer needs the personal data, but you require it to establish, exercise or defend legal claims

When you have exercised the right to restriction Kent Police can only store the personal data concerned and cannot further process it unless one of the following applies, Kent Police:

  • has your consent to do so
  • needs to do so to establish, exercise or defend legal claims
  • needs to do so to protect the rights of another person in the public interest

When Kent Police restrict the processing, it may do one or more of the following:

  • temporarily move the personal data to another system
  • make the personal data unavailable to officers and staff
  • temporarily remove the personal data from the Kent Police website
  • apply technical measures to prevent the processing or alteration of the personal data

Kent Police are obliged to inform you prior to us removing the restriction of processing and indicate to officers and staff where Kent Police have restricted the processing.

Kent Police are also obliged (by Article 19 of the GDPR) to inform anyone else Kent Police had disclosed your personal data the fact that the personal data has been restricted, unless it was impossible or disproportionate to do so. Where specifically requested, you will be informed about those recipients. Where the restricted personal data had been published online by Kent Police, where possible, Kent Police will inform anyone who has links to or copies of the personal of the restriction. Kent Police is not obliged to comply with Article 19 if doing so would be likely to prejudice the prevention or detection of crime, apprehension or prosecution of offenders or the assessment or collection of a tax or imposition of a similar nature, involves personal data archived in the public interest.

Verbal applications – The right may be exercised verbally or in writing. If you make an application verbally you may be asked to validate any written record of the application Kent Police make at the time it is made by a police officer or member of staff.

Confirmation of identity – An application under this right cannot be regarded as valid until your identity is confirmed. There will be circumstances where your identity is already confirmed (e.g. you are a police employee or detained person) and consequently there is no further requirement to confirm identity. In other cases, there will be a need to obtain that confirmation, ideally at the time the request is made. The law does not set out any standard for confirming your identity, but typically you will be required to provide documentary evidence of your full name and current address.

Sufficient information to locate personal data etc. – It is in the interests of both yourself and Kent Police for there to be sufficient information within your application to enable the personal data in question to be located, and your grounds for restriction to be described. Kent Police may contact you to seek additional information to achieve this.

Manifestly unfounded or excessive – If Kent Police consider your application to be ‘manifestly unfounded’ or ‘excessive’ the GDPR states that [Kent Police] is able to refuse to act on the application. Our view is that the terms ‘manifestly unfounded’ and ‘excessive’ (which are not defined in the GDPR) are likely to encompass:

  • an application that repeated a previous right to restriction application (unless the application included information not previously provided to us or the circumstances had changed)
  • an application where there is evidence of a malicious, disruptive or time-wasting intent on their part
  • an application displaying characteristic indicators of a vexatious request under the Freedom of Information Act 2000 set out in the Information Commissioner’s guidance on dealing with vexatious requests

Timescales – All  right to restriction applications must be progressed promptly by upon receipt and the response supplied within one month, but Kent Police are able to extend the deadline for a further two months, where necessary, having taken into account the complexity and number of requests you; but notification of this extension by us to you must occur within the initial month.


When determining whether an extension is required Kent Police will consider factors such as:

  • the time already expended on the application
  • the volume of information that must be searched to identify information pertinent to your application
  • the structure of the information to be searched and the personal data within it
  • the sensitivity, purpose and nature of the processing
  • the practicalities of restricting access to your personal data
  • the level of resource available to conduct the work
  • the overall projected timescale for completing the response to the application
  • whether you are prepared to reduce the scope of your application

Communications – Kent Police will ensure that any communication with you arising from this right is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to you if you are a child (aged less than 16 years). Responses will usually be in writing but may be verbal, where requested by you, provided Kent Police have first confirmed your identity when speaking with you.

Applications via Solicitors – Kent Police may receive an application on your behalf from a solicitor. This will be accepted once the solicitors have provided confirmation that they have confirmed your identity and are acting on behalf of you in respect of the application.

Applications from children – This right may be exercised by children (those aged less than 16). If you are a child any application received directly from you will be accepted provided that Kent Police are content that you are capable of understanding this right and that the application has been freely made by you. Responses to such applications will go back directly to you.

Where an adult, usually a parent, exercises the right of erasure of a child Kent Police will not accept that application if there is any doubt that the adult is genuinely seeking to exercise the child’s right for the child. Responses to such application may go back to the child or the adult acting on their behalf.

