Policy paper

Individual Rights Policy

Updated 5 July 2018

Introduction

This policy explains the rights you have as a user of the Disclosure and Barring Service’s (DBS) services. This document provides you with information regarding how we at the DBS will fulfil our obligations under the General Data Protection Regulation (GDPR). This document will direct you to additional guidance which may be of assistance where appropriate.

Reference to a number of these rights is also contained within the relevant Privacy Notices. We do have other Privacy Policies/Notices that cover our other statutory functions. These can be found here.

Your rights under GDPR include:

This document sets out how the DBS will meet each of your rights.

Your right to be informed

Policy Statement

The right to be informed encompasses our obligation to provide you with ‘fair processing information’, typically through a privacy notice as referenced above. It emphasises the need for transparency over how we use personal data.

DBS will be transparent with regards to the way your personal data is used through the use of a relevant Privacy Notice depending upon the service you use. You will need to ensure that you read the appropriate Privacy Notice before submitting your personal data to us.

Your right to access your personal data

Policy Statement

You have the right to request a copy of the personal information DBS holds about you, this is known as a Subject Access Request (SAR).

On receipt of a valid SAR application we will tell you whether we hold any data about you and provide you with a copy. Further information on how to apply can be found here.

Your right to request information held is accurate

Policy Statement

You have the right to request correction of any data that you believe is inaccurate. Where the DBS is not the author, creator or originator of the information, this request will be forwarded to the relevant party for action.

Disclosure-related information

It is the duty of you and the relevant Registered Body or Responsible Organisation who verified your identity, to ensure the information you have submitted on your Disclosure application form is accurate and verified.

If you believe you have submitted an error on an application that is still in progress you will need to contact us immediately on 03000 200 190.

If you wish to dispute information contained on a completed certificate you can raise a dispute by contacting the DBS helpline on 03000 200 190.

Third parties can also dispute a DBS certificate if they have all the necessary information:

• the applicant’s name
• the applicant’s date of birth
• the certificate number and issue date
• the applicant’s address

Where this is the case the applicant will be notified by DBS that a third party has raised a dispute.

Barring-related information

Where the barring referral information was provided to DBS by another party, this request will be forwarded to the relevant originating party and you should contact them directly. They will be asked to consider the request to correct the information e.g. if your request relates to an employer statement, strategy minutes or the Police National Computer (PNC). If you believe any of the information we hold on you is incorrect please contact the DBS helpline on 03000 200 190 or contact us via e-mail at dbsdispatch@dbs.gov.uk. We will do everything we can to make sure that your concerns are addressed as quickly as possible and that amendments are made, where they can be.

Your right to erasure of your personal data

Policy Statement

In certain circumstances you have a right to have personal data held about you erased. At the DBS we will only do this if certain criteria are met. There are some circumstances where this cannot be done therefore we advise you to seek independent advice before submitting an application to us.

Any requests for information to be erased will be considered on a case-by-case basis.

There are some specific circumstances where the right to erasure does not apply and we may refuse your request.

Your right to restrict processing

Policy Statement

You have the right to request that DBS restricts the processing of your information where it has been established that one of the following applies:

• during the period of rectification accuracy of personal data is contested
• processing is unlawful
• an individual has requested the information is retained to enable the establishment and/or exercise or defence of legal claims
• pending verification of the outcome of the right to object to automated decision making
• where processing has been restricted

It should be noted that this is unlikely to apply to information supplied under Safeguarding & Vulnerable Groups Act 2006 (SVGA). SVGA Sch 3 Prt 3 13 (1)/ SVGO, the Safeguarding Vulnerable Groups (Northern Ireland) Order 2007.

DBS must ensure that in respect of any information it receives in relation to an individual from whatever source or of whatever nature it considers whether the information is relevant to its consideration as to whether the individual should be included in each barred list.

DBS customers can request restriction of processing for any of the above reasons until these are resolved. Should you wish to restrict processing on Disclosure you will need to contact us on 03000 200 190.

