Requesting Access to Personal Data at SOAS
- What are my rights?
- What are the exemptions?
- How has Freedom of Information affected Data Protection?
- How do I submit a request?
- What happens next?
- Can I appeal?
- Can I re-use the data?
- What if I need a transcript or copy of my degree certificate?
- What if I want feedback on my Masters dissertation/exam performance?
- Where can I get further information?
1. What are my rights?
The Data Protection Act 1998 gives individuals a right of access to the personal data which organizations hold about them, subject to certain exemptions (see What are the exemptions?). Requests for access to personal data are known as subject access requests. This page explains how to submit a subject access request to SOAS, how we will handle your request, and your right to complain if you are dissatisfied.
If you submit a subject access request to SOAS, you are entitled to be told whether we hold any data about you. If we do, you also have the right:
- To be given a description of the data, the purposes for which the data are being processed, and those to whom the data may have been disclosed;
- To be given a copy of the data in an intelligible form, with any unintelligible terms explained;
- To be provided with any information available to SOAS about the source of the data; and
- If you specifically request it, to be given an explanation as to how any decisions taken about you solely by automated means have been made.
These rights apply to electronic data, and to data in "manual" (i.e. non-electronic) formats subject to certain limitations (see How has Freedom of Information affected Data Protection?). Further information about your rights under the Data Protection Act is available on the website of the Information Commissioner.
If your request is for information other than information about yourself, such as information about decisions or actions by SOAS, you cannot submit it as a Data Protection Act request. See our Freedom of Information pages for details of how to find information using our Freedom of Information Publication scheme, and how to submit a Freedom of Information Act request.
2. What are the exemptions?
The Data Protection Act includes various exemptions which specify the circumstances in which an organization can refuse to provide access to personal data. The most likely situations in which SOAS could refuse a subject access request are where:
- The release of the data would jeopardise the prevention or detection of crime, or the apprehension or prosecution of offenders;
- You have requested access to an examination script, other than examiners' comments;
- You have requested data contained in a confidential reference provided by SOAS;
- You have requested data which record SOAS's intentions in relation to any negotiations with you, and the release of the data would prejudice the negotiations;
- The data is covered by legal professional privilege;
- The data relates to management forecasting or management planning, and its release to you would prejudice SOAS's business or activities; or
- You have requested access to data which have been retained for the purposes of historical or statistical research, the conditions set out in the Data Protection Act for processing for research purposes have been met, and the results of the research have not been published in a way which identifies individuals.
The right of access to data in paper format is also subject to some limitations: see How has Freedom of Information affected Data Protection? for further information.
If SOAS withholds data from you as a result of an exemption under the Data Protection Act, we will explain why the data have been withheld and the relevant exemption, unless doing so would itself disclose information which would be subject to the exemption.
The Data Protection Act allows us to refuse to provide you with a copy of your data if the effort in doing so would be disproportionate, or if the same or similar data have already been provided to you and a reasonable interval has not elapsed since your previous subject access request. In addition, if SOAS reasonably requires further information from you in order to locate the data which you have requested, and we inform you of this, we are not required to comply with your request until you supply us with the information.
We have to protect the Data Protection rights and other legal rights of other individuals when we respond to subject access requests. Information which does not relate to you may be 'blanked out' or edited out, particularly if it relates to other individuals. Sometimes we may not be able to release data relating to you because doing so would also reveal information about other persons who have not consented to their data being released, and it would not be reasonable in the circumstances to release the data without their consent. In such cases, you will be informed that data about you have been withheld and the reasons for doing so.
3. How has Freedom of Information affected Data Protection?
The Freedom of Information Act 2000 has amended the Data Protection Act to provide individuals with additional rights in regard to personal data held by public authorities, such as SOAS, to which the Freedom of Information Act applies. In particular, you can now gain access to "manual" (i.e. non-electronic) data about you regardless of how the filing or record keeping system containing the data is organized. However, this right is subject to certain limitations, particularly as far as "unstructured" manual data is concerned. "Unstructured" manual data is paper format information which is not "structured by reference to individuals or criteria relating to individuals": in other words, files which are not about you, or are not about subjects which indicate that information about you is held in the file. Files relating to general subjects like "finance" or "travel" are examples of files that would probably be considered to be "unstructured" manual data.
