DATA PROTECTION OFFICE {PMO} “OVERVIEW OF THE FUNDAMENTAL ASPECTS OF THE RIGHT OF ACCESS“ Presented by The Commissioner Mrs D. Madhub To Mutual Aid Association Staff 107/10/2015

DATA PROTECTION OFFICE {PMO} What does the right of access stand for? All data subjects (including parents, legal guardians or any person duly authorised in writing by the data subject) have the right to access their own personal details kept by the data controller; Suffice that they fill the request for access to personal data form available on the homepage of our website and submit it to the data controller concerned and not the Data Protection Office together with a payment of RS 75 as provided in the Data Protection regulations of /10/2015

DATA PROTECTION OFFICE {PMO} The data controller is then required to supply the data subject with a copy of the personal information on the individual that it possesses, the purposes for which the data are kept and the people or institutions that the data may be disclosed to within 28 days of the receipt of the request. Where the data controller is unable to comply with the request, it must so inform the data subject within the period of 28 days and as soon as practicable, comply with the request. 307/10/2015

DATA PROTECTION OFFICE {PMO} A data controller may refuse to accede to such a request for disclosure:- Where he is not provided with sufficient information -as to the identity of the requestor and- to locate the information requested; or Where compliance with the request will result in the contravention of a legal confidentiality obligation; or Where the information relates to the education, training or employment, provision of service by the data subject; or Where compliance with the request will expose the data controller to legal proceedings for the commission of an offence. 407/10/2015

DATA PROTECTION OFFICE {PMO} Where the data controller is also in possession of associated personal data of another individual/s, he may refuse to disclose that data unless that other indivudual/s has/ve consented to the disclosure or he obtains the written autorisation of the Commissioner. The data controller has to erase, rectify, block or destroy as appropriate or notify as soon as is reasonably practicable the third party holding inaccurate data where he has been informed of the inaccurateness of the data. Failure by the data controller to do so will give rise to the right of the data subject to apply to the Commissioner for needful to be done. 507/10/2015

DATA PROTECTION OFFICE {PMO} Such requests have to be made at reasonable intervals. Otherwise, the data controller may be entitled to refuse the request. Some practical tips for handling requests for access to personal data forms:- Appoint a Co-ordinator or a Data Protection Officer who will be responsible for the response to the access request. A description of the functions and responsibilities of the Co-ordinator should be circulated within the organisation and staff should be advised of the necessity for co-operation with the Co-ordinator. All subject access matters should be submitted to the Co-ordinator. 607/10/2015

DATA PROTECTION OFFICE {PMO} Check the validity of the access request. Ensure that it is in writing, that the appropriate fee of Rs 75 is included. Log the date of receipt of the valid request. 707/10/2015

DATA PROTECTION OFFICE {PMO} THANK YOU ANY QUESTIONS OR COMMENTS? 807/10/2015