Data Processing Requests
Data protection law grants rights to individuals relating to the processing of their personal data.
The Data Protection Act (DPA 2018) / UK General Data Protection Regulation (UK GDPR) provides the following rights:
1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling
To be informed
The right for individuals to be informed about the collection and use of their personal data. This information is available on our Privacy Notice webpage.
Access
The right for individuals to have access to their personal data. Details about our procedure for handling access requests can be found on our Accessing health records and personal information webpage.
Rectification
The right for individuals to have inaccurate personal data rectified, or completed if it is incomplete. Requests for rectification of data can in certain circumstances be refused for example if the request is manifestly unfounded or excessive.
Erasure
The right for individuals to have personal data erased; this is not an absolute right and only applies in certain circumstances. The right does not apply to the if the processing is necessary for public health purposes or for the purposes of preventative or occupational medicine.
Restrict processing
The right for individuals to request the restriction or suppression of their personal data; this is not an absolute right and only applies in certain circumstances. For example this right applies were the individual contests the accuracy.
Data portability
This right allows individuals to obtain and reuse their personal data for their own purposes across different services. This right only applies to the information an individual has provided to the data controller (organisation processing the data).
Object
The right for individuals to object to:
• processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority
• processing for direct marketing purposes
• processing for purposes of scientific/historical research and statistics
Liverpool Heart and Chest Hospital NHS Foundation Trust does not process personal data for direct marketing purposes.
Automated decision making
This right allows individuals to challenge a decision based solely on automated decision making and to request human intervention.
Liverpool Heart and Chest Hospital does not carry out any data processing that uses automated decision making.
Making a Data Processing Request
Requests can be made verbally or in writing and should be made to Information Governance
• Email infogov@lhch.nhs.uk
• Post Information Governance, Liverpool Heart and Chest Hospital NHS Foundation Trust, Thomas Drive, Liverpool, L14 3PE
• Phone 0151 600 1845
Our Data Processing Request form is available for use.
Fees & timescales
No charges apply unless the request is manifestly unfounded or excessive; the Trust may charge a reasonable fee to cover administrative costs for handling such requests.
Requests will be processed as soon as possible, and a response will be issued within one month from the date of receipt unless the request is complex or manifestly unfounded or excessive.
Where requests are refused we will explain the reasons. If you are unhappy with the decision, you have the right under the Regulation to lodge a complaint with a supervisory authority, for the UK this is the Information Commissioner’s Office:
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Phone: 0303 123 1113
- Website: ico.org.uk