Privacy Notice for Data Subject Rights Requests (inc. Data Protection Complaints)

Living individuals (data subjects) have a number of rights under data protection laws. You can read about them on this IC webpage. When you submit a request related to one of those rights (for example, a Subject Access Requests (SAR), Rectification Request, Erasure Request, Data Portability Request, Restriction Request, Objection Request or request for human interaction in an automated decision-making process including profiling) or a complaint related to any of the above, you provide BCU with personal information including your name and contact details and any other personal information you choose to include.

When a data protection complaint has been submitted, the following personal information is usually provided to us: name, the relationship to BCU (e.g. staff, student, external), the email address, phone number, staff or student ID (if applicable) and information relating to the complaint.

The legal basis for BCU processing this personal information is ‘legal obligation’ as we have a legal obligation to respond to request or related complaint. You might choose to include some information called ‘special category personal data’ under data protection law. We encourage you to only provide us with the minimum information we need in order to carry out your request. This includes information about your health (including mental health), race, ethnic origin, religion, sexual orientation, political opinions, philosophical beliefs, trade union membership, genetic data and biometric data.

The special condition permitting the processing of the special category personal data depends on the context. The most likely to apply are Article 9(2)(b) ‘Employment, social security and social protection law’, which would include the Equality Act 2010, or Article 9(2)(g) Substantial Public Interests – Statutory and government purposes. Only if no other conditions of processing apply, we will rely on your explicit consent.

BCU will use your personal data to help respond to your request or related complaint. We usually keep your request documentation on file for up to the last action plus 6 years, unless there is an identified need to keep it for longer. We may keep your name, relationship with BCU (e.g. former student, member of the public etc.) and date of the request (or related complaint) on a register for 10 years for monitoring purposes.

Your personal data will only be accessible to relevant staff, for example staff involved in responding to your request and a related complaint and, where relevant, HR. Hard copies of personal information are kept in locked storage and personal data stored electronically is on secure systems within the UK or EU.

BCU would only share the personal data you have provided as part of the request with an external organisation if it was needed in order to process the request (e.g. we needed to inform a data processor of a rectification), if we believe we are compelled to by law or we seek external assistance such as a consultant or legal advice.

You have the right to correct or update your personal data at any time. You have the right to request access to your personal data. You have the right to request the restriction of the processing of your personal data. To do correct or update your personal data in relation to your request or to retract your consent for the processing of any special category data within the request or complaint, or to retract the request itself, please email informationmanagement@bcu.ac.uk unless it relates to a Subject Access Request, in which case please email SAR@bcu.ac.uk. To read more about your rights please go to the IC website https://ico.org.uk/for-the-public/.

If you are not satisfied with the response to your rights request, please follow BCU’s Data Protection Complaints Procedure. If you are not content with how we handle your information, please follow our Data Protection Complaints Procedure. If you have used that procedure and are unsatisfied with the response you have received, you then have the right to complain directly to the Information Commission. You can find out more about this on the IC’s complaints website.

• Birmingham City University’s Data Protection Policy and Appropriate Policy Document
• Birmingham City University’s Privacy Notices
• The Information Commissioner’s Office (ICO) information for members of the public
• Subject Access Request Procedure