1. Access to Information: Data Protection and Freedom of Information Records Management Section

2. Data protection: key concepts Personal data Sensitive personal data Data subjects Data protection principles

3. What happens if we get it wrong? Fraud, identity theft, distress Damage to relationships and research access Reputational damage Investigated by the Information Commissioner The University can be fined up to £500,000 The University can be sued Personal criminal offences –Unauthorised disclosure –Destruction of information required for a request –Processing without notification

4. Data protection: what you must do 1.Respond to subject access requests within 40 calendar days 2.Tell individuals what you do with information about them 3.Keep personal data securely 4.If you pass data out with the University, follow the policies and procedures 5.Use University retention schedules and disposal guidance

5. Freedom of information: principal requirements Individual requests –Received 165 requests in 2009 –Second highest in HE sector –Popular topics: expenses, salaries, student population and conduct Publication scheme –Must keep up-to-date –Must publish in line with obligations –www.pubs.recordsmanagement.ed.ac.ukwww.pubs.recordsmanagement.ed.ac.uk Records management –Helps to find information

6. What does freedom of information mean for you?

7. Enforcement Complain to the Scottish Information Commissioner Personal criminal offence –Destruction of information required for a request Contempt of court

8. Advice and assistance Your local practitioner –http://www.recordsmanagement.ed.ac.uk/internal/pr actitioners/PractitionersList.htmhttp://www.recordsmanagement.ed.ac.uk/internal/pr actitioners/PractitionersList.htm The Records Management Section –recordsmanagement@ed.ac.ukrecordsmanagement@ed.ac.uk –http://www.recordsmanagement.ed.ac.ukhttp://www.recordsmanagement.ed.ac.uk –0131 651 4099

9. Questions?