Data rights and protections under UK GDPR

Under the UK General Data Protection Regulation (UK GDPR) you have a number of rights regarding your personal data. The following information identifies each of these rights and how ENTRUST applies this right to your personal data.

The right to be informed

This privacy policy sets out how we collect and use personal data. The policy is available on the ENTRUST website and is provided in ENTRUST Online (EOL) at the point of enrolment. Furthermore, the policy is provided to the EB main contact in the EB enrolment pack.

The main contact of each EB is responsible for ensuring that all contacts and governing members of the EB are informed of, and provided with a copy of, ENTRUST's privacy policy.

The right of access (also known as subject access requests)

Under UK GDPR you have the right to obtain:

  • Confirmation that your data is being processed;
  • Access to your personal data; and
  • Other supplementary information - that largely corresponds to the information provided in this privacy notice.

We will provide this information to you free of charge unless the request is 'manifestly unfounded or excessive', when we may choose to charge an administration fee or refuse to respond.

We will endeavour to provide the information as soon as possible, and never more than one month after receipt of your request;

To ensure data security we will request evidence of identification before we supply any personal data.

The right to rectification

Where you tell us that the information we hold on our records about you is incorrect, we will update the data as quickly as possible, and no longer than one month after you have let us know.

If you are recorded as a current or past Governing Member of an EB and you tell us this is not correct, we will attempt to seek confirmation of this before taking any action to correct our records.

The right to erasure (also known as the right to be forgotten)

The UK GDPR introduces the right to have your personal data erased. However, this is not absolute and only applies in certain circumstances.

ENTRUST's lawful basis for processing personal data is 'for the performance of a task carried out in the public interest or in the exercise of official authority'. The right to erasure does not apply for this lawful basis.

The right to restrict processing

You have the right to request that we restrict the processing of your personal data in certain circumstances. For example:

  • You contest the accuracy of the data we hold. In this instance we will restrict your data until we have verified the accuracy of the data;
  • The data has been unlawfully processed, but you oppose erasure and request restriction instead. This is unlikely, however if this is the case we will retain your data in this instance;
  • We no longer need the data, and it will be removed under our data retention policy, but you require us to retain the information in order to establish, exercise or defend a legal claim. This is unlikely, however if this is the case we will retain your data in this instance;
  • You have objected to us processing your personal data under the 'right to object' and we are considering whether our legitimate grounds override those of the individual. In this instance we will restrict the processing of your data until we have discussed the situation with HMRC.

The right to data portability

You have the right to request organisations provide you with a copy of your personal data to allow you to move, copy or transfer it from one IT environment to another.

This right only applies when the lawful basis for processing personal data is consent or for the performance of a contract. As ENTRUST's lawful basis is the performance of a public task, this right does not apply.

The right to object

You have the right to object to the processing of your personal data in the performance of a task in the public interest or exercise of official authority. In this instance you must have an objection on 'grounds relating to your particular situation'.

In this instance we will demonstrate that our position as regulator of the Landfill Communities Fund (LCF) on behalf of HM Revenue & Customs overrides the interests, rights and freedoms of you, as an individual. Enrolment in the LCF, which is a statutory scheme, is voluntary and we are therefore processing your personal data in accordance with the Landfill Tax Regulations as set down in 1996.

The right to automated decision making including data profiling

ENTRUST does not undertake any automated decision making or profiling activities in relation to personal data.

Privacy Policy