Information Charging Policy

1. Purpose

The purpose of this policy is to clarify the legislative provisions on charging, the internal allocation of responsibilities and duties and to provide a public framework as to the likely charges applicable.

2. Scope

The University may levy a charge in response to requests for information in accordance with the following legislation:

• UK GDPR
• Freedom of Information Act 2000
• Environmental Information Regulations

3. Relationship with existing policies

This policy forms part of the Information Security Framework and should be read in conjunction with the:

• Information Security Policy
• Data Protection Policy
• Records Management Policy

4. Policy statement

4.1 UK GDPR

All requests from individuals for access to their personal data for their own purposes, should normally be channelled through the formal Subject Access Request procedure unless the volume and nature of the information means that this can be facilitated locally. If unsure, advice should be sought from the Compliance and Risk Team, University Secretary's Office. There is no fee under the UK GDPR for Subject Access Requests however a reasonable fee may be charged where a request is manifestly unreasonable or repetitive or where further copies of already recently provided personal data is requested. This fee will take account of administrative costs.

4.2 Freedom of Information Act 2000

i) Under the Freedom of Information Act the University may charge for the costs of searching for and extracting information not included in the Publication Scheme, where this is estimated to exceed the appropriate limit. The appropriate limit is defined in the supporting fees regulations and is currently a total of £450, or 18 hours based on a flat rate of £25 per hour per member of staff. Where it is estimated that it will take longer than 18 hours to locate an/or retrieve all the information requested, the School/Department(s) providing the estimate may be asked to supply evidence or provide a detailed breakdown of search costs to the Compliance and Risk Team, University Secretary's Office.

ii) Where a request under the Freedom of Information Act exceeds the appropriate limit the Compliance and Risk Team, University Secretary's Office shall either issue a  fees notice and/or, having consulted with the relevant School/Department(s) where necessary, refuse the request under Section 12 and advise the requester as to what is available under the threshold.

iii) The University may only charge for the release of information included under its Publication Scheme where the Publication Scheme records that the material is subject to a charge. Information which the University intends to make routinely available to the public upon payment must be included in the Publication Scheme. Any charges levied in this manner may be retained by the School/Department responsible for publishing the information.

4.3 Environmental Information Regulations 2004

Under the Environmental Information Regulations the University may, in theory, make a reasonable charge for providing information upon request with no thresholds or ceilings. However, for transparency and simplicity the flat rate calculation applicable to Freedom of Information requests shall be applied.

4.4 Disbursements

In relation to requests made under the Freedom of Information Act or Environmental Information Regulations the University may charge a reasonable sum for disbursements. For administrative simplicity and cost effectiveness the University will not charge for disbursements where these are estimated as being under £10.

4.5 Summary of charging regimes

5. Responsibilities

5.1 The University is required to have a charging policy with respect to the Environmental Information Regulations and to publicise this policy.

5.2 The Senior Officer responsible for compliance with the legislation and collection of any related charges is the Senior Information Risk Owner.

5.3 In accordance with the Data Protection Policy, the Senior Information Risk Owner shall nominate a Data Protection Officer who shall be responsible for the administration of the relevant charges.

6. Compliance

6.1 Any queries or complaints arising from this policy should be directed in the first instance to the Compliance and Risk Team, University Secretary's Office at inforequest@cardiff.ac.uk.

Key Definitions

Senior Information Risk Owner as defined in the University Information Security Policy.

Fees Regulations as described in the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004