SAR requests

The request was successful.

Dear Cardiff University,

This is an information request under the Freedom of Information Act of 2000.

The purpose of this request is to inform estimates of the volume of information organisations hold about employees, and how this is changing over time. It forms part of research on emerging risks relating to AI, people analytics, and algorithmic workplace technologies.

Please provide:
1) A copy of or link to your organisation’s current internal guidance on preparing data for Subject Access Requests (including any personal data/SAR request form currently in use).

2) A copy of or link to your organisation’s privacy policy that applies to employees.

3) For the five most recent SARs you have received that included a request for the requester's personnel file [i], which you provided information in electronic format in respect of (i.e. which were not withheld due to failure to provide identification, being assessed as manifestly unfounded/excessive, or exemptions), please provide:
a. the calendar year the SAR information was sent to the subject
b. the total filesize (in megabytes, MB, to the nearest whole number rounding up) of information sent. Where multiple messages were sent this number should be the total filesize across all messages that fulfilled the SAR. Filesize can be simply determined just by using the size of email(s) or .zip files provided.
c. an indication of the types of information sent to the requester (see checklist below, ‘Summary of information provided’).
d. the approximate length of service of the requesting employee at the date the request was received (0-2 years, 3-5 years, 6-10 years, 11+ years) [ii].
e. whether a narrative description of information used for automated decision making and profiling was provided with the SAR response [iii].

4) As above but for the five least recent Subject Access requests that meet the description in (3), and which are available in a retrievable electronic format. For example, if your organisation has records of Subject Access Requests dating back to 2014, the information you provide might consist of details relating to five SARs from 2021-22, and five SARs from 2014-15.

Yours faithfully,

Vincent Bryce

Notes
[i]’Personnel file’ can be interpreted as any requests which included either the words ‘personnel’ or ‘HR’, and the words ‘record’ or ‘file’ or ‘data’ in the request detail. This will include requests made by both current or former employees.
[ii]If the requester was a former employee, please provide approximate length of service at the point they exited the organisation.
[iii]If no reference to automated decision making and profiling was provided in the SAR response, state ‘not provided’. If the response stated that no data are used for automated decision making and profiling, state ‘no’. If information was provided that one or more types of information are used for automated decision making and/or profiling, state ‘yes’.
An example of the response expected is as follows:
1) see attached document
2) see [insert link]
3) see table
4) see table

Link to example table format:
https://www.dropbox.com/s/f34zk2fpv5w31e...

InfoRequest, Cardiff University

1 Attachment

Dear Vincent,

 

I acknowledge receipt of your email received by this office on 26^th
August 2022.  

 

Your request will now be dealt with under the Freedom of Information Act
2000 and has been allocated reference FOI22-291 which should be quoted in
all correspondence. We will respond to your request within 20 working days
starting the next working day after receipt, therefore you can expect to
receive a response no later than 26^th September 2022.

 

Where we consider that we will not be able to meet the deadline or if
further time is required to consider the public interest test we will
contact you as soon as possible and give you a revised date for response.

 

In some circumstances a fee may be payable and, if that is the case, we
will let you know. A fees notice will be issued to you, and you will be
required to pay before we will proceed to deal with your request.

 

Yours sincerely

 

Ian Johnson                                                               
             Ian Johnson  

  Swyddog Cydymffurfiaeth                                    
              Compliance Officer 

  

Swyddfa Ysgrifennydd y Brifysgol    University Secretary’s Office 

Prifysgol Caerdydd    Cardiff University 

42 Park Place      42 Park Place  

Caerdydd    Cardiff 

CF10 3BB    CF210 3BB 
Ffôn: 029 208 79633  Phone: 029 208 79633 

E-bost: [1][email address]  E-mail: [2][email address

     

Rydym yn croesawu gohebiaeth trwy’r We welcome correspondence in Welsh or
Gymraeg neu’r Saesneg. Ni fydd gohebu    English. Corresponding in Welsh will
yn Gymraeg yn creu unrhyw oedi.  not lead to any delay. 

     

Ysgrifennwch ataf yn Gymraeg neu’n Please write to me in Welsh or
Saesneg  English 

   

 

  

Phone: 029 208 79633 

E-mail: [email address

  

We welcome correspondence in Welsh or English. Corresponding in Welsh will
not lead to any delay. 

  

Please write to me in Welsh or English 

 

 

 

show quoted sections

InfoRequest, Cardiff University

 

Dear Vincent,

 

Further in this matter, we are unable to open the below links which
provide examples of the information you seek.

 

Can you please resend these?

 

Yours sincerely  

 

 

Swyddfa Ysgrifenydd y Brifysgol University Secretary’s Office

Prifysgol Caerdydd Cardiff University

Ebost : [1][email address] Email: [2][email address
 
 
 
The University welcomes
Mae'r Brifysgol yn croesawu correspondence in Welsh or English. 
gohebiaeth yn Gymraeg neu'n Saesneg.  Corresponding in Welsh will not lead
Ni fydd gohebu yn Gymraeg yn creu to any delay.
unrhwy oedi.

 

 

show quoted sections

Dear InfoRequest, thanks for your reply.
I am sending a downloaded copy of the example file to your email address (the link is working so I suspect it is an organisational policy that may be preventing Dropbox downloads).

Yours sincerely,

Vincent Bryce

InfoRequest, Cardiff University

2 Attachments

Dear Vincent,

 

I am writing in response to your Freedom of Information request dated
26^th August 2022.

