Assembly Commission

How We Respond to Data Subject Access Requests

How we manage personal information

The Northern Ireland Assembly Commission (“the Assembly Commission”) takes seriously its responsibilities in processing personal data. Under data protection law, the Assembly Commission is required to ensure that personal data it processes is:

processed lawfully, fairly and in a transparent manner;
collected for specified, explicit and legitimate purposes and not further processed for incompatible purposes;
adequate, relevant and not excessive;
accurate and up to date;
not kept for longer than is necessary;
processed in an appropriate manner to maintain security.

How to make a request for information that the Assembly Commission holds about you (a Data Subject Access Request)

What is personal data?

Personal data is information about identified, or identifiable, living individuals. Personal data can be held in many formats. For example, personal data might include paper documents, computerised records, photographs or videos, or a combination of these formats.

What are data subject access requests?

Under data protection law, individuals have certain rights in respect of their personal data, including a right of access to personal data held about them by an individual or an organisation. You can request information on the personal data that the Assembly Commission holds about you by making a data subject access request.

What details should you include in your request?

When you send a data subject access request to the Assembly Commission, please include the following details:

Your full name and address (including email address if you wish an email response) together with a phone number so we can contact you if we require further details or if we need to clarify any part of your request; and
Additional information which will help us to identify you. This includes the dates during which you had contact with us, any reference number quoted on any correspondence with us and the name of the office with which you corresponded.

Please be as specific as possible about the personal data that you are requesting. We may contact you if we require more details to help us respond to your request.

How do I make a request?

You can make your request orally or in writing. To help us process your request and find the information you have requested, we would be grateful if you would make your request in writing if possible:

By email: martina.dalton@niassembly.gov.uk

By post:
Information Standards and Data Protection Officer,
Room 241 Parliament Buildings,
Ballymiscaw,
Stormont,
Belfast
BT4 3XX

An example of a letter you could use appears at the end of this document but you can also use your own words.

How will we respond to your request?

The Assembly Commission will ensure that you receive a reply to your subject access request without undue delay and, in any event, within one month of receiving your request. If the request is complex, or there are a number of requests, we may extend the period for responding by a further two months. If we extend the period for responding, then we must inform you of this within one month of receipt of the request and explain the reason(s) for the delay.

What will it cost?

We will respond to your subject access request free of charge.

If, however, your request is complex or excessive (e.g. because of its repetitive character), we may:

Charge a reasonable fee, taking into account the administrative costs of providing or transmitting the personal data; or
Refuse to act on the request.

If we are not going to comply with the request, then we will inform you of the reasons for this and inform you of your right to lodge a complaint with the Information Commissioner’s Office.

What information can I expect to be sent to me?

You are entitled to be told if any personal data is held about you by the Assembly Commission and if so, in addition to a copy of your personal data, to be provided with information as to:

The purpose of the processing;
The categories of personal data concerned (e.g. contact details, bank account information);
The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients overseas;
Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
The existence of the right to request rectification or erasure of personal data or restriction of processing of personal data or to object to such processing;
The right to lodge a complaint with the Information Commissioner’s Office;
Where the persona data are not collected from the data subject, any available information as to their source;
The existence of automated decision-making and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject; and
Where personal data are transferred outside the EU, details of the appropriate safeguards to protect the personal data.

The Assembly Commission will provide this information to you in a commonly used electronic form (unless you either did not make the request by electronic means or you specifically request not to be provided with the copy in electronic form).

Personal data relating to third parties

There may be circumstances in which the Assembly Commission finds that providing you with the information that you seek involves personal data relating to another individual or individuals. In these circumstances we may need to redact the personal data of those other individuals prior to providing you with your personal data.

For further information

Please contact the Information Standards and Data Protection Officer:

By post:
Information Standards and Data Protection Officer,
Room 241 Parliament Buildings,
Ballymiscaw, Stormont,
Belfast
BT4 3XX

Email: martina.dalton@niassembly.gov.uk

Subject Access Requests

You may find the following sample letter helpful when putting forward your request. It may be useful for you to keep a copy of your letter together with a record of any further correspondence.

Sample letter to request access to your personal data

Your name and address
Your contact phone or e-mail address
Date

For the Attention of: Information Standards and Data Protection Officer
Email: martina.dalton@niassembly.gov.uk
The Northern Ireland Assembly Commission
Room 241
Parliament Buildings
Ballymiscaw
Belfast
BT4 3XX

Please send me the information which I am entitled to access under Article 15 of the General Data Protection Regulation in relation to …………….

The personal data that I seek relates to [here you can include, for example, dates during which you had contact with us, any reference numbers quoted on any correspondence with us/the name of the Office with which you corresponded].

I have enclosed the following information to enable you to verify my identity: [list]

Yours sincerely,

[Your signature]