Joint Controllers – Where Kent Police acts with one or more other organisations as joint controllers it is ensured that any documentation between the parties sets out respective responsibilities under the GDPR and shows how an application under this right by you to personal data that is jointly processed will be managed.

No action taken – If Kent Police decide to take no action on your application Kent Police will inform you of that decision without delay and in any case within one month of receiving your application. Kent Police will also inform you of the reasons for not taking action and advise you that you may lodge a complaint with the Information Commissioner’s Office and seek a judicial remedy to challenge our decision.

Record keeping – Kent Police will maintain records that provide information concerning:

  • contact with you
  • searches made to locate your personal data
  • results of those searches
  • any restrictions of your personal data
  • any decision-making or rationale setting out why exemptions or limitations have been applied, why restriction was not undertaken, or the application has been considered as manifestly unfounded or excessive
  • the response(s) to you

These records are intended to be able to withstand Information Commissioner and legal scrutiny and will be retained in accordance with the National Police Chief’s Council’s National Retention Schedule.

Limitations – Your right to restriction of processing can be limited by Kent Police in certain circumstances, specifically where the application of the right:

  • would be likely to prejudice the prevention or detection of crime, apprehension or prosecution of offenders or the assessment or collection of a tax or imposition of a similar nature
  • would prevent disclosures required by law or legal proceedings
  • would prejudice functions designed to protect the public
  • would be incompatible with processing your personal data for journalistic, artistic or literary purposes in the public interest
  • involves personal data archived in the public interest

Application form – Kent Police does not currently have an application form for you to exercise this right.

To exercise this right please email: public.disclosure@kent.pnn.police.uk

 

GDPR Right to Data Portability

This right is set out at Article 20 of the GDPR and only applies where the processing of your personal data is for General Purposes.

You have the right to receive personal data previously provided to Kent Police by you in a format that is structured, commonly used and machine readable. You also have the right to transmit your personal data to another organisation or person without hindrance by us where the processing of your personal data was based on your consent or was necessary for a contract involving you and is carried out automatically. Where technically feasible Kent Police will transmit the personal data automatically.

The right does not apply if:

  • Kent Police are processing your personal data to perform a task in the public interest or under official authority
  • it would adversely affect other individuals

There is no equivalent right if your personal data is processed for Law Enforcement Purposes.

Limitations – Your right to data portability can be limited by Kent Police in certain circumstances, specifically where the application of the right:

  • would be likely to prejudice the prevention or detection of crime, apprehension or prosecution of offenders or the assessment or collection of a tax or imposition of a similar nature
  • would prevent disclosures required by law or legal proceedings
  • would prejudice functions designed to protect the public
  • would be incompatible with processing your personal data for journalistic, artistic or literary purposes in the public interest
  • involves personal data archived in the public interest

Confirmation of identity – An application under this right cannot be regarded as valid until your identity is confirmed. There will be circumstances where your identity is already confirmed (e.g. you are a police employee or detained person) and consequently there is no further requirement to confirm identity. In other cases, there will be a need to obtain that confirmation, ideally at the time the request is made. The law does not set out any standard for confirming your identity, but typically you will be required to provide documentary evidence of your full name and current address.

Sufficient information to locate personal data etc. – It is in the interests of both yourself and Kent Police for there to be sufficient information within your application to enable the personal data in question to be located. Kent Police may contact you to seek additional information to achieve this.

Manifestly unfounded or excessive - If Kent Police consider your application to be ‘manifestly unfounded’ or ‘excessive’ the GDPR states that [Kent Police] is able to refuse to act on the application. Our view is that the terms ‘manifestly unfounded’ and ‘excessive’ (which are not defined in the GDPR) are likely to encompass:

  • an application that repeated a previous right to data portability application (unless the application included information not previously provided to us or the circumstances had changed)
  • an application where there is evidence of a malicious, disruptive or time-wasting intent on their part
  • an application displaying characteristic indicators of a vexatious request under the Freedom of Information Act 2000 set out in the Information Commissioner’s guidance on dealing with vexatious requests

Timescales – All right to data portability applications must be progressed promptly upon receipt and the response supplied within one month, but Kent Police are able to extend the deadline for a further two months, where necessary, having taken into account the complexity and number of requests you; but notification of this extension by us to you must occur within the initial month.

