People have the right to request information the University holds about them by making a subject access request, whereas Freedom of Information requests give anyone the right to ask the University for information it holds.
There are a lot of channels of communication through which any member of the University may receive a legally valid request for information, including social media, eg to academic groups and the official University accounts, or directly to members of staff using their University email addresses. All colleagues must know what these requests look like and what to do if they receive a request.
What are the rules for answering a request?
Subject Access Requests (UK GDPR)
-
A person can access and receive a copy of the personal data the University holds about them
-
A request is valid if the individual is asking for their own personal data. It is often necessary to get proof of identity or confirmation a request is genuine if we receive a request made on behalf of another person
-
It may be made verbally or in writing, including via social media
-
You have 30 calendar days to respond to the request.
Take action: If you think you have received a subject access request, email dp@lboro.ac.uk without undue delay.
Example SAR requests:
“I would like my employment record”
“Could I have access to my mitigating circumstances claim? Please, can you send them by tomorrow?”
Find out more about subject access requests.
Freedom of Information (FOI Act 2000)
-
Gives individuals the right to ask for information the University holds. It excludes personal data, commercially sensitive data, and intellectual property
-
A request can be made by anyone anywhere in the world
-
It must be made in writing and include the requestor's real name, a correspondence address, and describe the information being requested
-
You have 20 working days to respond.
Take action: If you think you have received an FOI request, email foi@lboro.ac.uk without undue delay.
Example FOI request:
“I would like data on the amount of cash payments for fees received from students over the past five years (broken down by the nationalities of those paying student fees in cash) and internal guidance notes to staff on dealing with them.”
Sometimes people ask for information containing a mix of both types of requests, these are split and responded to using the appropriate law:
Eg “Provide a copy of the Loughborough University data protection policy and copies of all emails referring to me and sent by my line manager”
Find out more about FOI requests.
How and should I give the requested information?
There is very specific guidance around “when” and “how much” information should be given in response to either a subject access or FOI request.
For example, redacting any personal information from a SAR request which doesn’t belong to the requester. It is best to consult the FOI/SAR team to ensure compliance with the regulations. They will also coordinate a response to requests containing both FOI and subject access questions.
The team may ask you to provide information to support the completion of a SAR or FOI request. Please be mindful of the restricted timescales and the additional work needed to review and prepare requests for release and support the team by providing any requested information as quickly as possible.