Your personal data and rights

This guide explains the rights you have in relation to your personal information (personal data) and what you can ask the Crown Office and Procurator Fiscal Service (COPFS) to do with it. It explains how to make a request for these rights and what to do if you are unhappy with how we have handled your personal information.

COPFS may hold personal information about you (also known as personal data) if you are:

• a person affected by crime
• a witness to a crime
• someone accused of a crime
• someone who has contacted or otherwise dealt with COPFS

The information may include witness statements, details of police charges and other information connected to the prosecution.

More information about how COPFS collects, uses, stores and shares personal information is available in our COPFS privacy notice.

Data protection law (UK GDPR and the Data Protection Act 2018), gives you the following rights in relation to your personal information:

• Right to be informed – you have the right to be told how your personal information is collected, used, stored, and shared
• Right of access –you can request access to the personal information we hold about you. This is also known as a subject access request or SAR.
• Right to rectification – you can ask us to correct inaccurate or incomplete personal information
• Right to erasure – also known as the 'right to be forgotten', you can request deletion of your personal information in certain circumstances
• Right to restrict processing – you can ask us to limit how we use your personal information
• Right to data portability – you can request your personal information in a format that allows you to move it to another service. This only applies to information you have given to us.
• Right to object – you can object to the processing of your personal information in certain situations
• Rights related to automated decision-making and profiling – you have rights where decisions are made solely by automated means

These rights don’t apply in every situation. Some rights are different when COPFS uses personal information for law enforcement purposes (preventing, investigating or prosecuting crime or carrying out criminal penalties). When your personal information is used for those purposes, the rights to data portability and to object don’t apply. If restrictions apply to any other rights, we will explain this when we respond to you.

For more information, visit the UK Government’s data protection guidance or the Information Commissioner’s Office (ICO).

Costs

There is no charge to make any request to COPFS, including requesting a copy of your personal information.

You have the right to ask for access to personal information that COPFS holds about you. This is called a subject access request or a SAR.

You can make a subject access request by:

• completing our subject access request form
• emailing SubjectAccessRequests@copfs.gov.uk
• calling 0300 020 3000 and asking to speak to a member of the Subject Access Team in the Information Governance and Security Assurance Unit
• writing to:

Information Governance and Security Assurance Unit
Policy and Engagement
Crown Office
25 Chambers Street
Edinburgh
EH1 1LA

We recommend using our form because it asks for the information we need to help us deal with your request. If you do email or write to us, please include your full name, contact details, and a clear description of the information you are requesting.

However, you send your request, we will also need copies of your identification. Please include two types of ID, so we have proof of your name, date of birth, and address.

If you believe the personal information that we hold about you is inaccurate or incomplete, you can request that we correct or rectify it.

To request a correction:

• Email us at dataincidents@copfs.gov.uk
• Include your name, contact details, and specify the data you believe is incorrect along with the correct information.

We may need to confirm your identity before considering your request. If that is the case, we will ask you to provide proof of name, date of birth, and address.

You can ask COPFS to delete (or erase) your personal information in certain circumstances.

To request deletion of your personal information:

• Email us at dataincidents@copfs.gov.uk
• Provide your name, contact details, and explain why you believe your information should be deleted.

We may need to confirm your identity before considering your request. If that is the case, we will ask you to provide proof of name, date of birth, and address.

This right doesn’t apply in every situation and there are circumstances where we need to keep your information. We will consider your request and explain our decision where that is the case.

Once we have received your request, along with any additional information and identification needed to progress it, we will normally respond within one calendar month.

If we need more time, we will tell you and explain when you can expect to receive a response.

If you are unhappy with how COPFS has handled your personal information or responded to a request concerning your data protection rights, you have the right to make a data protection complaint.

What can I complain about?

You can complain about issues such as:

• how we have handled your personal information
• how we responded to your subject access request (SAR) or request for other rights
• how we have stored and protected your personal information, including if you have been affected by a personal data breach
• how long we keep your information or whether it is accurate

A data protection complaint must relate specifically to how we have handled your personal information and/or our compliance with data protection law.

If your concern is about our general service (rather than how we handled your personal information), it will be considered under our separate complaints process.

Who can make a complaint?

You can make a complaint if:

• COPFS has handled your personal information
• you are acting for someone else with their permission.

If you are complaining on behalf of someone else, you must provide their written authorisation. We may also need to confirm your identity before investigating the complaint.

You can make a data protection complaint by:

• completing our data protection complaint form
• emailing DataIncidents@copfs.gov.uk or if you have a complaint about a Subject Access Request (SAR) emailing SubjectAccessRequests@copfs.gov.uk
• writing to:

Information Governance and Security Assurance Unit
Policy and Engagement
Crown Office
25 Chambers Street
Edinburgh
EH1 1LA

• in person at a COPFS office.

If you make your complaint by telephone or in person, we will record the details you provide.

We may ask you to put your complaint in writing if we aren’t clear about the nature of your complaint or if the complaint is complex.

What should I include in my complaint?

Please tell us:

• your full name and contact details
• any relevant COPFS case or request reference numbers
• what you believe has gone wrong
• how this has affected you
• the outcome you are seeking
• any evidence or documents that may help us consider your complaint.

How long do I have to make a complaint?

You should normally complain within six months of becoming aware of the issue.

We may consider an older complaint depending on the circumstances. However, the passage of time may limit what we can investigate or do to resolve the matter.

What happens after I make a complaint?

Once we receive your complaint, we will:

• acknowledge it within five working days
• contact you if we need clarification or more information
• confirm your identity or the authority of a representative, where necessary
• investigate what happened
• provide you with a written response within 20 working days.

If we need more time, we will tell you and explain when you can expect to receive a response.

If you are not satisfied with our response to your data protection complaint, you can ask the Information Commissioner’s Office to consider the matter.

You can contact them in the following ways:

• Online: https://ico.org.uk/make-a-complaint/
• By post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• By phone: 0303 123 1113