Introduction
You have the general right to access personal information that we hold about you.
We are committed to operating on a transparent level and we welcome ‘The Right to Access’ housed within the General Data Protection Regulations (GDPR).
If you require access to your personal information you should make a Subject Access Request to us. You are generally entitled to find out what personal data we hold about you, why we are holding it and who we disclose it to.
1. Policy Objective
The objective of this policy is to ensure that there is a systematic approach to the management and processing of Subject Access Requests, in order to ensure that we comply with the requirement of access to personal data under the GDPR.
It is the aim of this policy to inform the public and clarify the process for applying for a Subject Access Request to us, as well as ensuring our staff are informed regarding the management of such requests.
2. What is a Subject Access Request
A Subject Access Request is a written request for personal data we hold about you. You are therefore entitled to find out what personal data we hold about you, why we are holding it and who we may disclose it to. (See Paragraph 5)
3. What is Personal Data
Personal data relates to all information concerning a living individual who can be identified from that information. The information can potentially affect the privacy of an individual. Expressions of opinion about the individual will also be considered as personal data.
Examples of personal data include:
Personal data
- Name
- Address
- Telephone numbers
- Email address
Sensitive Personal data
- Race or ethnic origin
- Medical details or banking details
- Political opinions
- Religion
- Membership of a trade union
- Health
- Sex life
- Sexual orientation
Criminal Offence data
Criminal offence data includes data about criminal allegations, proceedings or convictions; this also specifically extends to personal data linked to related security measures.
4. Information you are entitled to obtain
Generally you have the right to access the personal data that we hold about you. You can obtain the following:
- Confirmation that your personal data is being processed
- What personal data we hold about you
- Access to the personal data we hold about you
- Supplemental information regarding the processing. Supplemental information that must be provided to you is as follows:
– The purpose of processing
– The categories of data processed
– The envisaged retention period
– Your right to rectification and erasure
– Information regarding where we obtained your data (if we did not collect it from
you)
– Any regulated automated decision making where necessary
5. How do you make a Subject Access Request?
A Subject Access Request must be made as a written request for personal data.
Subject Access Requests to RCVS Knowledge can be sent to the Head of Library and Knowledge Services, Clare Boulton at clare@rcvsknowledge.org, or by post to:
RCVS Knowledge
3 Waterhouse Square
138-142 Holborn
London
EC1N 2SW
6. What we do if you send us a Subject Access Request
Identity Check
We will first check your identity against the level of information that you have supplied. We may ask you to provide further information required in order to confirm your identity.
If you are seeking information for someone else, you must provide that individual’s consent for the release of their personal information.
If you have been appointed to act for someone under the Mental Capacity Act 2005, we will ask you to confirm their capacity and explain how and why you are authorised to act on their behalf.
Collation of Personal Information
We will check whether we have enough information in order to process the Subject Access Request. If further information is required we will ask you for this or for further clarification. The process of collating any manual or electronic information held on the data subject will then begin. We will also identify if any information is provided by a third party or identifies a third party.
If information that relates to a third party is discovered, we may write to third parties to seek information on whether there would be any reason for this information not to be disclosed.
We will not provide third party information unless the third party concerned consents to the sharing of their information, unless it is reasonable to do so without consent.
Before sharing information we may therefore anonymise information that identifies third parties. We will also redact any information that may affect another individual’s privacy.
Providing the Information
Once collation is complete and any concerns addressed, we will send you a copy of the completed Subject Access Request with all information in permanent form that we are obliged to disclose under Article 15 of the GDPR. Further supplemental information may also be provided as suggested in paragraph 5 of this policy.
We will summarise information rather than supply whole documents where appropriate. We will generally provide information in electronic format, or in hard copy should you request it. In situations where we cannot provide the information in permanent form, we will make an appointment to allow you to view the relevant information in person.
7. Grounds for not complying with a Subject Access Request
Where requests for information are ’manifestly unfounded or excessive’, particularly if they are repetitive, we will either:
- Charge a fee (see paragraph 8); or
- Refuse to respond
If we refuse to respond to your request, reasons for that refusal and guidance on what next steps you can take will be provided.
Under the GDPR, we also have a right to withhold data (see paragraph 10).
8. Fees
We will provide a copy of the personal information we hold free of charge. However, if the request is manifestly unfounded or excessive, particularly if it is repetitive, we will charge a ‘reasonable fee’. This fee will be decided by the RCVS Knowledge Chief Executive Officer (CEO).
9. Time to Respond
We will ordinarily provide information within one month of receiving a Subject Access Request. Where necessary we will extend the period of compliance by a further two months. This will happen when requests are complex and numerous.
We will inform you of any necessary delay within one month of receiving your request.
10. Rights under the GDPR
Right to Withhold
Whilst Article 15 of the GDPR provides a right of access to personal information for an individual, we can also withhold personal data if disclosing it would ’adversely affect the rights and freedoms of others’ [Article 15(4)]. This decision will rest with the RCVS Knowledge CEO.
Where applicable, we may apply appropriate exemptions in accordance with the legislative provisions.
The right to withhold information may also extend to intellectual property rights.
Right to Rectification
We will rectify any inaccuracies that you have highlighted regarding your personal information. If personal information is incomplete, you can ask us to complete the data or to record a supplementary statement.
11. Our complaints procedure
If you are dissatisfied with the outcome of your Subject Access Request you may contact the RCVS Knowledge CEO Katie Mantell or by post to:
RCVS Knowledge
3 Waterhouse Square
138-142 Holborn
London
EC1N 2SW
The RCVS Knowledge CEO will review and assess the decision and will respond appropriately.
If you are not satisfied with the decision of the RCVS Knowledge CEO you may contact the Information Commissioner’s Office or by post to:
Information Commissioner’s Office
75-77 Great Portland Street
London
W1W 7LR
