Your rights and choices

Individuals have several rights under data protection laws; these are as follows:

• The right to be informed – a privacy notice in relation to the purpose of processing will address this; there are privacy notices available in the Data Protection section of the Privacy Centre.
• The right of access, commonly known as a subject access request (SAR) – this means you have the right to access and receive copies of personal data held by an organisation about you
• The right to rectification – this means you have the right for incorrect or incomplete data held about you to be rectified
• The right to erasure, commonly known as the right to be forgotten (RTBF) – this means you can request all data held about you to be deleted
• The right to restrict – this links with some of the other rights and means you can request that the organisation restricts processing your data while the issue is resolved, for example if the data is incorrect and the rectification right is exercised.
• The right to data portability – this means you have the right to request an organisation provide your data in a machine-readable format, e.g. a CSV file and transfer it to another organisation
• The right to object – this means you can object to the processing and the controller has to stop unless it can prove a legitimate lawful purpose for the processing. The right to object is absolute in relation to marketing.
• Automated individual decision-making, including profiling – the Church currently does not process data in this way.

It's important to note that not all rights are absolute and it depends on the lawful basis for processing as to what rights apply. This will be detailed in the relevant privacy notices detailed here. You can exercise any of your rights with the Church of Scotland either verbally or in writing to Privacy@churchofscotland.org.uk

Complain to The Church of Scotland

Under data protection laws you have the right to complain to the controller (the Church of Scotland) regarding how your data is processed, the purposes, the lawful basis, etc. To exercise this right and make a complaint, please email Privacy@churchofscotland.org.uk

You can also telephone 0131-225-5722 and ask for the Data Protection Officer (DPO), or you can send your complaint in writing to:

Data Protection Officer (DPO)
Law Department
The Church of Scotland
121 George Street
Edinburgh
EH2 4YN >

On receipt of your complaint, your complaint will be acknowledged within 30 days. The DPO will investigate without undue delay and fully report back the findings of the investigation. If you are still not satisfied with this outcome, you can complain to the regulator of data protection, the UK Information Commissioner's Office (ICO).

Complain to the Regulator

If you are not satisfied following the investigation of your complaint or if you continue to have an issue with the processing of your personal data, you have the right to make a complaint to the regulator, the UK Information Commissioner's Office (ICO), at the following address:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Or by emailing them at icocasework@ico.org.uk or calling 0303-123-1113.

The ICO has guidance and a complaints procedure on their website: How to make a data protection complaint to an organisation and what to expect if a complaint is made to the ICO: Data protection framework