When determining whether an extension is required Kent Police will consider factors such as:

  • the time already expended on the application
  • the volume of information that must be searched to identify information pertinent to your application
  • the structure of the information to be searched and the personal data within it
  • the sensitivity, purpose and nature of the processing
  • the practicalities of transmitting your personal data
  • the level of resource available to conduct the work
  • the overall projected timescale for completing the response to the application
  • whether you are prepared to reduce the scope of your application

Communications – Kent Police will ensure that any communication with you arising from this right is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to you if you are a child (aged less than 16 years). Responses will usually be in writing but may be verbal, where requested by you, provided Kent Police have first confirmed your identity when speaking with you.

Applications via Solicitors – Kent Police may receive an application on your behalf from a solicitor. This will be accepted once the solicitors have provided confirmation that they have confirmed your identity and are acting on behalf of you in respect of the application.

Applications from children – This right may be exercised by children (those aged less than 16). If you are a child any application received directly from you will be accepted provided that Kent Police are content that you are capable of understanding this right and that the application has been freely made by you. Responses to such applications will go back directly to you.

Where an adult, usually a parent, exercises the right of erasure of a child Kent Police will not accept that application if there is any doubt that the adult is genuinely seeking to exercise the child’s right for the child. Responses to such application may go back to the child or the adult acting on their behalf.

Joint Controllers – Where Kent Police acts with one or more other organisations as joint controllers it is ensured that any documentation between the parties sets out respective responsibilities under the GDPR and shows how an application under this right by you to personal data that is jointly processed will be managed.

No action taken – If Kent Police decide to take no action on your application Kent Police will inform you of that decision without delay and in any case within one month of receiving your application. Kent Police will also inform you of the reasons for not taking action and advise you that you may lodge a complaint with the Information Commissioner’s Office and seek a judicial remedy to challenge our decision.

Record keeping – Kent Police will maintain records that provide information concerning:

  • contact with you
  • searches made to locate your personal data
  • results of those searches
  • any transmissions of your personal data
  • any decision-making or rationale setting out why exemptions or limitations have been applied, why restriction was not undertaken, or the application has been considered as manifestly unfounded or excessive
  • the response(s) to you

These records are intended to be able to withstand Information Commissioner and legal scrutiny and will be retained in accordance with the National Police Chief’s Council’s National Retention Schedule.

Application form – Kent Police does not currently have an application form for you to exercise this right.

To exercise this right please email: public.disclosure@kent.pnn.police.uk

 

GDPR Right to Object

This right is set out at Article 21 of the GDPR and only applies where the processing of your personal data is for General Purposes.

When Kent Police process your personal data for the performance of a task carried out in the public interest or under official authority, including profiling, you have the right to object to the processing.

In those case Kent Police can no longer process the personal data unless either of the following applies:

  • Kent Police can demonstrate compelling grounds overriding your interests, rights or freedoms, or
  • the processing is necessary for Kent Police to establish, exercise or defend legal claims

Kent Police are obliged to inform you of this right when Kent Police first communicate with you when intending to process your personal data and present this right separately from other information.

The right also applies if Kent Police process your personal data for direct marketing purposes in which case Kent Police are obliged to cease processing it for those purposes.

The right also applies where Kent Police process your personal data for scientific, historical research or statistical purposes unless the processing is required when Kent Police perform a task carried out in the public interest.

There is no equivalent to the right where your personal data is processed for Law Enforcement Purposes.

 

Limitations – Your right to object can be limited by Kent Police in certain circumstances, specifically where the application of the right:

 

  • would be likely to prejudice the prevention or detection of crime, apprehension or prosecution of offenders or the assessment or collection of a tax or imposition of a similar nature
  • would prevent disclosures required by law or legal proceedings
  • would prejudice functions designed to protect the public
  • would be incompatible with processing your personal data for journalistic, artistic or literary purposes in the public interest
  • would be incompatible with processing your personal data for journalistic, artistic or literary purposes in the public interest
  • involves personal data archived in the public interest

Confirmation of identity – An application under this right cannot be regarded as valid until your identity is confirmed. There will be circumstances where your identity is already confirmed (e.g. you are a police employee or detained person) and consequently there is no further requirement to confirm identity. In other cases, there will be a need to obtain that confirmation, ideally at the time the request is made. The law does not set out any standard for confirming your identity, but typically you will be required to provide documentary evidence of your full name and current address.

