You are:

Data Protection

Introduction data entry

Under the Data Protection Act 1998 (or DPA) the GOC is known as a “Data Controller”. This means we are an organisation that controls how we collect, record, and use personal information, or as the Act calls it, “personal data”.

Personal data is information about an identifiable living person. The person who the personal data is about is called a “Data Subject”. The DPA does not cover information about deceased people.

As a data controller we must comply with certain rules of good information handling, more commonly known as the eight data protection principles. You have the right to expect us to ensure that personal data is:

  • Processed fairly and lawfully
  • Obtained for specific and lawful purposes
  • Adequate, relevant and not excessive for those purposes
  • Accurate and where necessary, kept up to date
  • Not kept for longer than is necessary
  • Processed in accordance with your rights as a data subject
  • Kept secure
  • Not transferred abroad unless to countries with adequate data protection laws
     

Your rights under the DPA

You have the right to:

  • Find out what information we hold about you on computer and in some paper records
  • Ask us to stop processing your personal data if the processing will cause you or somebody else any unjustified damage or substantial distress
  • Require us not to use your personal data for direct marketing
  • Claim compensation if you have suffered damage and distress as a result of us failing to comply with the Act
  • Ask the Information Commissioner to investigate and assess whether we have breached the Data Protection Act. 

Make a subject access request

If you want to make a request to see your personal data this is called a subject access request and we are allowed to charge you a fee of up to £10 before providing the information to you.

You are entitled to be:

  • Given a description of the personal data in question
  • Told for what purposes we are using your personal data
  • Told the people, or types of people we have disclosed your personal data to
  • Given a copy of any personal data with any acronyms or codes explained
  • Given any information available to us about the source of the personal data
     

There are a number of exemptions under the DPA which may mean we are unable to disclose some of the information you want. Some examples of these exemptions are:

  • Personal data about somebody else or information that would identify somebody else
  • Information that may prejudice the way we carry out our regulatory activities
  • Information that attracts legal professional privilege
  • Examination scripts
  • Crime and Taxation (if disclosure could prejudice matters such as the prevention or detection of crime)

If your personal data has other information amongst it that would not be appropriate to release to you (for example, other people’s information), we will blank out or “redact” this. This means that you might receive documents that have blanked-out sections.

If we are unable to give you your personal data we will tell you why it has been withheld unless the DPA also exempts us from having to confirm or deny its existence.

Please send your request in writing to us together with the £10 fee describing the information you want. It would be helpful if you could clearly mark your mail “Subject Access Request”.

Requests should be sent to:

Accreditation Policy and Project Officer
General Optical Council
41 Harley Street
London
W1G 8DJ

or by email to: lsparkes@optical.org

We will deal with your request as quickly as possible, normally within the 40 calendar days limit set by the DPA. The 40 days will start after payment of the fee. You may also be asked to supply proof of your identity.

Further information

For more information about the Data Protection Act and its principles you can:

 

data entry