Submit a request regarding personal data based on the GDPR

The municipality regularly asks you to provide your personal data. Or it uses personal data that is already registered. The municipality must handle your personal data with care. To this end, it must comply with, among other things, the General Data Protection Regulation (GDPR). The municipality:

• only requests the personal data it needs to process your request or report
• ensures the secure, confidential, and careful registration and processing of your personal data
• processes your data for the purpose for which you provided it (or for something directly related to that purpose)
• does not retain your data longer than is necessary for the purpose for which the data is collected
• will only send your data to other organizations if it is legally required to do so
• informs you about what they do with your personal data and why they do it. You can ask for this information.

The municipality keeps various personal data about you. For example, the information you provide when applying for a permit. Personal data is processed and stored in various ways. This is done in a careful, secure, and transparent manner. This is mandatory.

You have a number of rights. These give you more insight into and control over your personal data. You can ask the municipality to:

• view your personal data (right of access)
• correct your data (right to rectification)
• delete your data (right to be forgotten)
• process your data less extensively (right to restriction)
• receive an overview of your data in a legible and digital format
• transfer your data to another authority or company (data portability)
• provide information about agencies, companies, or individuals who have received your data from the municipality
• to stop processing your data
• not to make any decisions without involving a civil servant. Some decisions are made automatically by a system. You can demand that a civil servant always makes or checks the decision.

The municipality processes much of your personal data because it is required to do so by law. In such cases, you cannot exercise your rights, or can only do so to a limited extent. For example, you cannot request that the municipality stop processing your data if it is required by law to keep this data.

You can always request information about the processing of your personal data. You must receive a clear answer to this request.

The Requirements submitting a request regarding personal data are, in any case:

• This concerns personal data relating to:
  • yourself
  • a child under the age of 16 for whom you are the legal representative
• You may ask someone else to submit a request on your behalf (an authorized representative).
• This concerns personal data that is recorded by the municipality or by agencies that have been clearly instructed to do so by the municipality.
• Your rights may be restricted if this is stipulated in a legal regulation. For example, you cannot request the removal of your personal data from the Personal Records Database (BRP).

The municipality will decide on your request within one month. This one-month period begins as soon as you have identified yourself, for example with your DigiD. The municipality may extend this period once by two months. If the municipality wishes to extend the period, you will be notified within one month of the municipality receiving your request.

You can object to the decision on your request regarding your personal data. Do this within 6 weeks. If you disagree with the decision on the objection, you can appeal to the court.

If you feel that you have not received a clear response to your request for information, you can submit a complaint to the Dutch Data Protection Authority.

Privacy statement of the municipality of Heerlen

Video about the use of personal data in the BRP

Information about the protection of personal data (Rijksoverheid.nl)

Information about the protection of personal data (Data Protection Authority)