Sufficient information to locate personal data etc. – It is in the interests of both yourself and Kent Police for there to be sufficient information within your application to enable the personal data in question to be located. Kent Police may contact you to seek additional information to achieve this.

Manifestly unfounded or excessive – If Kent Police consider your application to be ‘manifestly unfounded’ or ‘excessive’ the GDPR states that [Kent Police] is able to refuse to act on the application. Our view is that the terms ‘manifestly unfounded’ and ‘excessive’ (which are not defined in the GDPR) are likely to encompass:

  • an application that repeated a previous right to data object application (unless the application included information not previously provided to us or the circumstances had changed)
  • an application where there is evidence of a malicious, disruptive or time-wasting intent on their part
  • an application displaying characteristic indicators of a vexatious request under the Freedom of Information Act 2000 set out in the Information Commissioner’s guidance on dealing with vexatious requests

Timescales – All right to object applications must be progressed promptly upon receipt and the response supplied within one month, but Kent Police are able to extend the deadline for a further two months, where necessary, having taken into account the complexity and number of requests you; but notification of this extension by Kent Police to you must occur within the initial month.

When determining whether an extension is required Kent Police will consider factors such as:

  • the time already expended on the application
  • the volume of information that must be searched to identify information pertinent to your application
  • the structure of the information to be searched and the personal data within it
  • the sensitivity, purpose and nature of the processing
  • the practicalities of ceasing processing of your personal data
  • the level of resource available to conduct the work
  • the overall projected timescale for completing the response to the application
  • whether you are prepared to reduce the scope of your application

Communications – Kent Police will ensure that any communication with you arising from this right is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to you if you are a child (aged less than 16 years). Responses will usually be in writing but may be verbal, where requested by you, provided Kent Police have first confirmed your identity when speaking with you.

Applications via Solicitors – Kent Police may receive an application on your behalf from a solicitor. This will be accepted once the solicitors have provided confirmation that they have confirmed your identity and are acting on behalf of you in respect of the application.

Applications from children – This right may be exercised by children (those aged less than 16). If you are a child any application received directly from you will be accepted provided that Kent Police are content that you are capable of understanding this right and that the application has been freely made by you. Responses to such applications will go back directly to you.

Where an adult, usually a parent, exercises the right of erasure of a child Kent Police will not accept that application if there is any doubt the adult is genuinely seeking to exercise the child’s right for the child. Responses to such application may go back to the child or the adult acting on their behalf.

Joint Controllers – Where Kent Police acts with one or more other organisations as joint controllers it is ensured that any documentation between the parties sets out respective responsibilities under the GDPR and shows how an application under this right by you to personal data that is jointly processed will be managed.

No action taken – If Kent Police decide to take no action on your application Kent Police will inform you of that decision without delay and in any case within one month of receiving your application. Kent Police will also inform you of the reasons for not taking action and advise you that you may lodge a complaint with the Information Commissioner’s Office and seek a judicial remedy to challenge our decision.

Record keeping – Kent Police will maintain records that provide information concerning:

  • contact with you
  • searches made to locate your personal data
  • results of those searches
  • any cessation of processing of your personal data
  • any decision-making or rationale setting out why exemptions or limitations have been applied, why restriction was not undertaken, or the application has been considered as manifestly unfounded or excessive
  • the response(s) to you

These records are intended to be able to withstand Information Commissioner and legal scrutiny and will be retained in accordance with the National Police Chief’s Council’s National Retention Schedule.

Application form – Kent Police does not currently have an application form for you to exercise this right.

To exercise this right please email: public.disclosure@kent.pnn.police.uk

 

GDPR Right not to be subject to Automated Decision-Making

This right is set out in Article 22 of the GDPR and only applies where the processing of your personal data is for General Purposes.

You have the right not to be subject to a decision taken by Kent Police using just automated means if the decision has a legal or similar effect on you.

The right does not apply if the decision:

  • is necessary for a contract between yourself and Kent Police, or
  • is authorised by law, or
  • is based on your explicit consent

But in all three cases Kent Police must implement suitable measures to safeguard your rights, freedoms and legitimate interests. Those measures must include as a minimum the right to require Kent Police to nominate an officer or member of police staff that you can express your point of view and contest the decision.

