Data Protection Notice - Other Rights

The Right to Erasure/Right to be Forgotten

The right to erasure is also known as “the right to be forgotten” and in general refers to an individual’s right to request the deletion or removal of personal information where there is no compelling reason for NHSGJ to continue using it.

As with other rights, there are particular conditions around this right and it does not provide individuals with an absolute right to be forgotten.
Individuals have the right to have their personal information deleted or removed in the following circumstances:

  • When it is no longer necessary for the purpose for which it was collected.
  • When NHSGJ no longer have a legal basis for using your personal information, for example if you gave us consent to use your personal information in a specific way, and you withdraw your consent, we would need to stop using your information and erase it unless we had an overriding reason to continue to use it.
  • When you object to NHSGJ using your personal information and there is no overriding legitimate interest for us to continue using it.
  • If we have used your personal information unlawfully.
  • If there is a legal obligation to erase your personal information for example by court order.

NHSGJ can refuse to deal with your request for erasure when we use your personal information for the following reasons:

  • To comply with a legal obligation for the performance of a public interest task or exercise of official authority.
  • For public health purposes in the public interest.
  • Archiving purposes in the public interest, scientific research historical research or statistical purpose.
  • The exercise or defence of legal claims

When using personal information our legal basis is usually that its use is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us under the NHS Scotland Act as noted previously. This means that in most circumstances we can refuse requests for erasure. However, we will advise you of this as soon as possible following receipt of your request

The Right to Restrict Processing
You have the right to control how we use your personal information in some circumstances. This is known as the right to restriction. When processing is restricted, NHSGJ is permitted to store your personal information, but not further use it until an agreement is reached with you about further processing. We can retain enough information about you to ensure that your request for restriction is respected in the future.

Examples of ways you can restrict our processing would be:

  • If you challenge the accuracy of your personal information, stop using it until we check its accuracy.
  • If you object to processing which is necessary for the performance of our tasks in the public interest or for the purpose of legitimate interests, we will restrict our processing while we consider whether our legitimate grounds override your individual interests, rights and freedoms.
  • If our use of your personal information is found to be unlawful and you ask for restriction instead of full erasure we will restrict our processing.
  • If we no longer need your personal information but you need it to establish, exercise or defend a legal claim, we will restrict our processing.
  • If we have shared your personal information with any individuals or organisations, if we restrict our processing, we will tell those individuals or organisations about our restriction if it is possible and not an unreasonable amount of effort.

Whenever we decide to lift a restriction on processing, we will tell you.

The Right to Data Portability
The right to data portability allows individuals to obtain and re-use their personal information for their own purposes across different services. It allows them to move, copy or transfer personal information easily from one IT environment to another in a safe and secure way. For example: it enables consumers to take advantage of applications and services which can use their information to find them a better deal.

The right to data portability only applies when the individual has submitted their personal information directly, through electronic means to NHSGJ. This means that in most circumstances the right to data portability does not apply within NHSGJ.

The Right in Relation to Automated Decision Making and Profiling
You have the right to object to any instances where a decision is made about you solely by automated means without any human involvement, including profiling.

NHSGJ does not undertake any decision-making about you using wholly automated means.

How to Raise a Data Protection Concern or Complaint

At NHS Golden Jubilee, we are committed to handling your personal information in accordance with data protection law and maintaining your trust.

If you have concerns about how your personal data has been collected, used, shared, or protected, you have the right to raise a data protection concern or complaint.

Your Right to Raise a Concern or Complaint

You can contact us at any time if you:

  • Believe your data has been used incorrectly or unlawfully;
  • Are unhappy with how we have responded to a data protection request (e.g. access, rectification, or restriction); or
  • Have concerns about a potential data breach involving your personal information.

Our Data Protection Complaints Process

NHS Golden Jubilee operates a formal Data Protection Complaints process to ensure that all concerns are:

  • Logged and acknowledged;
  • Assessed in line with data protection legislation;
  • Investigated where appropriate; and
  • Responded to in a clear and timely manner.

We will:

  • Acknowledge receipt of your complaint. Legislation states we should do this within 30 days, however we aim to acknowledge receipt as soon as possible within those 30 days.
  • Investigate your complaint without undue delay.
  • Keep you informed of progress during the investigation; and
  • Provide a formal response setting out the outcome and any actions taken. There is no fixed statutory deadline to provide a response by. ICO guidance states within a reasonable period, guidance indicates up to 3 months maximum unless exceptional circumstances apply. You will always be kept informed of the progress of your complaint. 

How to Contact Us

You can raise a data protection concern or complaint by contacting our Data Protection Officer:

Sharon Stott
Data Protection Officer (DPO)
NHS Golden Jubilee
Digital Services
Golden Jubilee National Hospital
Agamemnon Street
Clydebank, G81 4DY

Email: ig@gjnh.scot.nhs.uk

(Your Data Protection Complaint will be managed confidentially and in line with our internal governance procedures. They will be handled in line with statutory requirements under relevant UK data protection legislation and organisational procedures.)

Escalation and Your Rights

If you remain dissatisfied with how we have handled your concern, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

Further information is available via the ICO website:
Information Commissioner’s Office