 

For ease of reference, I have reproduced your questions below with our
corresponding responses.

 

Please provide:

 

1) A copy of or link to your organisation’s current internal guidance on
preparing data for Subject Access Requests (including any personal
data/SAR request form currently in use).

 

Please see attached word document.

 

Information on how an individual can make a request can be found on our
website:
[1]https://www.cardiff.ac.uk/public-informa...

 

2) A copy of or link to your organisation’s privacy policy that applies to
employees.

 

Please refer to our website here:
[2]https://www.cardiff.ac.uk/public-informa...

 

3) For the five most recent SARs you have received that included a request
for the requester's personnel file [i], which you provided information in
electronic format in respect of (i.e. which were not withheld due to
failure to provide identification, being assessed as manifestly
unfounded/excessive, or exemptions), please provide:

 

a. the calendar year the SAR information was sent to the subject

 

Please see attached PDF document.

 

b. the total filesize (in megabytes, MB, to the nearest whole number
rounding up) of information sent. Where multiple messages were sent this
number should be the total filesize across all messages that fulfilled the
SAR. Filesize can be simply determined just by using the size of email(s)
or .zip files provided.

 

Please see attached PDF document.

 

c. an indication of the types of information sent to the requester (see
checklist below, ‘Summary of information provided’).

 

d. the approximate length of service of the requesting employee at the
date the request was received (0-2 years, 3-5 years, 6-10 years, 11+
years) [ii].

 

Please see attached PDF document.

 

e. whether a narrative description of information used for automated
decision making and profiling was provided with the SAR response [iii].

 

Please see attached PDF document.

 

4) As above but for the five least recent Subject Access requests that
meet the description in (3), and which are available in a retrievable
electronic format. For example, if your organisation has records of
Subject Access Requests dating back to 2014, the information you provide
might consist of details relating to five SARs from 2021-22, and five SARs
from 2014-15.

 

Please see attached PDF document.

 

 

I trust this information satisfies your enquiry.  Should you feel
dissatisfied with this response or the way in which your request was
handled you can request an Internal Review. This should be made in writing
within 40 working days of the date of this email. Please provide your
unique reference number of your request, information on why you are
dissatisfied and any detail you would like us to consider as part of the
Internal Review process. Email your request to
[3][email address] where it will be forwarded to the Head of
Compliance and Risk who will be responsible for overseeing the review.

 

If you remain dissatisfied following the outcome, you have the right to
apply directly to the Information Commissioner for consideration.  The
Information Commissioner can be contacted at the following address:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF.

 

I would like to take this opportunity to thank you for your interest in
Cardiff University. If you require further assistance please feel free to
contact me.

 

Yours sincerely

 

 

 

 

Swyddfa Ysgrifenydd y Brifysgol University Secretary’s Office

Prifysgol Caerdydd Cardiff University

Ebost : [4][email address] Email: [5][email address
 
 
 
The University welcomes
Mae'r Brifysgol yn croesawu correspondence in Welsh or English. 
gohebiaeth yn Gymraeg neu'n Saesneg.  Corresponding in Welsh will not lead
Ni fydd gohebu yn Gymraeg yn creu to any delay.
unrhwy oedi.

 

 

 

References

Visible links
1. https://www.cardiff.ac.uk/public-informa...
2. https://www.cardiff.ac.uk/public-informa...
3. mailto:[email address]
4. mailto:[email address]
5. mailto:[email address]

Dear InfoRequest,

Thank you for the response which I believe includes nearly all aspects of what was requested,

For four records (those numbered 1,3,4 and 5 in the PDF list returned), approx. LOS information was not provided for the following reason: "Information not recorded in SAR records"
However, the institution should hold Length of Service data relating to the items in question in its HR system. The approximate LOS can therefore be returned based on a brief check with the HR team of the length of service for the employees/ex-employees in question.

Please could I request that these four values are added, after which I will regard the request as fully completed.

Yours sincerely,

Vincent Bryce

InfoRequest, Cardiff University

Dear Vincent,

Thank you for your email.

We will liaise with our HR department and revert to you shortly.

Yours sincerely

Swyddfa Ysgrifenydd y Brifysgol
Prifysgol Caerdydd
Ebost : [email address]  

Mae'r Brifysgol yn croesawu gohebiaeth yn Gymraeg neu'n Saesneg.  Ni fydd gohebu yn Gymraeg yn creu unrhwy oedi.
University Secretary's Office
Cardiff University
Email: [email address

The University welcomes correspondence in Welsh or English.  Corresponding in Welsh will not lead to any delay.

show quoted sections

InfoRequest, Cardiff University

1 Attachment

Dear Vincent,

 

Further to your email of 20^th October 2022, please find attached an
updated response including length of service banding.

 

Yours sincerely,

 

 

Swyddfa Ysgrifenydd y Brifysgol University Secretary’s Office

Prifysgol Caerdydd Cardiff University

Ebost : [1][email address] Email: [2][email address
 
 
 
The University welcomes
Mae'r Brifysgol yn croesawu correspondence in Welsh or English. 
gohebiaeth yn Gymraeg neu'n Saesneg.  Corresponding in Welsh will not lead
Ni fydd gohebu yn Gymraeg yn creu to any delay.
unrhwy oedi.

 

 

 

 

show quoted sections