Policy on access to information held on prospective, current and past employees - HR/876
The Data Protection Act of 1998 provides enhanced rights for individuals in respect of the information that is kept about them both in respect of the actual information and the purposes for which that information will be used.
This document sets out the University's actions and responsibilities when an individual exercises his/her right to establish what information is held about them by making a subject access request.
Where the term Data Subject is used, it refers to the person about whom the information is being requested.
1. Subject access requests must be made in writing to the FOI/DPA Officer, HR Officer, Lancaster University, Lancaster LA1 4YW or via email to Christine Wilkinson. It would assist the provision of data if a request form is filled out at the time of the initial request.
2. The University reserves the right to make a charge of up to £10 in respect of each request.
3. The University reserves the right to seek information from the individual to help locate the records and to undertake reasonable checks on the identity of an individual making a subject access request, before any information is disclosed.
4. The University will provide a copy or summary of the information promptly and in any event no later than 40 days after the receipt of the subject access request, subject to points 2 and 3 above being fully complied with.
5. The University will endeavour to provide the information in a readily readable and understandable format.
6. The University will advise the individual:
- Whether any personal information is kept about them, and if appropriate:
- What types of information is kept about them,
- Where available, the sources of that information,
- The purposes for which the information is kept,
- The types of organisations that the information is passed onto.
7. The University reserves the right to withhold certain information subject to that action being allowable under the Subject Information Exemptions of the Data Protection Act 1998.