- If you require access to "unstructured" manual data, you should describe the information in a way which allows us to find it. It will help us to process your Data Protection request if you can be as specific as possible about what you want.
- We are not obliged to provide you with access to unstructured manual data if the cost of locating and extracting the information would exceed the "appropriate limit" set by the Freedom of Information Act for Freedom of Information Act requests. For organizations like SOAS, this is currently £450 or 18 hours of staff time. Further information on the appropriate limit is provided in our guidance on Submitting a Freedom of Information or Environmental Information Request.
The extended rights brought in by the Freedom of Information Act do not apply to paper format data relating to appointments, removals, pay, discipline, superannuation or other personnel matters. There is only a right of access to this information if it falls within the Data Protection Act's concept of a "relevant filing system". However, SOAS's policy is to grant individuals access to this information regardless of whether it is in a relevant filing system.
If you are seeking information which SOAS holds about you, you must submit your request as a Data Protection request rather than a Freedom of Information request. However, you can use the Freedom of Information Act to gain access to other types of information held by SOAS, such as information on SOAS's policies, procedures and decisions. See our Freedom of Information pages for details of how to find information using our Freedom of Information Publication scheme, and how to submit a Freedom of Information Act request.
4. How do I submit a request?
Requests for access to personal data must be in writing. We ask that you complete and return SOAS's Subject Access Request Form, which is designed to gather the information which we need to identify you, communicate with you and locate data about you. Failure to complete the form could delay processing of your request, as we may need to contact you for further information or clarification.
When completing the subject access request form, please be as specific as possible about the information which you want access to, as this will assist us in processing your request. For example, if you only want data relating to your academic record, you should indicate that. A general request such as "please send me all of the data which you hold about me" is likely to lead us to contact you for further information or clarification. SOAS has the right to ask you for information which we reasonably need to locate the data which you have requested, and we may not respond to your request until you provide this information (see What are the exemptions?).
Together with the form, you must also send us a fee of £10 (payable to SOAS), and proof of your identity. We will not begin processing your request until the fee and proof of ID are received. We require proof of ID to ensure that we are releasing data to the correct person. Please supply a photocopy (not the original) of one of the following:
- Your current SOAS student ID or staff ID.
- The pages which identify you in your passport.
- Your driving licence.
If you are unable to supply any of the above, please contact SOAS's Information Compliance Manager (see Where can I get further information? for contact details).
Please send the completed subject access request form, fee and proof of identity by post to the following address:
Information Compliance Manager
London WC1H 0XG
The form, fee and proof of identity must be submitted for each subject access request.
5. What happens next?
We will send you an acknowledgement of your request as soon as possible. This will indicate the deadline by when we will send you a response. We may also ask you to provide further information or clarification if we require it to process your request, and may contact you again for additional information or clarification if necessary.
After SOAS receives your request, we must consider it and respond to it. We will respond as soon as possible, and in all cases within 40 calendar days of receipt of your request. If we reasonably require further information from you to locate the data which you have requested, we will inform you as soon as possible, and the 40 day deadline will commence from the date when we receive the information from you.
Any copies of data which are provided to you must be in permanent form. We will normally send the data on paper to the postal address specified by you on the subject access request form, unless we agree with you that the data can be supplied in a different format. The data may take the form of photocopies, printouts, transcripts or extracts, or a combination of these, depending on what is most appropriate in the circumstances.
If SOAS holds no data about you, you will be informed of this. You will also be informed of any cases where data about you have been withheld and the reasons for this, including the relevant exemptions (see What are the exemptions?), unless doing so would itself reveal information which would be subject to an exemption.
6. Can I appeal?
If you are dissatisfied with the handling of your Data Protection request, you are encouraged to contact the Information Compliance Manager in the first instance, to determine if the ICM can resolve your concerns informally (see Where can I get further information? for contact details). This may lead to a quicker resolution of your complaint than a formal appeal. However, you may ask for a formal review instead of contacting the ICM (see below).
