6.5 Resolver Data Subject Access Request Procedure GDPR

1. Purpose, scope, and users

This procedure sets out the key features regarding the handling of or response to requests for access to personal data made by data subjects, their representatives, or other interested parties by Resolver (the “Company”). This procedure will enable the Company to comply with legal obligations, provide better customer care, improve transparency, enable individuals to verify that information held about them is accurate, and increase the level of trust by being open with individuals about the information that is held about them.

This procedure applies broadly across all entities or subsidiaries owned or operated by the Company but does not affect any state or local laws or regulations which may otherwise be applicable.

This procedure applies to employees that handle data subject access requests such as the Data Protection Officer.

2. Reference documents

  • EU GDPR 2016/679 (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC)

3. Data Subject Access Request (“DSAR”)

A Data Subject Access Request (DSAR) is any request made by an individual or an individual’s legal representative for information held by the Company about that individual. The Data Subject Access Request provides the right for data subjects to see or view their own personal data as well as to request copies of the data.

A Data Subject Access Request must be made in writing (including by completing an online form on a corporate website: https://www.resolver.com/legal/data-subject-access-request/). In general, verbal requests for information held about an individual are not valid DSARs. In the event a formal Data Subject Access Request is made verbally to a staff member of the Company, further guidance should be sought from Data Protection Officer, who will consider and approve all Data Subject Access Request applications.

A Data Subject Access Request can be made via any of the following methods: email, post, corporate website, or any other written method. DSARs made online must be treated like any other Data Subject Access Requests when they are received, though the Company will not provide personal information via social media channels.

4. The Rights of a Data Subject

The rights of an individual in relation to a data subject access, insofar as this is possible, include the following:

  • Know whether a data controller holds any personal data about him/her/they;
  • Receive a description of the data held about him/her/they and, if permissible and practical, a copy of the data;
  • Be informed of the purpose(s) for which that data is being processed, and from where it was received;
  • Be informed whether the information is being disclosed to anyone apart from the original recipient of the data and if so, the identity of those recipients;
  • The right of data portability (e.g. data subjects can ask that their personal data be transferred to them or a third party in a machine-readable format (Word, PDF, etc.), however, such requests can only be fulfilled if the data in question is: 1) provided by the data subject to the Company, 2) is processed automatically and 3) is processed based on consent or fulfillment of a contract); and
  • If the data is being used to make automated decisions about the data subject, to be told what logic the system uses to make those decisions and to be able to request human intervention.

The Company must provide a response to data subjects requesting access to their data within 30 calendar days of receiving the Data Subject Access Request unless local legislation dictates otherwise.

5. Requirements for a valid DSAR

To be able to respond to the Data Subject Access Requests on time, the data subject should:

  • Submit his/her/their request using a Data Subject Access Request Form.
  • Provide the Company with sufficient information to validate his/her/their identity, to ensure the person requesting the information is the data subject or his/her/their authorized person.

Subject to the exemptions referred to in this document, the Company will provide information to data subjects whose requests are in writing (or by some other method explicitly permitted by the local law), and are received from an individual whose identity can be validated by Company.

However, the Company will not provide data where the resources required to identify and retrieve it would be excessively difficult or time-consuming. Requests are more likely to be successful where they are specific and targeted at particular information.

Factors that can assist in narrowing the scope of a search include identifying the likely holder of the information (e.g. by making reference to a specific department), the time period in which the information was generated or processed (the narrower the time frame, the more likely a request is to succeed), and being specific about the nature of the data sought (e.g. a copy of a particular form or email records from within a particular department).

6. DSAR process

6.1.  Receiving a Request

Upon receipt of a DSAR, the Data Privacy Officer will acknowledge the request. The requestor will be asked to complete a Data Subject Access Request Form to better enable the Company to locate the relevant information <== VLAD ISN’T THIS REPETITIVE? WHY WOULD THEY HAVE TO COMPLETE A DSAR IF IT IS ALREADY RECEIVED?

6.2. Identity verification

The Operations Coordinator<== WHO IS THIS? needs to check the identity of anyone making a DSAR to ensure information is only given to the person who is entitled to it. If the identity of a DSAR requestor has not already been provided, the person receiving the request will ask the requestor to provide two forms of identification, one of which must be a photo ID and the other confirmation of address (e.g. e-mail address).

If the requestor is not the data subject, written confirmation that the requestor is authorized to act on behalf of the data subject is required.

6.3.  Information for Data Subject Access Request

Upon receipt of the required documents, the person receiving the request will provide the Data Protection Officer with all relevant information in support of the DSAR. Where the Data Protection Officer is reasonably satisfied with the information presented by the person who received the request, the Data Protection Officer will notify the requestor that his/her DSAR will be responded to within 30 calendar days.

