If for example an individual has requested that their information is erased, refer to the Data Subject Rights Options in the first instance. If you are not sure speak to your Business Unit’s BMT lead or Data Champion, or to the Deputy Data Protection Officer (Kate Butcher in CSU) or the Data Protection Officer (Tom Penlington in Legal).
If we are legally required to comply with the request but the software your Business Unit uses and stores data referring to the individual is not UK GDPR compliant (in this example, not providing the functionality to erase data on that individual), there are a few actions to consider:
Even if the exact request cannot be complied with because of the software, if a system note (whether that be text or a highlighting tool) is available to be put in place as an ‘alert’, that is preferable. If however there is no such functionality available, a separate note or spreadsheet (accessible by everyone who uses that software) should be created by way of Word or Excel for example, detailing the request, date, and action required)
The DPO should be made aware of this, by emailing dpo@molevalley.gov.uk. The software provider should also be made aware of the lack of functionality and difficulties experienced as a result of the software not being UK GDPR compliant
If we are in a contract with the software supplier and there are no assurances from them about offering to provide the functionality required, it is a corporate risk-based decision whether another software supplier should be sought at the conclusion of that contract
If we are unable to comply – where we are legally required to – with the request, the individual concerned must be informed, with the additional step/s having been taken by us to reassure that individual
If the individual is unhappy with the action taken by us, you can advise them they can complain to the Information Commissioners Office (ICO): Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF
