The Data Protection Act 1998

The Data Protection Act 1998 came into force on 1 March 2000. The Act governs the collection, retention, use and transmission of information about living individuals and the rights those individuals have to see this information. The Act covers personal information in both electronic form and manual form (e.g. paper files, card indices) if the information is held in a relevant, structured filing system. The measures and procedures the University has in place to ensure adhere to the Act are based on the Joint Information Systems Committee Code of Practice (JISC) Data Protection Code of Practice for the HE and FE Sectors.

As part of its obligation, the University, on an annual basis, informs the Information Commissioner's Office of the purposes for which personal information is processed together with the types of individuals who are the subject of the data (data subjects), the types of data being processed (data classes), the individuals or organisations to which the University does or intends to disclose data and the countries to which, if any the data is transferred. The University registration number is Z5856740 and further details of the Data Protection register entry be found on the Information Commissioner's website at this link http://www.ico.gov.uk/

What Does The Act Mean For University Staff?

• All members of staff at the University of Warwick who handle or process personal data about individuals in any way (names, contact details, financial details, course details, personal circumstances, beliefs, etc) must be aware of the Data Protection principles and how to apply them lawfully.
• If you receive a request from an individual or organisation to gain access to personal data held by the University about individuals, in most cases DO NOT provide the data yourself.
• If the individual wanting to gain access to the data is the subject of the data (i.e. Joe Bloggs wants to see his personal file), please refer the request to the Administrative Officer for Legal Compliance at infocompliance@warwick.ac.uk who will process the data subject access request.
• If the individual or organisation wanting to gain access to the data is not the subject of the data (i.e. a company wants to see data on members of staff, or a law enforcement agency wants to locate an individual) do not provide the information, but ask them to redirect their request to the Administrative Officer for Legal Compliance at infocompliance@warwick.ac.uk. NB: this does not prevent you from providing references on behalf of students to potential employers in the usual way - in such cases you are free to provide the references directly without recourse to the Administrative Officer for Legal Compliance. It also does not prevent you from releasing data to organisations such as HESA, funding bodies, etc as part of our statutory requirements. You may also transfer personal data about individuals to third parties in other cases provided the individuals who are the subject of the data have consented to their data being transferred in this way in the form of a written or electronic record to that effect.
• Staff involved in processing new types of personal data have a responsibility to inform the Administrative Officer for Legal Compliance at infocompliance@warwick.ac.uk so the University's notification can be immediately updated. In providing any such updates, full details should be included of the type of personal data to be processed (i.e. financial details, contact details, etc), who the subject of the data is (students, staff, the public, etc), why the data is being processed (marketing, staff administration, etc) and whether the intention is at any time to transfer the data to a third party external to the University who is not the subject of the data, including whether this is an international partner.
• Useful links: JISC Guidelines

 Data Protection Act 1998

 Information Commissioner's website

What Does The Act Mean For Students Of The University?

All students at the University of Warwick who handle or process personal data about individuals (names, contact details, financial details, course details, personal circumstances, beliefs etc) in the course of their studies must be aware of the Data Protection principles and how to apply them lawfully within the confines of the University Data Protection policy. It may be that certain conditions are in place, eg for dealing with NHS or DWP data, so you are advised to speak to your tutor and department in the first instance. Further clarification can be sought from the Administrative Officer for Legal Compliance at infocompliance at warwick dot ac dot uk

How Do I Make A Request for Personal Information Held About Me? (Data Subject Access Request)

In order to access copies of personal information about you, held by the University of Warwick, as 'data subject' you are asked to complete a DP1 FORM, which can be downloaded here. In addition you will need to send a £10 fee (cheques to be made payable to the ‘University of Warwick’), together with copies of two forms of ID (passport, driving licence, staff/student badge etc). Please note that the University is unable to process verbal requests for personal information.

A fee is applicable for every Data Subject Access Request, so you are advised to make your request for information as specific as possible to include, details of dates, type of information (eg memos, letters, reports, emails etc), department and the names of authors and recipients, where appropriate. You may find the guidance provided by the Information Commissioner’s Office at www.ico.gov.uk ‘How to access your information’ useful.

Under the Data Protection Act 1998, if the request is not clear, the University reserves the right to seek additional information from the data subject, before processing the request. The statutory period for requests to be fulfilled is 40 calendar days, but you will be advised of the reasons why it may be necessary to extend this period, eg if the original request is not clear and further clarification is required.

Please forward your completed form, proof of ID and fee to:

Alison Thompson, Administrative Officer for Legal Compliance, Deputy Registrar's Office Office, University House, University of Warwick, Coventry CV4 8UW

The Administrative Officer for Legal Compliance is also available on (024) 761 50949 to answer questions about the University's obligations under the Data Protection Act, but will only provide legal advice to University staff or student members.

Please be aware that in some cases specific procedures are in place for allowing access to particular types of information, such as access to copies of Student Transcripts.. In these cases please follow the existing procedures.