The 30-day period begins from the date that the required documents are received. The requestor will be informed by the Data Protection Officer in writing if there will be any deviation from the 30-day timeframe due to other intervening events.

6.4.  Review of Information

The Data Protection Officer will contact and ask the relevant department(s) for the required information as requested in the DSAR. This may also involve an initial meeting with the relevant department to go through the request if required.

The department which holds the information must return the required information by the deadline imposed by the Data Protection Officer and/or a further meeting is arranged with the department to review the information. The Data Protection Officer will determine whether there is any information that may be subject to an exemption and/or if consent is required to be provided from a third party.

The Data Protection Officer must ensure that the information is reviewed/received by the imposed deadline to ensure the 30-day timeframe is not breached. The Data Protection Officer will ask the relevant department to complete a “Data Subject Disclosure Form” to document compliance with the 30-day requirement.

6.5.  Response to Access Requests

The Data Protection Officer will provide the finalized response together with the information retrieved from the department(s) and/or a statement that the Company does not hold the information requested, or that an exemption applies.

The Data Protection Officer will ensure that a written response will be sent back to the requestor. This will be via email unless the requestor has specified another method by which they wish to receive the response (e.g. post). The Company will only provide information via secure channels.

When hard copies of information are posted, they will be sealed securely and sent by recorded delivery.

6.6.  Archiving

After the response has been sent to the requestor, the DSAR will be considered closed and archived by the Data Protection Officer.

The procedure is presented as a flow chart in the Annex of this document.

7. Exemptions

An individual does not have the right to access information recorded about someone else, unless they are an authorized representative, or have parental responsibility.

The Company is not required to respond to requests for information unless it is provided with sufficient details to enable the location of the information to be identified and to satisfy itself as to the identity of the data subject making the request.

In principle, the Company will not normally disclose the following types of information in response to a Data Subject Access Request:

  • Information about other people – a Data Subject Access Request may cover information that relates to an individual or individuals other than the data subject. Access to such data will not be granted unless the individuals involved consent to the disclosure of their data.
  • Repeat requests – Where a similar or identical request in relation to the same data subject has previously been complied with within a reasonable time period, and where there is no significant change in personal data held in relation to that data subject, any further request made within a six month period of the original request will be considered a repeat request, and the Company will not normally provide a further copy of the same data
  • Publicly available information – the Company is not required to provide copies of documents that are already in the public domain.
  • Opinions given in confidence or protected by copyright law – the Company does not have to disclose personal data held in relation to a data subject that is in the form of an opinion given in confidence or protected by copyright law.
  • Privileged documents – any privileged information held by Company need not be disclosed in response to a DSAR. In general, privileged information includes any document which is confidential (e.g. a direct communication between a client and his/her lawyer) and is created for the purpose of obtaining or giving legal advice.

8. Data Subject Access Request refusals

There are situations where individuals do not have the right to see information relating to them. For instance:

  • If the information is kept only for the purpose of statistics or research, and where the results of the statistical work or research are not made available in a form that identifies any of the individuals involved.
  • Requests made for other, non-data protection purposes can be rejected.

If the responsible person refuses a Data Subject Access Request on behalf of the Company, the reasons for the rejection must be clearly set out in writing. Any individual dissatisfied with the outcome of his/her Data Subject Access Request is entitled to make a request to the Data Protection Officer to review the outcome.

9. Responsibilities

The overall responsibility for ensuring compliance with a DSAR rests with the Data Protection Officer.

If the Company acts as a data controller towards the data subject making the request then the DSAR will be addressed based on the provisions of this procedure.

If the Company acts as a data processor the Data Protection Officer will forward the request to the appropriate data controller on whose behalf the Company processes personal data of the data subject making the request.

10. Managing records kept based on this document

Record nameStorage locationThe person responsible for the storageControls for record protectionRetention time
Data Subject Access Request FormsDSAR FormData Protection OfficerOnly authorized persons may access the folder10 years
Data Subject Disclosure FormPrivacy StatementData Protection OfficerOnly authorized persons may access the folder10 years

11. Validity and document management

This document is valid as of July 2020.

The owner of this document is Data Protection Officer, who must check and, if necessary, update the document at least once a year.

EFFECTIVE ON: September 2020

REVIEW CYCLE: Annual at least and as needed

REVIEW, APPROVAL & CHANGE HISTORY: Last time reviewed and approved in August 2020 by Resolver’s Information Technology Security team.