Data Protection Policy
A PROTECTION POLICY
Carnegie College is registered as a Data Controller under the Data Protection Act 1998, and works at all times in line with the terms of the Act. Should you wish to view the College’s Register Entry, a copy is available in the College Library and at the main Reception.
OPENNESS AND TRANSPARENCY
In processing or getting personal data, the College aims to be open and transparent in so far as it recognises that it is a custodian of all personal details about its clients and staff. The College adheres to the eight data protection principles contained within the Act, which are:
- Personal data shall be processed fairly and lawfully and shall not be processed unless certain conditions are met.
- Personal data should be obtained only for one or more specified and lawful purpose and shall not be further processed in any manner incompatible with that purpose or those purposes.
- Personal data shall be adequate, relevant and not excessive in relation to the purpose.
- Personal data shall be accurate and where necessary kept up-to-date.
- Personal data processed for any purpose shall not be kept for longer than is necessary for that purpose or those purposes.
- Personal data shall be processed in accordance with the rights of data subjects under the Act.
Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
Personal data shall not be transferred to a country or territory outside the European Economic Area (the 15 EU member states plus Iceland, Liechtenstein and Norway) unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
SUBJECT ACCESS REQUEST (SAR)
If you wish to access information which the College (the data controller) holds about you, a “Subject Access Request” (SAR) form can be obtained from the main Reception which you should fill in and return. You can also write to the Head of Customer Services, Carnegie College, Pittsburgh Road, Dunfermline KY11 8DY. You must clearly identify yourself and the information you need to allow your request to be dealt with. There will be a maximum fee of £10.00 for each SAR.
You will only be able to send two SARs each session for the same information and there must be a gap of six months between the first and second request.
There are certain categories of information that the College does not need to, or is not allowed to show to you. These generally relate to the investigation of a crime or where to show the information would reveal the identity of another individual.
The normal response time from the College to you is 40 days, although this may be extended to five months in the case of SARs about internal examinations and assessments where the SAR is made before the announcement of results. However if you request that the College stops or does not begin processing data, you are entitled to a decision within 21 days.