Other safeguards are set out in Section 14 of the DPA.

There are no limitations to this right.

Confirmation of identity – An application under this right cannot be regarded as valid until your identity is confirmed. There will be circumstances where your identity is already confirmed (e.g. you are a police employee or detained person) and consequently there is no further requirement to confirm identity. In other cases, there will be a need to obtain that confirmation, ideally at the time the request is made. The law does not set out any standard for confirming your identity, but typically you will be required to provide documentary evidence of your full name and current address.

Sufficient information to locate personal data etc. – It is in the interests of both yourself and Kent Police for there to be sufficient information within your application to enable the personal data in question to be located. Kent Police may contact you to seek additional information to achieve this.

Manifestly unfounded or excessive – If Kent Police consider your application to be ‘manifestly unfounded’ or ‘excessive’ the GDPR states that [Kent Police] is able to refuse to act on the application. Our view is that the terms ‘manifestly unfounded’ and ‘excessive’ (which are not defined in the GDPR) are likely to encompass:

  • an application that repeated a previous right not to be subject to automated decision-making application (unless the application included information not previously provided to us or the circumstances had changed)
  • an application where there is evidence of a malicious, disruptive or time-wasting intent on their part
  • an application displaying characteristic indicators of a vexatious request under the Freedom of Information Act 2000 set out in the Information Commissioner’s guidance on dealing with vexatious requests

Timescales – All  applications under this right must be progressed promptly upon receipt and the response supplied within one month, but Kent Police are able to extend the deadline for a further two months, where necessary, having taken into account the complexity and number of requests you; but notification of this extension by us to you must occur within the initial month.

When determining whether an extension is required Kent Police will consider factors such as:

  • the time already expended on the application
  • the volume of information that must be searched to identify information pertinent to your application
  • the structure of the information to be searched and the personal data within it
  • the sensitivity, purpose and nature of the processing
  • the practicalities of ceasing any automated decision-making using your personal data
  • the level of resource available to conduct the work
  • the overall projected timescale for completing the response to the application
  • whether you are prepared to reduce the scope of your application

Communications – Kent Police will ensure that any communication with you arising from this right is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to you if you are a child (aged less than 16 years). Responses will usually be in writing but may be verbal, where requested by you, provided Kent Police have first confirmed your identity when speaking with you.

Applications via Solicitors – Kent Police may receive an application on your behalf from a solicitor. This will be accepted once the solicitors have provided confirmation that they have confirmed your identity and are acting on behalf of you in respect of the application.

Applications from children – This right may be exercised by children (those aged less than 16). If you are a child any application received directly from you will be accepted provided that Kent Police are content that you are capable of understanding this right and that the application has been freely made by you. Responses to such applications will go back directly to you.

Where an adult, usually a parent, exercises the right not to be subject of automated decision-making for a child Kent Police will not accept that application if there is any doubt that the adult is genuinely seeking to exercise the child’s right for the child. Responses to such application may go back to the child or the adult acting on their behalf.

Joint Controllers – Where Kent Police acts with one or more other organisations as joint controllers it is ensured that any documentation between us sets out respective responsibilities under the GDPR and shows how an application under this right by you to personal data that is jointly processed will be managed.

No action taken – If Kent Police decide to take no action on your application Kent Police will inform you of that decision without delay and in any case within one month of receiving your application. Kent Police will also inform you of the reasons for not taking action and advise you that you may lodge a complaint with the Information Commissioner’s Office and seek a judicial remedy to challenge our decision.

Record keeping – Kent Police will maintain records that provide information concerning:

  • contact with you
  • searches made to locate your personal data
  • results of those searches
  • any cessation of automated decision-making using your personal data
  • any decision-making or rationale setting out why exemptions or limitations have been applied, why restriction was not undertaken, or the application has been considered as manifestly unfounded or excessive
  • the response(s) to you

These records are intended to be able to withstand Information Commissioner and legal scrutiny and will be retained in accordance with the National Police Chief’s Council’s National Retention Schedule.

Application form – Kent Police does not currently have an application form for you to exercise this right.

To exercise this right please email: public.disclosure@kent.pnn.police.uk

This Privacy Notice is divided into three parts:

 

Back to top