Data Protection

Note: the Data Protection webpages are currently being updated.

 

‌At Manchester Metropolitan University we take data protection seriously.

The University is responsible for complying with General Data Protection Regulation ('GDPR') whenever personal data is processed.  Our Data Protection Policy, sets out the University's compliance statement.

Our Data Protection Notice to Students can be accessed here. This notice provides further details about how and why the University uses your personal data whilst you are studying with us.

Our Data Protection Notice to Staff will be published shortly.

The University is registered as a Data Controller with the Information Commissioner, the regulator of Data Protection matters. The University’s registration number is Z5710637.  Our registration notice, which provides further information about how we process personal data, can be viewed on the ICO’s website.  

 

Data subjects (individuals whose data is processed or held by the University) have a number of rights relating to their data.  The ICO’s website provides further information on scope of these rights and how to exercise them.

If you wish to exercise one of your rights in relation to your personal data, please contact dataprotection@mmu.ac.uk or by post to: The Data Protection Officer, Manchester Metropolitan University, Legal Services, 2nd Floor, All Saints Building, M15 6BH. 

If you wish to seek access to your personal data (make a Subject Access Request or 'SAR'), please refer to the guidance in the section below.

If you wish to make a complaint or report a personal data breach: please contact dataprotection@mmu.ac.uk as soon as possible, providing as much information about the circumstances as possible, to enable us to investigate this.  A personal data breach means a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Your right of access: making a Subject Access Request

 Subject Access Requests under GDPR: Guidance for individuals who wish to obtain copies of their personal data held by the University is provided below:

 

How can I make a subject access request (SAR)?

For current students/staff if you require a small volume of simple data: (eg, the documents do not contain personal data about other people in addition to yourself, such as a letter from Occupational Health, or your Exceptional Factors form), we recommend you contact the relevant University team to request this.  In these instances, you should not expect to receive a formal written response to your request; the University’s primary aim is to facilitate access to your data, where appropriate.

For other individuals and for staff/students who require more/complex data: (eg held by a number of staff or across several University departments; or likely to contain personal data regarding other individuals, in addition to yourself), this will be dealt with by the University’s Legal Services department: please contact dataprotection@mmu.ac.uk

You can make a subject access request verbally or in writing (electonically or by post); although we would always recommend written requests (especially for larger volumes or complex data), so that we can be sure of identifying all the data you require.  The University has produced a SAR form for data subjects to complete (to be published shortly).  This will help you make a request and identify the information you require.  It is not compulsory to use the University’s SAR form, but it may help to prevent delays, for example, by reducing the likelihood of us having to seek further clarification from you.

 

Do I have to pay a fee?

In most cases, the University will not charge a fee for a SAR.  However, we reserve the right to charge a reasonable fee where permitted, such as for providing duplicate copies of information, or where the request is manifestly unfounded or excessive.  If a fee is applicable, we will let you know and give you the option to withdraw your request without incurring any charge.

 

Do I have to provide anything else? 

We may need to conduct an identity check once we receive your request and/or prior to releasing the information to you.  This will depend upon whether you are a current student or member of staff, and how you communicate with us.  If your contact details do not match those we hold on file for you, we will require documentation such as copies of passport/driving licence and utility bill confirming your address.  For written requests, we therefore recommend that you use your MMU email address, or a postal address that matches our records.  If you attend in person to request a copy of a specific document from the relevant team/department, be prepared to show your University ID card. 

As the University usually processes large amounts of data about its students and staff, if your request is broad or vague, we are entitled to ask you for more information to clarify your request and enable us to identify the data.  If we ask you for clarification, the timescale for University to respond to your request will not commence until we receive this additional information from you.

 

When will I receive the data I have asked for?

There are 2 timescales for responding to SARs, depending on the nature of your request: 

The usual timescale for SARs is one month.  However, this may be extended by a further two months if your request is complex, or involves a high volume of data; or if we receive a number of requests from you.  We will let you know within one month of receiving your request if we need to extend the timescale and explain why.  

