Under data protection laws you have the right  to be given copies of the personal information (data) that we hold about you (the right to access). 

If you wish to ask for information that we hold about you (called a subject access request or SAR), please complete and return this form ^{(docx, 179kb)} to: legal@winchester.gov.uk

If you wish to submit your request by post, please send to our Data Protection Officer, whose contact details are given in the 'Data Protection Officer contact details' section below.

We will need  proof of your identity - particularly where you do not have an address within Winchester district. This is to make sure that we do not send  your personal information to  the wrong person.

Your Proof of Identity will normally be copies of two documents (scanned or photocopy) which show your date of birth, name and current address – for example your driving licence, passport, utility bill or council tax bill. If you are unable to provide two suitable documents, please contact us by email or by post to discuss.

The Information Commissioner’s  web-site has some useful  information about how to access your personal data: ico.org.uk/for-the-public/personal-information

There is normally no charge for you to access your personal data (there are a few exceptions where the amount of information is excessive or where you ask for extra copies of the same information). We will tell you if for any reason there is a charge.

Depending on the type of information you ask for  and how you would like the information to be provided to you, we may provide electronic or paper copies. Sometimes you may prefer to visit the offices to be shown the information. Generally if you don’t express a preference, we will respond to you in the same way you contact us. Our preference is for electronic communication where possible - as it is  quicker and cheaper.

Once we have  enough information from you to find your personal information, we have one calendar month to respond to you. If a request is complicated or includes a lot of information we can extend  this by a further two months. If we cannot respond within one month, we will let you know when we expect to respond and explain the reasons.

Winchester City Council operates several CCTV systems. Data Protection laws allow you to ask for CCTV footage that identifies you. We will need  to know  as much information as possible about where and when you think you have been recorded on our CCTV systems (time, date and  place). You will also need to produce a current photograph  so we can identify you in the footage. Further information about our CCTV system, including the location of CCTV cameras can be found here: winchester.gov.uk/parking/cctv

The form you can use is here: CCTV Subject Access form ^{(docx, 182kb)}.

When we collect personal data about you, either direct from you or from anybody else, we must tell you  how and why we collect and use that information. We must provide you with information including: why we use you personal data, how long we keep it for and who we share it with. This is called “privacy information”. 

As a local authority we collect and use information for many different reasons. Usually we need to use your information because we need it to:

• carry out a contract or agreement with you;
• comply with a legal requirement or obligation;
• carry out one of our public tasks (statutory functions);

We do not usually need ask  for or need  your consent to hold and use your personal information  however, if we do, you have the right to withdraw consent at any time.

At the time we collect the information from you – whether that is on an on-line or paper form, by email or by phone or via our web-site or an app we will always aim to make it clear to you what we  do with your information.  This will usually be in a short Privacy Notice – because we don’t  think you want a full explanation every time you contact us.

Our general Privacy Statement can be viewed here. The aim of the general Privacy Statement is to give you  a full explanation of  how and why we collect and use your personal data. We also provide  Privacy Information that  is specific to departments.  

If you have any questions about how we use your personal information, please contact our Data Protection Officer (see section below).

Data Protection laws  give you other rights  (as well as the rights to be informed and  to access information explained above) . These rights do not apply  in all circumstances - it depends on why  we hold your information . 

These rights are:

• The right to rectification (to  correct your data if you think it is wrong)
• The right to erasure (the right to be forgotten)
• The right to restrict processing (we can store your personal data but not use it)
• The right to data portability (to  obtain  from us and re-use personal data that you have given us)
• The right to object (to ask us to stop using your personal data)
• Rights in relation to automated decision making and profiling

You can exercise any of these rights verbally or in writing –  we have one calendar month to respond to you. We can increase this , if we need to, by a further  two months where the request is complicated or if we receive a number of requests from you.

If you wish to exercise any of these other rights (other than subject access), you can use this form ^{(docx, 181kb)} or contact our Data Protection Officer 

• Email: legal@winchester.gov.uk 
• Post: Data Protection Officer, Winchester City Council, City Offices, Colebrook Street, Winchester SO23 9LJ
• Phone: 01962 840 222

We are working with community partners, through Community First, to provide support and assistance to vulnerable residents. Information on residents requiring assistance is provided to us by Hampshire County Council, where residents register for support through the Coronavirus Hampshire Helpline (0333 370 4000).

Information is shared to:

• Facilitate the health and wellbeing of people who are extremely vulnerable
• Ensure they can obtain essential supplies (groceries and medicine)
• Enable access to social contact and support with basic care needs

The council, as a data controller for the personal data shared by the Coronavirus Hampshire Helpline, or collected directly from residents, undertakes to:

• Access and process the information only for the purpose of delivering the service
• Comply with data protection legislation at all times and not transfer information outside the UK or European Economic Area
• Only process the information for as long as is necessary to deliver the service
• Only share or allow access to the information where it is strictly necessary

We also ensure that any third party with whom we share the information, including our systems suppliers, shall meet the requirements above and has put in place suitable technical, security and organisational measures to protect the information.

The legal basis for the council to process and share the information is provided by the General Data Protection Regulation (GDPR) Article 6 (1) (e) public task. The council relies on GDPR Article 9(2) (g) substantial public interest and paragraph 6, Schedule 1 of the Data Protection Act 2018 'governmental purpose' to process and share special category (sensitive) personal information such as people's health information.

The third parties with whom we will be sharing necessary and relevant information are all working together to ensure a coordinated response to residents of the Winchester district and to provide the service to extremely vulnerable people.

This may entail staff and/or volunteers from Community First and staff and/or volunteers working in other voluntary sector organisations contacting people directly, by telephone where possible, to offer them services and support, including help with shopping or food deliveries, regular outbound calls/welfare checks, prescription drop-off support and other forms of assistance as agreed with the person such as dog walking.

Winchester City Council and Community First will obtain consent from the person to proceed with any calls and to sharing their information with any other third parties.

In situations where a person is believed to be at risk of harm, their information may be shared with other relevant people or organisations to safeguard them from harm or to protect their vital interests.