Subject access requests
Subject access requests can now be made both verbally and in writing. The University has one calendar month to comply with a request; the clock starts on a request as soon as it is received by the University.
The GDPR does not specify how to make a valid subject access; it can also be made to any part of the University (including by social media) and does not have to be to a specific person or contact point.
Therefore a subject access request will be valid from the date it is received at the University; it is irrelevant who receives the request. For example requests received by individual staff members or Schools will still be valid. Staff should not inform individuals to resubmit these requests directly to the Information Governance Office (IGO) or that they must use the online submission form as their initial request would have been valid and the time for compliance will have already started. The School or staff member must forward any request they receive directly to the IGO as a matter of urgency.
Should an individual insist on making a verbal request to a member of staff contact details should be taken and the IGO contacted as soon as possible. The IGO will then contact the individual and log the request accordingly.
A request does not have to include the phrase 'subject access request' or Article 15 of the GDPR, as long as it is clear that the individual is asking for their own personal data. This presents a challenge for the University as any member of staff could receive a valid request. Individuals therefore have a responsibility to promptly identify that an individual has made a request and handle it accordingly. Should a staff member be unsure if they have received a valid request then they should contact the IGO for advice on the matter.
To summarise -
- Request can be in writing or verbal
- Clock starts on request as soon as it is received at the University
- Doesn't have to be labelled as a subject access request to be valid
- Can be made to anyone at the University
- If in doubt contact the IGO for advice
Requests under the Freedom of Information Act 2000
The University is also subject to the Freedom of Information Act 2000 (FOIA).
Anyone has a right to request general information from a public authority and we have two separate duties when responding to these requests:
- to tell the applicant whether we hold any information falling within the scope of their request; and
- to provide that information to them
We have 20 working days to respond to a request.
For a request to be valid under the FOIA it must be in writing, but requesters do not have to mention the FOIA or direct their request to a designated member of staff. We cannot ignore or refuse a request simply because it is addressed to a different member of staff. Any letter or email to any member of staff asking for recorded information is a request under the FOIA.
Therefore staff need to be able to identify requests and ensure that they are passed to the Information Governance Office as soon as they are received.
Although we must respond to requests to information it does not mean that we must treat every enquiry formally as a request under the FOIA handled by the IGO.
At times it may be more sensible and provide better customer service to deal with a request as a normal course of business enquiry rather than an official FOIA request; for example if a member of the public only wants to know the email address for Student Services then this is something that should be handled as business as usual and does not need to be handled as a formal request under the FOIA.
The provisions of the FOIA need to come into force only if:
- you cannot provide the requested information straight away;
- the requester makes it clear they expect a response under the FOIA;
- you do not wish to disclose some or all of the information as the IGO will need to assess to see if a valid FOIA exemption applies
In these instances it should be forwarded to the IGO as a matter of urgency.
If members of staff are unsure if the request should be treated as a request under the FOIA then again they should ask the IGO for advice.
To summarise -
- Request must be in writing
- Clock starts on request as soon as it is received at the University
- Doesn't have to be labelled as an FOIA request to be valid
- Can be made to anyone at the University
- If in doubt contact the IGO for advice
More advice about complying with the Freedom of Information Act is available.
If you wish to contact the IGO you can either email information.governance@manchester.ac.uk or call on 0161 275 57789.