Subject Access

Current staff/students: If you are looking for a specific document, or a small amount of simple data (which does not contain personal data about other people in addition to yourself), such as a letter from Occupational Health, or your Exceptional Factors form, you should contact the relevant University team in the first instance to request this. In these instances, you should not expect to receive a formal written response to your request; the University’s primary aim is to facilitate access to your data, where appropriate.

For all other individuals, and staff/students who require more complex data: (e.g. held by a number of staff or across several University departments; or likely to contain personal data regarding other individuals, in addition to yourself), you can make your request by writing to the Data Protection Team in Legal Services at: dataprotection@mmu.ac.uk or tel: 0161 247 3401.

You can make a subject access request verbally or in writing; although written requests are preferred (especially for larger volumes or complex data), so that we can be sure the request is clear and we can identify all the data you require.  

In most cases, we won’t charge a fee.  However, the legislation allows us to charge a fee in certain circumstances, e.g., if you require duplicate copies, or if a request is considered to be manifestly unfounded or excessive.  If a fee is applicable, we will let you know in advance and give you the option to withdraw your request without incurring any charge.

We may need to check your identity: when we receive your request / prior to releasing the information:   ID verification checks will depend on whether you are a current student or member of staff, and how you communicate/submit your request.  E.g., if your contact details don’t match those we hold on file for you, we will need further evidence of your identity, such as a copy of your passport/driving licence and a utility bill confirming your address.  You may therefore prefer to use your MMU email address or a postal address that matches our records. 

If you attend in person to request or collect copies of personal data, be prepared to show your University ID card. 

We may need to ask you for clarification, or for more information to help us identify your personal data:  The University processes large amounts of data as we have a high number of students, staff, applicants, enquirers, graduates, alumni and other contacts. If your request is broad or vague, we are entitled to ask you for more information to clarify your request to enable us to identify the data. 

If we ask you for clarification, the timescales for complying with your request will not commence until we receive this additional information from you.

There are 2 timescales for responding to SARs, depending on the nature of your request: 

• The standard timescale is one month. 
• If your request is complex, involves a high volume of data, or if we receive a number of requests from you, we may extend the timescale by a further two months (to a maximum of 3 months in total). 

We will let you know within one month of receiving your request if we need to extend the timescale and explain why.  

If we need to ask you for clarification or more information because your request is broad or vague, or we cannot identify the information you are seeking, the timescale will not commence until we receive this information from you.

Generally, the broader your request, or the more information you ask for, the longer it is likely to take.   For example, emails are often unstructured, informal, and contain complex third party personal data; it is likely to take much longer to process email data than it would to provide a copy of your staff/student file.  We must also take into account the number of requests the University is dealing with at the time; it is not possible to prioritise one individual’s request above others, although requests which are limited in scope, clear and focussed are likely to be processed more quickly.

You should not expect to wait any longer than one month for simple, low volume requests; or three months for higher volume and complex requests.

You may provide permission for a solicitor or other individual to submit a subject access request on your behalf.  However, we may need to contact you directly about the request to conduct identity checks or ensure adequate consent is obtained.  Solicitors may provide a signed form of authority, confirming that you have given your consent for the University to release your data to the solicitor. 

You are entitled to receive the personal data the University holds relating to you, subject to any exemptions provided by law, in accordance with the UK/EU GDPR and the Data Protection Act 2018.    

Your right of access applies to:    

• your personal data within documents/other records: it is not a right to the full documents containing your data, only to the extracts of your data within those documents;

• data held by the University at the time of your request: the University routinely destroys information in accordance with its Records Retention Schedule; and we are unable to recreate or provide information which was previously held but has since been routinely destroyed.

In addition, under the Right of Access, you are entitled to receive supplementary information about the University’s data processing activities.  We provide this information to you in the following documents:  

• the University’s Privacy Notices provide further information about the data we process, including the purposes for processing personal data, the categories of data, and who we share information with.
• our Records Management Policy and Retention and Disposal Schedule  
• our Data Protection Policy

Yes, you may request copies of emails held by the University containing personal data relating to you. However, please note that: 

• email is not a data storage facility but a communication tool.  Emails are often informal and contain information about other individuals with the same/similar name, or information about more than one individual.
• we cannot conduct a central University-wide computerised search for all personal data relating to one person; the system is too large, data is too complex, and no computer system can identify personal data.
• the process for identifying and providing personal data held in emails requires: individual searches of specified email accounts, a manual review of all data retrieved to identify personal data, the removal of duplicate copies, and the removal/redaction of exempt information such as third party personal data.   Email searches often result in large volumes of complex data, containing personal data information about more than one person.  Depending upon the volume & complexity of the data involved, a request for email data may result in an extended timescale for responding to your SAR; or increase the likelihood that the University may refuse your request as manifestly unfounded or excessive.
• unless you specifically request otherwise, we will not usually provide copies of emails containing your name in the To/From/Cc fields of an email, as we assume that you already have access to this data (having sent/received it previously from your own account).  However, if you do wish to request duplicate copies of emails you have deleted/mislaid, please let us know. 

To enable us to identify emails containing personal data relating to you, we will ask you to provide the following information with your request:

• Names of the accounts likely to hold relevant personal data relating to you, or the sender/recipients of the emails 
• Dates (or date ranges) of the emails you require, e.g. from 1st January to 31st March 2018.
• Any other relevant information that might assist the University to locate the specific information you require.

The University has the right to charge a fee, or refuse any request, which is manifestly unfounded or excessive, or repetitive.  If this applies to your request, we will contact you within one month of receiving your request to let you know.

There are also some exemptions to the right of subject access (such as personal data relating to another person) which means you may not be entitled to receive all of the information within a document.  Information you are not entitled to receive will not be included in the disclosure – we will remove this from any documents we provide.

The University can supply copies of data electronically (by email/secure portal) or in paper/hard copy format, which you can choose to collect in person or receive by post (recorded delivery). 

If you contact us by email we will usually provide the information electronically, unless you specify otherwise. 

Please remember that the purpose of the Right of Access/SAR under GDPR is to allow you, as data subject, “to be aware of, and verify, the lawfulness of the processing” by the University.  Because SARs are designed for this specific purpose only, you may be disappointed in the outcome if you are asking for information for any purpose other than: checking and verifying that the University is processing your data lawfully.

However, if you are dissatisfied with the handling/outcome of your request, and wish to make a complaint, please submit your reasons in writing to the Data Protection Officer at: dataprotection@mmu.ac.uk  Your complaint will be investigated and you will receive a response to your complaint within one month of receipt. 

If you remain dissatisfied with the outcome of your complaint, you have a subsequent right to make a complaint to the ICO, or to seek to enforce your rights under GDPR through a judicial remedy.  See the ICO website for more information: https://ico.org.uk/