Your right to data portability

Policy Statement

You have the right, where this is technically feasible and if you wish, to electronically receive any personal data you have provided to DBS electronically, which we have processed on a consent basis. This will help enable you to share this information with another if you wish.

All requests for portability will be considered on a case-by-case basis.

Please note standard and enhanced certificates are processed under Part V Police Act 1997 and barring information is processed under the Safeguarding and Vulnerable Groups Act 2006. Therefore this information falls outside of the right to Data Portability.

Your right to object to DBS processing your personal information

Policy Statement

You have the right to object to processing of your information at any time. Should you wish for the DBS to stop processing a disclosure application you will need to withdraw the application.

It should be noted that this is unlikely to apply to information supplied under Safeguarding Vulnerable Groups Act Sch 3 Prt 3 13 (1) / SVGO, the Safeguarding Vulnerable Groups (Northern Ireland) Order 2007. All such requests will be considered on a case-by-case basis.

Please contact the DBS helpline on 03000 200 190 or contact us via e-mail at dbsdispatch@dbs.gov.uk.

Your right to object to automated decision making (including profiling)

Policy Statement

Disclosure process

Police National Computer (PNC) matching is generally an automated process. For standard and enhanced certificates, if the system identifies that ‘potentially’ there is police information held about you by a police force this is then sent to the relevant police force for consideration regarding information which may be disclosed on your certificate.

You have the right to object to any automated decision-making. It should be noted that you would need to inform us of this on submission of your application by contacting us on 03000 200 190.

Barring process

Within the barring process, automated decision-making is limited to the processing of information relating to certain serious criminal offences. If cautioned or convicted for such offences you may be automatically included in the children’s and/or adults’ barred list. The law requires DBS to do this. SVGA Sch 3: Prt 1, 1, (3) & Prt 2, 7,(3).

Letters informing you of your barred status will explain when this action has been taken and confirm your right to object. Exercising this right will only result in removal from a list if a processing error has occurred or the information upon which the decision was based was incorrect.

DBS do not currently undertake any profiling activities.

Your right to an effective judicial remedy against a controller or processor

Policy Statement

If you believe your rights have been infringed as a result of the processing of your personal data, you are able to take proceedings against the DBS as a controller or any DBS data processors as referenced in the relevant privacy notice.

DBS are unable to advise you in this regard. You should therefore seek your own independent legal advice.

Your right to representation

You have the right to appoint a not-for-profit body, association to act on your behalf where you believe your following rights have not been adhered to:

• right to lodge a complaint with a ICO (GDPR Article 77)
• right to effective judicial remedy against ICO (GDPR Article 78)
• right to an effective judicial remedy against a controller or processor (GDPR Article 79)

DBS are unable to advise you in this regard. You should therefore seek your own independent legal advice.

Your right to compensation and liability

A person who has suffered material or non-material damage as a result of infringement of the regulation shall have the right to receive compensation from the DBS as a controller, or DBS data processors as referenced in the relevant Privacy Notice.

The DBS or its processors (as contained within the relevant Privacy Notice) shall be exempt from liability where it is proven we are not in any way responsible for the damage.

DBS are unable to advise you in this regard you should therefore seek your own independent legal advice. If you wish to make a legal claim against the DBS please send this to DBS Legal Services at dbslegalservices@dbs.gov.uk.

Your right to lodge a complaint to the Information Commissioners Office (ICO)

Policy Statement

If you make a complaint to DBS regarding the way in which we have processed your personal data and remain dissatisfied with the response received, you have the right to lodge a complaint to the ICO at the following address:

The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

https://ico.org.uk/

Glossary

Abbreviation
DBS	Disclosure and Barring Service
GDPR	General Data Protection Regulation
ICO	Information Commissioner’s Office
SAR	Subject Access Request
SVGA	Safeguarding Vulnerable Groups Act 2006
SVGO	Safeguarding Vulnerable Groups (Northern Ireland) Order 2007
PNC	Police National Computer