Data Protection

The UK General Data Protection Regulation and the Data Protection Act 2018 known together as data protection law places strict requirements on any organisation which processes personal information. The law states that personal information must be:

1.    processed fairly, lawful and transparently

2.    collected for specified, explicit and legitimate purposes

3.    adequate, relevant and limited to what is necessary

4.    accurate and kept up to date

5.    kept for no longer than is necessary

6.    processed in a manner that ensures appropriate security

These are known as the data protection principles.

As well as applying the data protection principles, to process personal information CFRS must ensure it has a lawful basis for doing so. The lawful bases are set out in data protection law and include consent, legal obligation, or where the processing is necessary to perform a task in the public interest. 

Your rights

Data protection law gives you certain rights in relation to your personal data including the right to have inaccurate data corrected and to obtain a copy of it.

Full details of your rights under data law can be found on the Information Commissioner’s Office website or in the Service’s Privacy Notice. 

Access to your Personal Information (Subject Access Request)

To request your personal data that Cumbria Fire & Rescue Service hold please send your request to InformationGovernance@cumbriafire.gov.uk

From the date when we receive your request and have confirmed your identify (we may need to ask for ID), we will have 1 calendar month to provide you with a response. We can however extend this to three months if the request is complex. If this is the case, we will let you know within 1 calendar month and tell you why.

There is generally no charge for providing you with your information but there are some circumstances when there might be. For example, if the request is excessive or for additional copies. If there is any charge, we will advise you within 1 calendar month and will ensure the fee is reasonable and only relates to the administrative cost of responding.

Please be aware that in some circumstances we may not be able to provide you with all personal information held by the Service. This would likely be the case if disclosure of the information would identify third parties or would prejudice the prevention or detection of crime. 

Access to Personal Information (Third Party Requests)

There are occasions when Cumbria Fire & Rescue Service may share information with third party organisations. These will likely relate to occasions when requests relate to:

·         the prevention or detection of crime

·         the apprehension or prosecution of offenders

·         disclosures required by or made in connection with legal proceedings

Third parties most likely to be able to make relevant requests in relation to the above are, for example:

·         police

·         statutory authorities with powers to prosecute, (eg Customs and Excise; Trading Standards, etc.)

·         solicitors

·          other agencies, according to purpose and legal status

If your organisation needs to request personal information that is held by us for the purposes listed above, please contact information.governance@cumbriafire.gov.uk.  Please ensure you state which exemption under the Data Protection Act 2018 you are relying on, the UKGDPR Article 6 lawful basis and where relevant the statutory function you acting under.

Data Protection Complaints/ right to erasure/right to rectification

If you wish to make a complaint in relation to how CFRS has handled your personal information or you wish to exercise your right to request rectification or erasure of your personal data, please contact the Data Protection Officer at InformationGovernance@cumbriafire.gov.uk  or write to:

Data Protection Officer 
Information Governance,

Carleton Avenue, 
Penrith 
CA10 2FA