FOI23/24 113 Subject Access Requests Received 2022/2023
FOI reference: 23/24 113
Date received: 17/11/2023
Date responded: 04/12/2023
Information requested
1 How many Subject access requests have you received from April 2022- April 2023
2. How long on average does it take to respond to each request?
3. How many requests are returned to the subject late? (either after 1 calendar month or an extension)
4. Where are the records for the SARs kept? Paper, storage systems? Please be specific
5. How large is your team which deal with subject access requests
6 What data do you typically redact in a SAR response?
6.1 How long does it take you to redact an average response?
7. How many employee SARs have you received (April 2022-23) and how many were responded to late?
8. Who holds the budget for this issue within your organisation?
9. What is the estimated cost to the business per SAR? (employee and end user)
Response
1 How many Subject access requests have you received from April 2022- April 2023
658 subject access requests were received within the requested timeframe.
2. How long on average does it take to respond to each request?
It takes an average of 16 days to respond to requests.
3. How many requests are returned to the subject late? (either after 1 calendar month or an extension)
There were three responses returned late during that period. One was two days late and two were a day late.
4. Where are the records for the SARs kept? Paper, storage systems? Please be specific
A log of the SARs received is kept in M365 (SharePoint), folders containing copies of the information requested and responses in a network folder and related correspondence in a limited access, shared mailbox within Outlook.
5. How large is your team which deal with subject access requests
Our Data Protection team has 2 members of staff; one of whom leads on providing responses to subject access requests. Members of staff from other teams are involved in finding and retrieving the relevant information. Their number will vary depending on the nature of the request.
The Data Protection team forms part of a wider Information Governance team, that consists of seven members of staff and covers data protection, information security, freedom of information and records management. When there is a large volume of subject access requests received, other members of the Information Governance team can step in and help to prepare the responses.
6 What data do you typically redact in a SAR response?
The type of information that is typically redacted is:
Information about other candidates. For example, their name, Scottish Candidate Number (SCN) or entries.
Information about markers. For example, their name, initials, or marker ID.
Information about SQA staff who have not been in contact with the candidate. For example, the name or user ID of the person accessing candidate information for the request.
Objective test answers.
Information relating to SQA systems.
6.1 How long does it take you to redact an average response?
Under section 17 of the Act, where an organisation does not hold information, it should notify the requester to that effect.
We do not record this and as such we do not hold the information requested.
7. How many employee SARs have you received (April 2022-23) and how many were responded to late?
Three SARs were received. This represents both current and former employees, and none were responded to late.
8. Who holds the budget for this issue within your organisation?
The Head of Service for Strategic Planning & Governance holds the budget for this.
9. What is the estimated cost to the business per SAR? (employee and end user)
Under section 17 of the Act, where an organisation does not hold information, it should notify the requester to that effect.
We do not record this and as such we do not hold the information requested.