Procedure for Subject Access Requests
All individuals who are the subject of personal data held by the Council for Catholic Maintained Schools (CCMS) are entitled to:
- obtain confirmation that their data is being processed and access the personal data which CCMS holds about them (a Subject Access Request).
- request that CCMS corrects any personal data found to be inaccurate or incomplete.
- to request that a restriction is placed on further processing, where there is a dispute about the accuracy or processing of their personal data.
- to request that their personal data is erased where it is no longer necessary for CCMS to retain it.
- to withdraw their consent to the processing at any time, if their consent is being relied upon
- to request that CCMS provides them with their personal data; and
- in some circumstances, and where possible, to have CCMS share that data directly to another data controller.
Individuals wishing to exercise any of these rights should submit a request in accordance with the following procedure. Any request in relation to individual rights may be refused if an exemption applies.
Make your request in writing to the Data Protection Officer:
Data Protection Officer
CCMS
Third Floor, 23 Linenhall Street
Lisburn
BT28 1FJ
- by email to: foi@ccmsschools.com
- via a third party. If, due to a disability, you cannot put your request in writing, you may have a third party make the request on your behalf.
- you can also complete the online form which can be found on the Information Commissioners website:Make your subject access request | ICO
Your request should include details of who you are and provide evidence of your identity.CCMS will normally require your full name and address, your telephone number, a proof of ID (either a copy of a passport or driving license) and a proof of address (either a copy of a bank statement, utility bill or TV licence). If you are making the request for someone else, you should provide proof of ID and address for them (not for you). You will also need to provide evidence that you're allowed to make the request for them eg a signed letter of consent, a power of attorney document or proof of parental responsibility such as a birth or adoption certificate.
This information will be held for no more than1 year.
You should also provide as much detail as possible regarding the information - the subject matter of your request, (e.g. where and by whom the information is believed to be held, specific details of information required etc).
Should your request relate to previous contact with CCMS, where possible, you should provide the dates during which you had contact with us, any reference number quoted on correspondence and the name of the division/person you corresponded with.
You are not required to state why you wish to exercise your right.
The details we require are solely to aid the efficient location and retrieval of information.
Timescale
Once the Data Protection Officer receives a request, all efforts will be made to fully comply as soon as possible. In any event, in the case of a Subject Access Request, you will receive all the information that has been located and can be released within one calendar month, and an explanation for any information that cannot be provided at that time.
Information about third parties
In accordance with the Data Protection Act 2018 (The 2018 Act) CCMS cannot release information held about individuals without their consent. Therefore, if information held about you also contains information related to a third party, CCMS will make
every effort to anonymise/redact that information.If this is not possible, and CCMS has been unable to secure the relevant consent, CCMS may decide not to release the information.
Review
This policy will be updated as necessary to reflect best practice and to ensure compliance with any changes or amendments to the Data Protection Act 2018.