Rights for data subjects

Right to be informed

The data subject should have been provided with this information when their personal data was first collected (or been directed to a location, such as our website, where it can be found). If the data subject already has this information then they cannot exercise this right.

Right of access

The data subject (being an individual whose personal data is being processed by an organisation) is entitled to a range of information about the processing of their personal data and copies of that data. Formerly known as a Subject Access Request.

Right of rectification

The data subject is entitled to have records updated if they are incorrect or out of date. However, Brooke may need to make further checks in some circumstances which may result in our disputing that the data we hold is incorrect or out of date. We may restrict processing whilst investigating your application.

Right to erasure

Also known as the right to be forgotten. 

The right applies if:

• the data subject provided the information with their consent 
• the data is no longer necessary and the timescale for us to keep records has expired
• the data is being unlawfully processed (ie. we have processed data for a purpose we were not entitled to)
• the data subject has successfully objected to the data processing under the right to object 
• we are obliged to erase the data to comply with a legal obligation.

The right does not apply if:

• the data is required for a contract to which the data subject a party (such as employment or consultancy contracts, if applicable)
• we need the information to provide a service which is required by law
• the information is needed for a legal obligation
• we believe that the data is needed for a task in the public interest
• the data is required for archiving in the public interest, or for scientific or historical research purposes.

Right to restrict processing

The data subject is asking for restrictions to be put in place in a number of different areas of processing, such as where the data subject is contesting the accuracy of data held or if the data subject considers that our processing is illegal and wishes to preserve it whilst pursuing a complaint.

Right to object to processing

The data subject is objecting to processing in the following circumstances:

• Thelawful basis for the processing is ‘legitimate interests’ or for the performance of a task in the public interest/exercise of official authority. In this case we must stop processing personal data unless we are able to show compelling legitimate interest for the processing which override the interests, rights, or freedoms of the data subject. There may also be situations where the data needs to be processed for the establishment, exercise or defence of legal claims, in which case we do not need to comply with requests.
• The processing is for the purpose of direct marketing. 

Rights in relation to automated decision making and profiling

Data subjects have the right to choose to not be subjected to automated decision making and profiling. Brooke is only allowed to carry out this type of processing in the following situations:

• when it is necessary for the entry into or the performance of a contract
• it is authorised under UK law
• it is based on explicit consent.

Right to data portability

Data subjects have the right to request their data is put into a standard format and provided to them. 

More detailed explanations of these and other data subjects' rights can be found on the Information Commissioner's Office website.

Making a request

If you wish to make a request to Brooke, we may be able to deal with it by telephone or by email. 

If your request is more complex - such as a request for access to the personal data Brooke holds about you - you may find it easier to make the request in writing (this may be in electronic form).

Before we can act on any request, we must be:

• sure of your identity
• sure you have the necessary authority to make the request on behalf of the data subject if you are not the data subject,
• provided with sufficient information to be able to action your request
• supplied with information from you in order to locate the information you seek where you are seeking access to personal data

In all cases we will try to respond to your request and reply to you confirming that we have actioned it or, if we have not done so, provide you with an explanation why.

If you are making a request for a right of access to your personal data you are entitled to:

• be informed whether your personal data are being processed by Brooke
• have the information constituting the personal data communicated to you in a permanent form (in commonly used electronic form in many cases)
• be given supporting explanatory materials including a summary of the sources, recipients and purposes of the processing.

Completing a data subject's request form

You may make a request in writing in any way you choose. You can download a data subject's request form below, which explains where you should send your request as well as the various ways you can provide us with proof of your identity. You are not, however, obliged to use this form.

What happens after you submit your request

On receipt of your completed request, verification of your identity and sufficient details to enable us to deal with your request, Brooke is obliged to respond within one calendar month to your request, which may be extended in certain circumstances. 

The request will be actioned by us subject to any applicable exemptions. Where you are making any request for access to your personal data, the data will be provided as of the date of receipt of your request and all necessary supporting documents and proofs of identity.

If you have any reason to believe that Brooke has not dealt correctly with your request, please take the matter up with Brooke’s GDPR Programme Manager first. If you are still not satisfied, you should contact the Information Commissioner who is officially appointed to consider such complaints.

More information

For information about how Brooke uses your personal data please see our privacy statement. If you are an employee, contractor or trustee, we will have supplied you with a privacy notice which you should consult.

Please note that the Freedom of Information Act and the Environmental Information Regulations do not apply to Brooke.