If we need to ask you for clarification because your request is broad or vague, the timescale will not commence until we receive this information from you.

In general, it is likely that the broader your request, or the more information you ask for, the longer it is likely to take.  Timescales also depend upon the number of requests the University is dealing with at the time; and requests are managed in order, by date received and by the volume/complexity of data involved; it is not possible to prioritise one individual’s request above others, although as noted above, the more focussed a request is then generally the more quickly we will be able to respond to it.

However, you should not expect to wait any longer than one month for simple, low volume requests; or three months for higher volume and complex requests.

 

How is the deadline calculated?

The timescale commences the day after your request is received by the University and ends on the corresponding calendar date the following month.  Eg, if we receive your request on 3rd September, we would respond on/before 4th October for standard requests; and 4th December in cases where the deadline is extended due to volume/complexity.

If the deadline falls on a weekend or public holiday, the University has until the end of the next working day to comply. 

 

Can someone else make a SAR on my behalf?

You may provide permission for a solicitor or other individual to make a subject access request on your behalf, but we will usually need to make some checks on identity and consent.  Solicitors may provide a signed form of authority from you, confirming your consent for the University to release your data to the solicitor.  From anyone other than a solicitor acting in his/her professional capacity, we may need to contact you directly to obtain your consent and conduct some identity checks.  Note: This only applies in situations where another person is making a SAR on your behalf - for more information about how the University may share your data in other circumstances, please refer to our Data Protection Notice for Students. 

 

What information am I entitled to?

Your own personal data only: you are not usually entitled to receive data relating to other people. 

Data held by the University at the time of your request: the University routinely destroys information in accordance with its Records Retention Schedule; and we are unable to recreate or provide information which 

You are also entitled to receive additional supplementary information about the University’s data processing activities and this is set out in the following documents:  

 

Can I obtain copies of emails?

Yes, you are entitled to request copies of emails held by the University containing personal data relating to you.  However, please note the following:

- the University’s email systems are not capable of identifying and extracting all personal data relating to a specific data subject only.  Staff must therefore search individual email accounts to identify relevant data.  The results of email searches usually result in large volumes of complex data, containing personal data information about more than one person.  Depending upon the volume involved, requesting email data may therefore result in an extended timescale for responding to your SAR.

- unless you specifically request otherwise, we will not usually provide copies of emails containing your name in the ‘to’, ‘from’ or ‘cc’ fields of an email, as we assume that you already have access to this data (having sent/received it previously from your own account).  However, if you do wish to request duplicate copies of an email you have deleted/mislaid, please let us know. 

- The University’s population is over 40,000 registered individuals (including staff and students) each year; plus we hold information about many more enquirers, applicants, associates, and former staff and students.  It is therefore not feasible to conduct a search of every email account for a single name; and very broad requests, eg for 'all emails relating to me', are more likely to be considered manifestly unfounded and excessive under the GDPR.

Therefore, to enable us to identify emails containing personal data relating to you, we will need you to provide the following information with your request:

 

Will you refuse to provide any information?

The University has the right to charge a fee, or refuse any request, which is manifestly unfounded or excessive, or repetitive.  If this applies to your request, we will contact you within one month of receiving your request to let you know.

There are also some exemptions to the right of subject access (such as personal data relating to another person) which means that the University may need to withhold or remove certain types of information from you.  If an exemption applies to your request we will let you know. 

 

Can I ask for paper / electronic copies?

The University can currently supply copies of data by either:

You can specify the option you prefer.

We are looking into alternative means of providing access to data, in order to facilitate access to larger volumes of data electronically, and will update this section when additional options are available.

 

How can I make a complaint if I am dissatisfied with the outcome of my SAR?

Complaints must be made in writing and emailed to the Director of Legal Services at: legal@mmu.ac.uk  Your complaint will be investigated and you will receive a response to your complaint within one month of receipt. 

If you remain dissatisfied with the outcome of your complaint, you have the right to make a complaint to the ICO or to seek to enforce your rights under GDPR through a judicial remedy.  See the ICO website for more information: https://ico.org.uk/