Subject Access Requests

Individuals who wish to enquire about the data the University holds on them are required to make a 'subject access request'. Detailed below is the process for requesting access to the personal information we may hold.

Valid subject access requests require:

  • Full name
  • A clear indication that you wish to obtain information which may be held about you, in writing or verbally
  • Proof of identity - two forms, one photograph with proof of address, taken within the last three months 

We cannot release data unless all of the above requirements are met.

Written request

While subject access request do not have to be made in writing, it is recommended that you submit your requests in writing to ensure that these are processed without delay.

We have a subject access request form which you may like to use or if you prefer, you can write an email or a letter to us. Your request can be emailed to dataprotection@wlv.ac.uk or posted to:

Data Protection Officer, Offices of the Vice-Chancellor, University of Wolverhampton, Wulfruna Building, Wulfruna Street, Wolverhampton, WV1 1LY.

If you require assistance in completing the form or making a written request, please contact us via telephone on 01902 321000 or via email at dataprotection@wlv.ac.uk and we will be happy to help you.

The following individuals can request personal information from the University:

  • The individual whose information is held (the data subject)
  • A third party acting on behalf of the individual - evidence that they are acting on behalf of that individual must be provided, by signed authority along with sufficient ID as stated above.

If you are a member of staff and have requested to see your HR file, you will be invited to the University to view your file.

If you have requested data, depending on the volume of data we may contact you and ask if it is more preferable for it to be supplied in electronic format. Otherwise we will supply hard copies of data.  

There may be a restriction on the data you are provided. The Data Protection Legislation provides for certain exemptions which mean we may not be able to disclose it to you. For example, we are unable to provide third party data or data which would affect a Police investigation. If this is the case we will contact you and let you know the reasons why we are unable to provide the information.

If we do not hold any information we will confirm this in writing to you.

Under the Data Protection Legislation the University is required to respond to subject access requests within one month from the day after receipt of the request. Please note the one month period begins from receipt of the request and sufficient ID. Therefore, it is suggested you send all your documentation as early as you can to avoid any delay.

Once a Subject Access Request has been complied with and a Decision Notice has been issued, if you as the Applicant are not satisfied with the request outcome, you have two further rights of review.

The first right of review, is to ask for an Internal Review. This request for review needs to be communicated in writing. You need to specify, with as much detail as possible, what you are disputing about the original decision reached in relation to your Subject Access Request.

The Internal Review process can only review and consider the scope of the original Subject Access Request which was lodged. If an applicant wishes to make any amendments to the scope or asks for additional information, an additional Subject Access Request should be lodged with the University.

You can lodge an Internal Review either by:

  • Email at dataproection@wlv.ac.uk; or
  • Post at Information Governance Manager & Data Protection Officer, Offices of the Vice-Chancellor, University of Wolverhampton, Wulfruna Building, Wulfruna Street, Wolverhampton, WV1 1LY.

The second right of review, is a complaint lodged with the Information Commissioner’s Office (ICO).

Further details on how to contact the Information Commissioner can be found on their website at www.ico.org.uk.

The Applicant needs to lodge a request for Internal Review within 40 days from the date of the Decision Notice provided. Once an Internal Review request is accepted as valid, the University has 2 months from the date the Internal Review is received, to comply/respond.

Much like with your original Subject Access Request, you will receive an Internal Review Decision Notice which will explain the decision reached. Once received, you may, dependent on the outcome, exercise your further right of review with the ICO.

 

If you think the information we hold is incorrect, you are advised to contact us in writing and ask us to review the data. You may contact us by email at dataprotection@wlv.ac.uk or by post at Data Protection Officer, Offices of the Vice-Chancellor, University of Wolverhampton, Wulfruna Building, Wulfruna Street, Wolverhampton, WV1 1LY.

The Police and other law enforcement agencies or regulatory bodies can request access to individuals ' personal information, as long as the reason for doing so satisfies one of the exemptions to the data protection principles, under the schedules to the Data Protection Act 2018. For example, the Police may need to request an individual's personal information for the detection or investigation of a crime; or a local authority can request an individual's personal information for council tax purposes. 

More information on these exemptions can be found here: 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/

Page updated on: 17/12/2020 dataprotection@wlv.ac.uk