Data Protection - Access to personal information

You have the following rights in relation to your personal data which is processed by the University:

• to be informed about how the University will use your personal data. This should be done before data is collected, and is often done by way of a ‘privacy notice’. We have separate privacy notices for the different categories of people the University processes information about, for example, for students, staff, alumni, visitors etc. These are published on our website.   
• to access  the personal   information the University holds about you. This is known as a Subject Access Request.  More information about making Subject Access Requests can be found below;
• to correct inaccuracies or, where appropriate and taking into account the purpose for which we process your data, the right to have incomplete data completed;
• to have your personal data erased. This is a limited right which applies, among other circumstances, when the data is no longer required or the processing has no legal justification. There are also exceptions to this right, such as when the processing is required by law or in the public interest (e.g. when the University needs to retain a historical archive);
• to object to the processing of your personal data for marketing purposes. If you ask us to delete your personal data, we will continue to maintain a core set of personal data comprising very brief information to ensure that we do not inadvertently contact you in future. We may also need to retain some financial records for statutory purposes;
• to object to the processing of your personal data when that processing is based on specific criteria such as the public interest or other legitimate interests, unless we have compelling lawful  grounds to continue;
• to restrict the processing of your personal data. This is a limited right which will apply in specific circumstances and for a limited period;
• to ask for the transfer of your data electronically to a third party;
• where the legal basis for us processing your personal data is your consent, to withdraw that consent at any time.

For more information on exercising your rights email dataprotection@contacts.bham.ac.uk or write to:

The Information Compliance Manager
Legal Services
The University of Birmingham
Edgbaston
Birmingham
B15 2TT

An individual is only entitled to request access to their own personal data, and not to information relating to other people (unless the information is also about them or they are acting on behalf of someone).

Individuals may apply to the University for personal data that is being held about them by the University.

A request for your personal data can be made by completing a Subject Access Request form and attaching evidence of your identity. The form has been designed to assist you in formulating your request.  Requests and/or completed forms with relevant attachments can be emailed to: dataprotection@contacts.bham.ac.uk or posted to:

The Information Compliance Manager
Legal Services
The University of Birmingham
Edgbaston
Birmingham
B15 2TT

Fees

Although this service is free of charge, a ‘reasonable fee’ may be charged in cases where a request is manifestly unfounded or excessive, particularly if it is repetitive. A fee will also be charged for requests for further copies of the same information. The fee will be based on the administrative cost of providing the information.

How long will the University take to process my request?

Once the University is certain that it understands what information you are asking for, the University will have one month to provide the information to you. Please note that where requests are more complex, for instance where you are asking for details of email correspondence between several named individuals or covering a large time frame; this period may be extended by a further two months. If this is the case, you will be informed within one month of the receipt of the request.