If you remain dissatisfied after contacting the ICM, you can ask for an internal review of SOAS's handling of your request. Appeals should be submitted promptly, and within 12 months of the School's response to your request. If you wish to complain about a request to which we responded more than 12 months ago, you should contact the Information Commissioner (see below), as SOAS will not process your appeal.
Appeals should be sent in writing to the Deputy Secretary at the following address. You should state as fully as possible why you think your request was not dealt with in accordance with the Data Protection Act, and the remedy which you are seeking from the School:
- Post: Deputy Secretary, SOAS, Thornhaugh Street, Russell Square, London WC1H 0XG, United Kingdom
- Fax: +44 (0)20 7074 5019
- Email: firstname.lastname@example.org
The Deputy Secretary will assign your appeal to a review committee, and will acknowledge receipt of your appeal. The chair of the review committee will respond to your appeal within 40 working days of its receipt by the Deputy Secretary. If the review committee decides that information should be released to you, the information will be provided to you as soon as is practically possible. For further information about the appeal process, see SOAS's Freedom of Information, Environmental Information and Data Protection Appeal Procedures.
You can also ask the Information Commissioner for an assessment as to whether SOAS has processed your data in accordance with the Data Protection Act. The Commissioner can be contacted at the following address:
Cheshire SK9 5AF
Further information about how to enforce your rights under the Data Protection Act is available on the Commissioner's website.
7. Can I re-use the data?
The copyright of any data which is supplied to you will be owned by SOAS unless otherwise indicated. The supply of information under the Data Protection Act does not give the person who receives it an automatic right to re-use the information in a way which would infringe copyright, for example, by making multiple copies, publishing and issuing copies to the public.
Brief extracts of any material which is supplied to you may be reproduced under the fair dealing provisions of the Copyright, Designs and Patents Act 1988 (sections 29 and 30) for the purposes of research for non-commercial purposes, private study, criticism, review and news reporting. More extensive re-use must only be carried out with prior written permission from SOAS.
Enquiries about the re-use of material should be directed to SOAS's Information Compliance Manager (see Where can I get further information? for contact details).
Do not submit a Data Protection Act request. You don't need to fill in our subject access request form. If you're seeking a transcript of your academic results, or you need a copy of your SOAS degree certificate, there are other ways of gaining access to your information.
Copies of degree certificates are dealt with by the University of London's central administration. If you require a replacement copy of your certificate or a letter with details of your degree, please contact the Diploma Production Office, Room J, Senate House, Malet Street, London WC1E 7HU, United Kingdom. Certified copies of degree certificates are available from the University of London's Transcripts Office (follow link for further details).
9. What if I want feedback on my Masters dissertation/exam performance?
Students can use the Data Protection Act to request access to their marks; to the comments by examiners on their dissertations and on their exam scripts; and any data about them in the papers of examination boards. You should submit a Data Protection Act request in the usual way (see How do I submit a request?). The identities of your examiners will not normally be released to you. The Data Protection Act gives us a longer period of time in which to respond to requests if your results have not been published when your request arrives. In these circumstances, we will respond within 5 months of the date of receipt of your request or 40 days from the publication of the results (whichever is sooner).
However, SOAS students can also request informal feedback on their examination and dissertation performance without having to go through the Data Protection Act or pay a fee. Requests for informal feedback should be directed to the relevant Faculty Office. Questions about informal feedback should be directed to the Faculty Offices or the SOAS Registry.
Students should note that the Data Protection Act does not provide a right of access to examination scripts, and it is not SOAS's policy to release examination scripts.
Further information about how SOAS aims to protect the rights of individuals under the Data Protection Act is provided in SOAS's Data Protection Policy. Enquiries relating to Data Protection at SOAS should be directed to SOAS's Information Compliance Manager, whose contact details are below:
Information Compliance Manager
London WC1H 0XG
Telephone: +44 (0)20 7898 4150
Fax: +44 (0)20 7898 4019
Information about your rights under the Data Protection Act and how to submit a subject access request is available on the website of the Information Commissioner. Other organisations, such as the Citizens Advice Bureau, may also be able to assist you in developing a subject access request.
Last updated November 2008