Data Protection and Your Rights

Under the Isle of Man Data Protection Act 2018, which incorporates the Applied GDPR and the LED Implementing Regulations, individuals have a set of rights designed to give them control over their personal data. These are known as data protection rights.

Here’s a clear and simple summary of those rights:

Right to be informed
You have the right to know how your personal data is being used, why it’s being collected, and who it’s shared with.

Right of access
You can ask to see the personal data an organisation holds about you.

Right to rectification
If your data is wrong or incomplete, you can ask for it to be corrected.

Right to erasure (right to be forgotten)
In some cases, you can ask for your personal data to be deleted.

Right to restrict processing
You can ask an organisation to limit how it uses your data in certain situations.

Right to data portability
You can ask to receive your data in a format that allows you to move it to another service.

Right to object
You can object to your data being used for certain purposes, such as direct marketing.

Rights related to automated decision-making and profiling
You can ask for human involvement in decisions made by computers that affect you significantly.

These rights are designed to protect your privacy and give you more control over your personal information. However, as we discussed earlier, some of these rights are qualified, meaning they can be limited in specific situations (e.g. for national security or law enforcement purposes).

The Isle of Man’s data protection framework includes specific exemptions under Schedule 9 of the GDPR and LED Implementing Regulations. These may apply in contexts such as:

·              Crime prevention and investigation

·              Regulatory enforcement

·              Legal proceedings

·              Journalism, research, or archiving in the public interest

These exemptions are designed to balance individual rights with broader societal or legal obligations. The GSC may limit or withhold the exercise of data protection rights where doing so is necessary and proportionate to:

·              Avoid obstructing an official or legal inquiry, investigation, or procedure.

·              Prevent or detect crime, or support the investigation or prosecution of criminal offences.

·              Protect public or national security.

·              Safeguard the rights and freedoms of others.

·              Maintain the confidentiality of legal or regulatory functions.

·              Preserve the integrity of risk assessment systems used for crime or taxation purposes.

If an exemption applies under Schedule 9 of the GDPR and LED Implementing Regulations 2018, the following individual rights are considered qualified meaning they can be restricted in certain circumstances, such as for national security, crime prevention, or the protection of others’ rights:

Here are the rights that may be limited:

Right to be informed

You usually have the right to know when your data is being collected. But this might not apply if telling you would compromise an investigation or legal process.

Right of Access (Article 15)

You have the right to access your personal data, but this may be restricted if for example, if it would affect law enforcement, legal proceedings, our regulatory functions or if disclosure would reveal personal data about another individual, unless they consent or it is reasonable to disclose without consent.

Right to Rectification (Article 16)

You can request correction of inaccurate data. However, this does not apply if the data was accurate at the time it was collected or if rectification would interfere with statutory obligations or official records. 

Right to Erasure (Article 17)

Also known as the "right to be forgotten," this right may be limited where the processing is necessary for compliance with a legal obligation or where the data is needed for the establishment, exercise, or defence of legal claims. 

Right to Restriction of Processing (Article 18)

You can request restriction of processing, but this may be overridden if the data is required for legal claims or public interest reasons 

Right to Object (Article 21)

You can object to how your data is used, especially for marketing, but this may not apply if there are strong legal grounds to continue processing for example where the processing is based on legitimate interests or public interest.

Rights Related to Automated Decision-Making and Profiling (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, unless it is necessary for a contract, you have given explicit consent or it is authorised by law. 

Restrictions are applied on a case-by-case basis and must be:

·         Necessary to achieve the intended purpose

·         Proportionate in relation to the impact on the individual

·         Documented, with reasons recorded and available to the Information Commissioner upon request

Where a restriction is applied, the GSC will:

·         Inform the data subject of the restriction (unless doing so would undermine the purpose)

·         Explain the reasons for the restriction, where appropriate

·         Advise the data subject of their right to complain to the Information Commissioner

Article 15 of the Data Protection (Application of GDPR) Order 2018, provides the right of access to personal data. The exercise of this right is commonly known as making a ‘subject access request’ (DSAR).

For details on how to exercise your right of access, please refer to our policy and the accompanying guidance document, which includes a request form for your convenience.

• Subject Access Request Guidance and Request Form

• Subject Access Request Policy

The Isle of Man Information Commissioner has published the following guidance which may assist you

Ø  Complying with a Subject Access Request

Ø  Subject Access Request document library

Freedom of information Request under the Freedom of Information Act 2015

The GSC is subject to the Isle of Man’s Freedom of Information Act 2015 (‘the Act’). The Act enables Isle of Man residents to submit requests for information about the GSC as described on the Isle of Man Governments' Freedom of Information website.

Both the GSC and Isle of Man Government already provides a range of information and before considering submitting a request for information under the Freedom of Information Act 2015, you should try searching this website or alternatively the Isle of Man Government website (gov.im) using the search box or sitemap.

If you are unable to find what you are looking for, residents can make a request for information created on or after 11 October 2011 by public authorities, by completing a Freedom of Information Act 2015 request form online.

A paper version of the form is available here or by contacting us directly by email GSC-DPO@gov.im  

Before completing this form please read the Guidance Notes attached

Submit a Freedom of Information request:  

Code of Practice on Access to Government Information 2016

The Code of Practice on Access to Government Information (Isle of Man) outlines how individuals can request information from government bodies, especially in cases where statutory routes like the Freedom of Information Act (FOIA), Data Protection Act (DPA), or Public Records Act (PRA) do not apply.

Anyone can request information from Government currently under the Code of Practice on Access to Government Information 2016 ('Access Code'). 

The Access Code outlines the information that Government is committed to release, which can be summarised into five areas as follows:

1. Facts and analysis of facts relevant to major policy proposals;
2. Explanatory material on the Government's dealings with the public (for example, rules and procedures);
3. Reasons for administrative decisions to those affected;
4. Full information on how public services are run (for example, costs and targets); and
5. Details relating to policies, actions and decisions.

The Access Code supports the policy that some information must be kept confidential and therefore a list of exemptions is included. Examples of exempt information are national security and defence. 

You can make an Access Code request in writing to Government.

If you are unhappy with how your request has been handled, please contact the Data Protection Officer at DPO-GSC@gov.im. We will aim to resolve your concerns promptly.

If you remain dissatisfied, you may lodge a complaint with the Isle of Man Information Commissioner. Visit www.inforights.im or email ask@inforights.im.