As an organisation, the Education Workforce Council welcomes requests made for personal data held on an individual. We process a vast amount of personal data, all of which is processed responsibly in accordance with current UK GDPR and Data Protection legislation. Under UK GDPR regulation, an individual’s ‘right of access’ gives them the right to request any personal data held about them – commonly referred to as a ‘subject access request’. Below is a guide outlining the most efficient way of making a request as well as your rights under UK GDPR.
Before making a request
Before making your request, please ensure that a subject access request (SAR) is necessary to your needs. Subject access requests cover any personal data we hold about you, and individuals have the right to obtain, where possible, the following:
- Confirmation that your personal data is being processed by the organisation;
- A copy of all personal data held by the organisation;
- Any other supplementary information.
For an exhaustive list of supplementary information, please consult our privacy notice.
If your request relates to the above, please continue with your request. If your request relates more to how we function as an organisation, you may need to submit a request under the Freedom of Information Act. If so, please consult the separate guidelines on our website for FOI Act requests
How to make a request
Subject access requests must be made directly to the organisation but can be submitted in various ways, including by email, letter, telephone or through the organisation’s dedicated social media channels.
In the interest of efficiency, we ask that requests are as clear and as specific as possible. This includes citing any specific information you require, or any members/teams within the organisation that you know will have dealt with the information previously. Under your ‘right of access’ you have the right to request all personal data held about you by an organisation. If this is more suited to your needs, please include it in your request.
The appropriate contact details are included at the end of this guidance. We will require proof of identity before personal data can be released. In keeping with the ICO’s guidelines, information used to prove identity will be minimal and will be not be stored as recorded information.
How your request will be handled
Once a request is received, we will respond, without undue delay, within one calendar month. This period will start on the day the request is received and will end on the corresponding date of the following month. We may contact you to clarify a certain aspect of the request, but this will not affect the deadline. As mentioned earlier, being as specific and clear as possible from the start will improve the process for all parties.
If the corresponding date is not a working day, the deadline will become the next possible working day. Under current legislation, we reserve the right to extend this deadline by two months should the request be particularly complex or time-consuming. In this case, you will receive written confirmation of this extension.
If we do not hold any of your personal information, we will inform you in writing. Should we know of another organisation that may hold the required data, we mya be able to direct you towards them.
Your data rights
You may request to see your personal information or have it corrected. Under the Data Protection law (Data Protection Act 2018 and the UK General data Protection Regulations (UK GDPR) you have rights we need to make you aware of. The rights available too you depend on our reason for processing your information.
Right to be informed – privacy information is available via the EWC privacy notice;
Right of access - you have a right to see the personal information that we hold on you and some other supplementary data. These rights are commonly referred to as ‘subject access’. We will require proof of identity before disclosing any information. We will respond to your request without undue delay and at the latest within one month of receipt. There are exemptions which may mean that we do not need to comply with all, or part, of your request.
Right to rectification – you have a right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Right to erasure– you have the right (in certain specific circumstances) for your data to be ‘erased’
Right to restrict processing – you have the right to ask us to restrict the processing of your information. This right is limited where the processing is based on legitimate interests and/or is for the purpose of research and statistics
Right to object to processing –you have the right (in certain specific circumstances) to object to processing
Right to data portability - the right to ask that we transfer information about you to another organisation. This right only applies if we are processing information based on your consent, or under a contract and the processing is automated.
Could I be charged for accessing this information?
In some cases, you may be charged a reasonable fee to cover administrative costs. If a request is found to be ‘manifestly unfounded’, excessive or a repeat of an earlier request, these charges may apply. Most requests will be dealt with free of charge. Where a charge is applied, you will be informed in writing and the request will be put on hold until you respond.
Can your request be refused?
A request can be refused (both partially and entirely) under certain circumstances. Should the organisation find a request to be ‘manifestly unfounded’ or ‘excessive’, it can be refused outright under current legislation.
We may also refuse any request where we find an exemption applies, i.e. any potential impact on an unknowing third-party.
Should the organisation refuse your request, you will receive written confirmation outlining the reasons for taking the decision.
Our legal basis for processing
The Education Workforce Council was established by the Education (Wales) Act 2014. Our principal aims and functions are set out in legislation. As a result, it is in the public interest for the organisation to carry out the processing of personal data and, in some cases, special category personal data.
Where data is anonymous and used for statistical purposes only, we may not be required to comply.
How to make a complaint
Should our response be unsatisfactory in any way, you have the right to make a complaint. Complaints can be made to us directly, or alternatively the ICO (or another supervisory authority).
https://ico.org.uk/global/contact-us/
If you make a complaint to us directly, it will be dealt with impartially. It will be passed on to a senior member of staff who was not part of the original response.
How to contact us
Email:
Telephone: 02920 460099
Twitter: @ewc_wales
Mail:
Education Workforce Council,
9th Floor, Eastgate House,
35-43 Newport Road,
Cardiff,
CF24 0AB