Privacy Notice for Data Subject Rights Requests

Living individuals (data subjects) have a number of rights under data protection laws. You can read about them on this ICO webpage. When you submit a request related to one of those rights (for example, a Subject Access Requests (SAR), Rectification Request, Erasure Request, Data Portability Request, Restriction Request, Objection Request or request for human interaction in an automated decision-making process including profiling) or a complain related to any of the above, you provide BCU with personal information including your name and contact details.

The legal basis for BCU processing this personal information is ‘legal obligation’ as we have a legal obligation to respond to request or related complaint. You might choose to include some information called ‘special category personal data’ under data protection law. We encourage you to only provide us with the minimum information we need in order to carry out your SAR. This includes information about your health (including mental health), race, ethnic origin, religion, sexual orientation, political opinions, philosophical beliefs, trade union membership, genetic data and biometric data. 

The special condition permitting the processing of the special category personal data depends on the context. It might be Article 9(2)(b) ‘Employment, social security and social protection law’, which would include the Equality Act 2010, or it might be Article 9(2)(a) ‘Explicit consent’. Therefore please only include any special category data you explicitly consent for BCU to process, otherwise we will not be able to process your request.

BCU will use your personal data to help respond to your request or related complaint. We keep your request documentation on file for up to the last action plus 6 years, unless there is an identified need to keep it for longer. We may keep your name, relationship with BCU (e.g. former student, member of the public etc.) and date of the request (or related complaint) on a register for 10 years for monitoring purposes.

Your personal data will only be accessible to relevant staff, for example staff involved in responding to your request and a related complaint and, where relevant, HR. Hard copies of personal information are kept in locked storage and personal data stored electronically is on secure systems within the UK or EU.

BCU would only share the personal data you have provided as part of the request with an external organisation if it was needed in order to process the request (e.g. we needed to inform a data processor of a rectification), if we believe we are compelled to by law or we seek external assistance such as a consultant or legal advice.

You have the right to correct or update your personal data at any time. You have the right to request access to your personal data. You have the right to request the restriction of the processing of your personal data. If we are processing your personal data on the basis of your consent, you have the right to withdraw your consent at any time. However, if you choose to retract your consent before your request or related complaint is considered, we will not be able to take the personal data that was relying on your consent into consideration.

To correct or update your personal data in relation to your request or to retract your consent for the processing of any special category data within the request or complaint, or to retract the request itself, please email informationmanagement@bcu.ac.uk unless it relates to a Subject Access Request, in which case please email SAR@bcu.ac.uk. To read more about your rights please go to the ICO website https://ico.org.uk/for-the-public/.

If you are not satisfied with the response to your request, you have the right to lodge a complaint with the Information Commissioners Office about the handling of your personal data and can find out more about this on their website https://ico.org.uk/make-a-complaint/.

• Birmingham City University’s Data Protection Policy and Appropriate Policy Document
• Birmingham City University’s Privacy Notices
• The Information Commissioner’s Office (ICO) information for members of the public