Subject Access Request Policy

Publication date: July 2024

1.   Subject Access Requests

1.1    Under the UK General Data Protection Regulation (GDPR), any Fellow or member or other individual has a number of rights relating to personal data held about them by the RCR:
•    Fellows and members have the right to access their personal data ‒ this is referred to as
subject access
•    Fellows and members can make a subject access request orally or in writing, including on social media
•    We have 30 days to respond to a request
•    We cannot charge a fee to deal with a request in most circumstances

2.    What is a subject access request? (SAR)

2.1    The GDPR gives Fellows and members the right to be told what personal information the RCR holds about them and, unless an exemption applies, to receive a copy of that information.

2.2    This right is exercised by an individual making a subject access request which may be received by anyone in the College including Officers, trustees, or any member of staff. A request does not have to include the phrase 'subject access request' or reference Article 15 of the GDPR, as long as it is clear that the individual is asking for their own personal data. The request can be very broad (such as, ‘give me a copy of information you hold about me’) or it can be very precise (‘give me a copy of my database record’).

2.3    A request is valid even if the requester has not sent it directly to the person who normally deals with such requests – so it is important to ensure that all staff can recognise a subject access request and treat it appropriately.

2.4    This right applies to both structured and unstructured data sources. Structured data can, for the most part, be easily entered, stored, queried and analysed. Unstructured data can be described as types of data not organised in a defined manner which can include e-mails, videos, pictures, social media posts, presentations and PDFs.

3.    What does this mean for The Royal College of Radiologists?

3.1    Any private individual (Fellow, member, staff member, member of the public) has the right to make a SAR. They can ask for:
•    Copies of any personal data about them held by the RCR
•    An explanation of what the RCR uses that data for, if it is not clear from the records
•    An explanation of who else has access to the data, if is it shared with a third party outside the RCR

3.2    The General Data Protection Regulation gives an individual the right to see information held about them. This means they can request information about themselves and their exam performance, including:
•    Their mark
•    Comments written by the examiner and
•    Minutes of any examination appeals panels
 
3.3    An individual may ask a third party (e.g. a relative, friend or solicitor) to make a SAR on their behalf. You may also receive a SAR made on behalf of an individual through an online portal. Before responding, you need to be satisfied that the third party making the request is entitled to act on behalf of the individual. It is the third party’s responsibility to provide evidence of their authority.

3.4    The requester must include enough detail for the RCR to be able to identify all relevant data, for example, their full name, date of birth or RCR number and any other information necessary for data to be found. If necessary, you can request further ID from the requester to verify their identity.

4.    If you receive a Subject Access Request

4.1    Advise the RCR Governance team immediately. If the Data Protection Officer deems it to be a SAR, then responsibility for responding will move to the Governance team. If it is not deemed a SAR, then the responsibility to respond will lie with the original recipient or the appropriate team.
4.2    Please seek the advice of the RCR Governance team if you have any doubt as to whether a request is a SAR.
4.3    The RCR is obliged to respond to a subject access request promptly and in any event within 30 calendar days of receiving it, in line with UK GDPR.
4.4    We must provide a copy of the information we hold about individuals free of charge. However, we can charge a ‘reasonable fee’ when a request is manifestly unfounded or excessive, particularly if it is repetitive. We may also charge a reasonable fee to comply with requests for further copies of the same information.

5.    Compliance

5.1    Everyone that works for the RCR is required to comply with this policy. Any individual that is suspected of or found to not be complying with the policy requirements will be managed under the RCR's Disciplinary Procedure.