Introduction
Under the General Data Protection Regulation, individuals can ask to see personal data about themselves that is held on a computer and in some paper records. If an individual wants to exercise this subject access right, there is a procedure to follow. Individuals also have the right to have incorrect information held about them changed.
West Berkshire Mencap complies with the General Data Protection Regulation and will comply with its legal obligations for subject access requests.
The key aims of the policy and procedure are:
- That all employees know how to process a subject access request;
- That an individual understands how to access personal information held about them and make corrections if necessary.
Definition of Personal Data
Personal data is any information that relates to a living individual who can be identified – a) from that information, or b) from that information and other information which is in the possession of, or is likely to come into the possession of the Data Controller. It includes any expression of opinion about an individual and any indication of the intentions of the Data Controller in respect of the individual.
Exemptions
West Berkshire Mencap is not obliged to comply with the request if doing so would reveal the identity of another individual, unless:
- The other individual has given their consent;
- It is reasonable to comply without gaining consent.
When deciding whether to release third party details without consent, consideration will be given to:
- Whether there is a duty of confidence to the other individual;
- Whether appropriate steps have been taken to gain consent;
- Whether the other individual(s) are capable of giving consent;
- Whether the other individual(s) has expressly refused to give their consent.
Roles and Responsibilities
Specific responsibility for Data Protection within the organisation is as follows:
- Data Protection Lead – Paul Harris
- CEO Team: Sara Vaughan CEO, Tony Ferguson Deputy CEO, Jane Hall Deputy CEO.
- Member of the Board of Trustees – Paul Pointer
- Data Processors – any employee, volunteer or trustee handling personal information
No employee other than the Data Protection Lead is authorised to release personal information.
Subject access request procedure
A subject access request must be made in writing using the approved West Berkshire Mencap Subject Access Request form.
The outside of the envelope should be marked Subject Access Request.
A request must include TWO forms of identification. Examples of suitable identification include a photocopy of a passport or driving licence and a recent utility bill (within 3 months) or council tax letter (within 12 months) showing the current address of the person making the request.
On receipt of a subject access request, the envelopes must be passed unopened to the Data Protection Lead (Paul Harris) or in his absence to one of the CEO Team.
Once received the form should be date stamped.
An acknowledgement will be sent to the person requesting access within 3 working days of receiving the request. The acknowledgement will also outline the process and timescale for the request to be completed.
We will gather any manual or electronically held information (including emails) and identify any information provided by a third party or which identifies a third party.
If we have identified information that relates to third parties, we will write to them asking whether there is any reason why this information should not be disclosed. We do not have to supply the information unless the other party has provided consent or it is reasonable to do so without their consent. If the third party objects to the information being disclosed, we may seek legal advice on how to proceed.
A reply to the request will be sent to the individual without undue delay and in any event within 30 calendar days of receipt of the request. However, if the work involved is particularly complex or if numerous requests are made then we may extend this period by up to two additional months. In this case we will inform the person requesting access about the extension and explain the reasons.
We will not charge a fee for dealing with your request unless it is manifestly unfounded or excessive. If we charge a fee, we will inform the person requesting access to explain the reasons for doing so.
If West Berkshire Mencap does not hold any personal information regarding the data subject, or an exemption applies, the Data Protection Lead will respond in writing to the individual explaining this.
If the individual considers the information held by West Berkshire Mencap to be inaccurate they must write to the Data Protection Lead (Paul Harris), including two forms of identification as above, and clearly state what information is incorrect and what the correct information is.
Third Party Requests
Applications for access to information about another individual can be made following the procedures above, but only in certain circumstances. A third party (including solicitors) must provide a letter signed by the data subject authorising the release of the information.
Requests can be accepted from a third party, without the data subject’s agreement if that person is deemed incapable of providing consent and the third party is the individual’s authorised representative. If there is any doubt about the validity of the request, a copy of the power of attorney will be needed.
The police may also request information. The usual procedure for a written request should be followed and the request verified before information is released. The police do not have the right of access to information. Information may only be provided for one of the following reasons:
- For the prevention or detection of a crime;
- For the apprehension or prosecution of offenders.
It is also possible to receive a request for personal information about a third party without the data subject’s prior consent by claiming an ‘exemption’. This is basically a valid reason, as outlined in the Data Protection Act 1998 to allow for the disclosure under certain circumstances. The most common are:
- Crime and taxation
- Required by law or made in connection with legal proceedings
- Confidential references given by West Berkshire Mencap
A parent or guardian can request to see personal information relating to a minor without the child’s consent. However, the age of the child must be taken into consideration as will their ability to give consent and decisions surrounding obtaining a child’s consent will be made on a case-by-case basis.
Monitoring
Subject access requests will be monitored by the Data Protection Lead to ensure that the legal obligations are adhered to.
If the individual is not satisfied with our actions, they can raise a complaint directly with West Berkshire Mencap.
If they remain dissatisfied they have the right to refer the matter to the Information Commissioner or seek recourse through the courts
The information commissioner can be contacted at:
Information commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Policy Review
The policy will be reviewed every year or earlier in accordance with any amendments to the regulations or any other legislation.
