Data Subject Access Procedures

Purpose

This procedure will be used when a data subject exercises one or more of the rights, they are granted under the applicable data protection laws such as the California Consumer Privacy Act (CCPA).

Scope

A comprehensive description of the policy, including why it is needed, how the policy will meet the need or solve the problem, what procedures may be required, what operational activities may be affected, and in which areas.

1. Procedures

Each of the rights involved has its own specific aspects and challenges to [InnoveBW] (“Company”) in complying with them and doing so within the required time periods. In general, a proactive approach will be taken that places as much control over personal data in the hands of the data subject as possible, with a minimum amount of intervention or involvement required on the part of Company. This may be achieved by providing online access to the personal data so that the data subject can verify and amend it as required.

However, in some cases, there is a decision-making process to be followed by Company regarding whether a request will be allowed or not; where this is the case, the steps involved in these decisions are explained in this document.

1.1 Data Subject Request Procedures

Data Subject Access Request (“DSAR”)

A Data Subject Access Request is any request made by an individual (i.e., the data subject) or an individual’s legal representative regarding personal data held or controlled by the Company about that individual. The DSAR may include a request for data subjects to see or view personal data about them as well as to request copies of such data.

A DSAR can be made via any of the following methods: email, fax, post, corporate website or any other method. DSARs made online must be treated like any other DSARs when they are received, though the Company will not provide personal data via social media channels.

A data subject’s rights regarding a DSAR are not absolute. Therefore, although a data subject’s request may be valid and timely, there are certain exceptions to complying with a DSAR, and there may be a reason to either deny or partially grant a DSAR. See below for examples of exemptions to fulfilling a DSAR.

General Points

The following general points apply to all the requests described in this document:

1. Information shall be provided to the data subject in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, for any information addressed specifically to a child.
2. Information may be provided in writing, or electronically or by other means.
3. The data subject may request the information orally (e.g. over the telephone or face to face), if the identity of the data subject has been established.
4. We must act on a request from a data subject unless we are unable to establish their identity.
5. We must provide information without undue delay and within a maximum of one month from the receipt of the request.
6. The response time may be extended by up to two further months for complex or a high volume of requests – the data subject must be informed of this within one month of the request, and the reasons for the delay given.
7. If a request is made via electronic form, the response should be via electronic means where possible, unless the data subject requests otherwise.
8. If it is decided that we will not comply with a request, we must inform the data subject without delay and at the latest within a month, stating the reason(s) and informing the data subject of their right.
9. Generally, responses to requests will be made free of charge, unless they are “manifestly unfounded or excessive”, in which case we will either charge a reasonable fee or refuse to action the request.
10. If there is doubt about a data subject’s identity, we may request further information to establish it.

1.2 The Rights of a Data Subject

Depending on a data subject’s applicable jurisdiction, they may have certain rights related to Company’s collection and use of their personal data. A summary of some of these rights is below

1. The Right to Confirm/Know. At the point where personal data are collected from the data subject or obtained from another source, Company is required to inform the data subject about our use of that data and their rights over it. Compliance with this right is addressed in a separate policy, Privacy Notice Procedures, which describes the information that must be provided and sets out how and when this must be achieved.
2. The Right to Request Access (Data Portability). A data subject has the right to ask Company whether we process data about them, to have access to that data and in addition the information below. In most cases, the decision-making process for such requests will be straightforward unless it is judged that the request is manifestly unfounded or excessive. The compilation of the information is likely to require the input of the data owner.
   1. The categories of personal information it has collected about that consumer.
   2. The categories of sources from which the personal information is collected.
   3. The business or commercial purpose for collecting or selling personal information.
   4. The categories of third parties with whom Company shares personal information.
   5. The specific pieces of personal information that Company has collected about that consumer.
3. The Right to Request Deletion. The data subject has the right to require Company to delete personal data about them without undue delay unless there is a legal reason for Company to refuse to delete such personal data.
4. The Right to Request Correction. The data subject has the right to request the correction of his/her personal information that Company collected.
5. The Right to Opt-Out of Sale or Sharing of Personal Information. The data subject has the right to direct Company to not sell or share their personal information for cross-context behavioural advertising.
6. The Right to Object. The data subject has the right to object to the processing of their personal information.
7. The Right to Withdraw Consent. The data subject has the right to withdraw consent where consent was the legal basis for processing.
8. The Right to Restrict Processing. The data subject has the right to request the restriction of processing of their personal information in certain circumstances.
9. The Right to Appeal. The data subject has the right to appeal a decision made against them in certain circumstances.

1.3 Exemptions

An individual does not have the right to access information recorded about someone else, unless they are an authorized representative, or have parental responsibility. The Company is not required to respond to requests for information unless it is provided with sufficient details to enable the location of the information to be identified, and to satisfy itself as to the identity of the data subject making the request. In principle, the Company will not generally disclose the following types of information in response to a Data Subject Access Request:

Information about other people. A Data Subject Access Request may request information which relates to an individual or individuals other than the data subject. Access to such data will not be granted, unless the other individuals involved consent to the disclosure of their data.

Repeat requests. Where a similar or identical request in relation to the same data subject has previously been complied with within a reasonable time period, and where there is no significant change in personal data processed in relation to that data subject, any further request made within a six month period of the original request will be considered a repeat request, and the Company will not normally provide a further copy of the same data

Publicly available information. The Company is not required to provide copies of documents which are already in the public domain.

Opinions given in confidence or protected by copyright law. The Company does not have to disclose personal data held in relation to a data subject that is in the form of an opinion given in confidence or protected by copyright law.

Privileged documents. Any privileged information held by Company do not need to be disclosed. In general, privileged information includes any document which is confidential (e.g. a direct communication between a client and his/her lawyer) and is created for the purpose of obtaining or giving legal advice.

1.4 Procedure Flowchart

1.5 Procedure Steps

Depending on a data subject’s state of residency, they may have certain rights related to Company’s collection and use of their personal data. A summary of some of these rights is listed above in Section 1.2.

2. Enforcement

This document must be adhered to by all Company departments, divisions, employees, and 3^rd party service providers unless specifically granted an exception. Individual departments may develop more detailed documentation to handle department specific cases, provided they adhere to the policies that they support. This document will guide annual security reviews, as well as audits by a designated third party.

Violators of policies may be subject to employee disciplinary actions as described in applicable Company policies. Departments and divisions may impose sanctions upon their employees, within accepted guidelines, for violations.

3. Digital Subject Request Form