Right of Access (Subject Access Requests)

The UK General Data Protection Regulation ("UK GDPR") Article 15 gives individuals the right of access to any of their personal data that the University holds about them.

This is known as a Subject Access Request ("SAR").

Personal data is information that relates to a living individual.  The individual must be identified or identifiable either directly or indirectly from one or more identifiers or from factors specific to the individual.

If a SAR is received by any member of staff it should be forwarded immediately via email to gdpr@ulster.ac.uk or in hard copy to Mr Eoin Coyle, Data Protection & Information Compliance Manager, Ulster University, Cromore Road, Coleraine BT52 1SA

The University must respond to a SAR as quickly as possible and no later than one calendar month.

A calendar month starts on the day the University receives the request even if that day is a weekend or a public holiday. It ends on the corresponding calendar date of the following month.  However, if the end date falls on a Saturday, Sunday or bank holiday, the calendar month ends on the next working day.  Also, if the corresponding calendar date does not exist because the following month is shorter and there is no corresponding calendar date, the date for response is the last day of the following month.

The clock starts to tick as soon as a request is received and it is important that all requests are forwarded without delay to the Data Protection & Information Compliance Manager, Mr Eoin Coyle, as detailed above.

If the request is complex the response time can be extended to a maximum of 3 calendar months starting from the day after receipt of the request.

A SAR does not have to be submitted in any particular format and can be made verbally or in writing. A request does not have to include the phrase 'subject access request' or refer to data protection legislation. It must however be clear that the requester is asking for their personal data.

If an individual makes a verbal request that is then passed to the Data Protection & Information Compliance Unit, a follow up in writing will be issued asking for the individual to confirm that our understanding of the request is correct.

If the requester is not known to the University, the University will require sufficient information to verify their identity.

THIRD PARTY REQUESTS

SARs can be submitted via a third party usually by a solicitor acting on behalf of a client but sometimes an individual simply wants someone else to act for them.  The University needs to be satisfied that the third party making the request is entitled to act on behalf of the individual. It is the third party’s responsibility to provide evidence of this entitlement.

There may be occassions where staff will be approached by the PSNI for information such as personal data or CCTV footage. The University will not release the personal data of individuals unless the appropriate Form 81 has been received by the Data Protection & Information Compliance Unit.

The University cannot usually charge a fee for processing SARs except in limited circumstances, where the request is manifestly unfounded or excessive, or if an individual requests further copies for their data, in which cases a 'reasonable fee' for the administrative costs of complying with a request may be charged.

Subject access is often used by individuals who want to see a copy of the personal data the University holds about them.  Under subject access an individual is also entitled to the following information:

• the purposes for processing personal data
• the categories of personal data concerned
• the recipients or categories of recipient the University discloses the personal data to
• the retention period for storing the personal data
• the individual’s right to request rectification, erasure or restriction or to object to such processing
• the right to lodge a complaint with the ICO or another supervisory authority
• where personal data is not collected from the individual, any available information as to its source
• the existence of automated decision-making (including profiling)
• the safeguards the University provides if the data is transferred to a third country or international organisation

There are some restrictions on disclosing information in response to a SAR e.g. where this would involve disclosing information about another individual. The University considers the application of exemptions on a case by case basis.

If an applicant is not satisfied with how the University has dealt with the request, the matter can be raised under the University's internal review  process for Subject Access Requests. Please submit written details of your appeal to Clare Jamison, Ulster University, Coleraine BT52 1SA, email at university secretary@ulster.ac.uk

The University will normally undertake to issue a decision on an appeal within 20 working days of receipt.