Information Governance and Subject Access Requests

The Information Governance framework sets out the way we handle information, in particular, personal and sensitive data relating to our customers and employees. The framework determines how we collect and store data, specifying how the data is used and when it can be shared. The Information Governance Team provides guidance to the Council and individuals to promote how personal information is processed legally, securely, efficiently and effectively.

Further information, guidance and support can be found here: Information Governance - Derby City Council.

There is a wealth of information here, including procedures and guiding policies and guidance. This include, but is not limited to:

• Data Protection/UK GDPR;
• Information Security;
• Sharing and disclosing information;
• Records Management;
• Freedom of information.

Colleagues should promote Council privacy notices at every opportunity; it is a legal requirement for us to promote transparency on how we handle service users' information.

Staff working within the council should ensure that they have a thorough understanding of the Data Subjects Rights Requests Procedure (intranet access is required). Should families require any further information on their data protection rights this can be found on the data subjects rights request form and data protection webpage. In the event that individuals require further data protection support and advice they can contact the Information Governance team on 01332 640 763 or data.protection@derby.gov.uk.

A valid request for information can be made by a child; an assessment to the maturity of the child and the nature of data will need to be carried out. The information governance team and Children's Social Care may need to work together to form this assessment. Reasonable adjustments must be made for applicants who are disabled, verbal requests can suffice where absolutely necessary; in the event of receiving a verbal request you should document it. Compliance with data subject rights requests is essential to Derby City Council's operation as a local authority; each employee must be able to recognise a data protection request.

Please see the following links for further information:

• Internal procedure for dealing with data subject rights requests;
• Public facing page with information for families & children;
• Privacy notices for information for families and children on how their information is used and what their rights are;
• Information Commissioner Toolkit for Public Authorities on Dealing with Vexatious Claims - a toolkit to help councils decide when a Freedom of Information (FOI) applicant is vexatious, issued by the Information Commissioner's Office (ICO);
• Information Commissioner Guidance on Subject Access Requests - includes reminders that Subject Access Requests can be submitted by various means, including via social media, and do not have to contain the words 'subject access request'.