Under the Data Protection Act individuals have the right to make a Subject Access Request.
What is a subject Access?
Subject Access allows an individual to see almost any personal data held about them by the University. The University will seek to respond fully to any such request, subject to certain exemptions, as maximum openness is at the core of the University's Data Protection policy.
Students have the right to see their formal records, such as their LUSI record or any registry or departmental files and, but will also, almost without exception, be able to gain access to other materials - such as comments on their exam scripts, the relevant minutes of examiners' meetings, emails concerning them and so on.
Staff and other associates of the University also have the right to see information that is being held by the University.
Should you as a member of staff be approached by a student wishing to see particular information held, you may, if the request is easy to answer and relatively narrow in focus, answer it directly. However, if the request is more extensive (e.g. it would involve retrieving information from more than one department/section) or is unclear or controversial in any way, then it should be forwarded to the Compliance Team in the Secretariat.
How to Make a Subject Access Request
Anyone wishing to make a Subject Access Request should complete our online form found at the link below:
Online Subject Access Request Form
We recommend that you use our online form, but if you wish to submit a paper version of the form then please find this below:
Subject Access Request Form
Please note that proof of identity in the form of a driving license, library card, or passport is required, as well as a standard fee of £10.00 in order for us to process your Subject Access Request.
This can be paid online via the University’s online store at the link below:
Pay online here
Payment can also be made via cheque, which can be made payable to Lancaster University, or by cash which can be handed in to the Compliance Team, C Floor, University House, LA1 4YW.
Payment is required for requests made online as well as paper requests. To avoid delays in processing, it is recommended that if you use the online form and that you make payment online also.
We will answer Subject Access Requests within 40 days of receiving the request form, the fee and all necessary information needed to answer the request.
References provided by the data controller (i.e. the University) are exempt from subject access requests. However, the Act does not stop the disclosure of such references, and all departments are encouraged to be as open and transparent as possible regarding the information they hold on individuals (staff and students).
Also remember that individuals could legitimately request the reference from the receiving organisation. As a general rule, you are advised not to include information in a reference that you would not wish to the individual concerned to see. Always make sure your comments about a person’s suitability are defensible and justifiable on reasonable grounds, so that you do not cause unnecessary distress if your reference is viewed by the individual.
The Data Protection Act gives individuals the right to references received by the University. However, when releasing references to individuals upon receipt of a subject access request, staff need to be careful not to inadvertently disclose any personal information relating to a third party (e.g. the referee) without their consent.
If the reference is confidential then it may be necessary to contact the referee to determine if they have any objection to the reference being disclosed to the candidate. However, usually the candidate would still have a right to see their reference with the referee’s personal details removed, unless there is a strong reason to withhold.
Where the University is both the sender and recipient of a reference, such as when providing references for internal promotions, individuals will be able to access them.
Please contact the Compliance Team if you have any questions or concerns.
Please email: email@example.com