Personal information charter

The Disabled Persons Transport Advisory Committee (DPTAC) data protection policy

This policy explains how The Disabled Persons Transport Advisory Committee (DPTAC) will, as a data controller, comply with the Data Protection Act 2018 and associated legislation including the General Data Protection Regulation (GDPR).

Your privacy

We know how important it is to protect your privacy. If we need to collect, store or otherwise use your personal data, we will comply with the Principles and other provisions of data protection law.

What allows DPTAC to process your personal data

We will only process your personal data if we have a lawful basis to do so. Most of the processing we do relates either to contracts, our public tasks, or is necessary for our legitimate interests. Where we process more sensitive, or ‘special category’, personal data, we will ensure that we meet the relevant requirements.

When we collect your personal data

When we collect your personal data, we will provide you with specific information including:

  • how to contact our data protection officer
  • the purpose and legal basis for our processing
  • where relevant, who your data will be shared with and whether it will be transferred to a third country (and if so the safeguards that will be put in place to protect it)
  • how long it will be kept for
  • your rights in connection with that processing
  • how to complain
  • whether you are obliged to provide your data, and if so the possible consequences of not doing so

Where your personal data was sent to us by a third party, we will tell you who that third party was and, were relevant, provide you with the above information. We will normally do that within one month.

Your rights

The GDPR gives individuals a number of rights in relation to their personal data. The most commonly used right is subject access, which allows you to request a copy of any data we might hold on you. For a full description of your rights and how they might apply to the way we use your personal data, please visit the Information Commissioner’s Office website. DOHL will uphold your rights to the extent that they apply to the way we process your personal data.

If you wish to exercise any of your rights, including accessing a copy of your personal data, please contact DPTAC[email protected]. If you are unknown to us, we will need you to provide proof of identity before we can start processing your request.

Our privacy information notice

The purposes for which we process personal data include:

  • maintaining our accounts and records
  • consideration and investigation of complaints
  • answering queries

When we share information

We may share personal data within our organisation or with other bodies where we are permitted to do so by law. There are some cases where we can pass on your data without telling you – for example, to prevent or detect crime, or in order to produce anonymised statistics. In all cases, whether data is shared internally or externally, we will comply with data protection law.

Correspondence

When you write to DPTAC we will look after any personal information you disclose to us and use it only as necessary to provide you with an answer. This will be in accordance with our task as a public authority to be accountable and transparent about the functions and policies that we are responsible for.

Where your correspondence relates to a policy area or issue for which another public body has responsibility, we will, in the first instance, seek your approval before passing the correspondence to them to respond to you. In the case of requests for information that are handled under the Freedom of Information Act 2000, DPTAC will use your personal data as necessary to comply with those laws. We may need to consult with other public authorities in central government where a coordinated response is required. Where an information request would be more appropriately directed to another organisation, our response will advise you where it should be sent, but the request will not be forwarded.

A record of your correspondence will be held by us for at least 3 years and then, under normal circumstances, deleted. It will only be kept for longer where it is necessary in connection with an ongoing issue.

Our data protection officer

Our DPO informs and advises us on how to comply with data protection law, and provides assurance that we are doing so. DPTAC’s designated data protection officer (DPO) is part of the Department for Transport’s data protection team.

Our DPO can be contacted at:


Data Protection Officer
Department for Transport
Ashdown House
Sedlescombe Road North
St Leonards-on-Sea
East Sussex
TN37 7GA

Email: [email protected]

When contacting our DPO, please make clear that your correspondence is about DPTAC.

The steps we take to keep your data secure

We take information security seriously and will protect your personal data from unauthorised access, accidental loss, destruction and damage. We ensure that staff who routinely access personal data as part of their jobs receive appropriate training in how to protect it, and we carry out regular reviews and audits to ensure that our methods of collecting, holding and processing personal data meet the government’s security standards and industry good practice. We will only transfer your personal data overseas where appropriate safeguards are in place to protect it. The cross-government security policy framework on GOV.UK sets out the government’s approach to protective security.

Data breach notification

DPTAC will do everything it can to keep your personal data secure. If, despite this, a breach occurs which creates a risk to your rights and freedoms, we will ensure that the Information Commissioner’s office is informed without delay, and in any event within 72 hours after we have become aware of it.

Where we assess that there is a high risk to you, we will ensure that you are notified without undue delay. Where it is not possible to contact you directly, we will attempt to make you aware through other means, such as a public announcement. The information we will provide to you will include:

  • the contact details of the department’s data protection officer
  • the likely consequences of the breach
  • details of the measures already taken or planned to address the breach including any steps taken to mitigate potential damaging effects

How to make a complaint

If you’re unhappy with the way we have handled your personal data and want to make a complaint, please write to our data protection officer using the details provided above.

We will acknowledge your complaint within 5 working days and send you a full response within 20 working days. If we can’t respond fully in this time, we will write and let you know why and tell you when you should get a full response.

If you remain dissatisfied, or if you require independent advice about data protection, privacy and data sharing issues, contact:

Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Contents