1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
  2. Hi Guest, welcome to the TES Community!

    Connect with like-minded education professionals and have your say on the issues that matter to you.

    Don't forget to look at the how to guide.

    Dismiss Notice

Making a Subject Access Request under the 1998 Data Protection Act

Discussion in 'Workplace dilemmas' started by Gardening Leaves, Jan 31, 2012.

  1. Gardening Leaves

    Gardening Leaves New commenter

    As a number of people have asked me for this information recently, it seemed a good time to reproduce it again here. In addition to the information given below, a useful source of information about making requests to have personal information disclosed can be found on the Information Commissioner's website: www.ico.gov.uk
    Whilst you have a statutory right to request this information at any time, you should bear in mind that, especially if you are already in dispute, or potentially so, with your employer, this act could cause them to throw their toys out of the pram, become defensive and make your life even more difficult. Therefore, I would urge you to think carefully before you fire off the appropriate letter and send off your ten quid! Take advice first!! (If, on the other hand, your employers are already being complete nobbers and you have nothing else to lose, it is a strong and useful piece of kit.)
    * * *
    Under the 1998 Data Protection Act, individuals have the right to request disclosure of information held by public organisations, of which they are the subject. This is done by making a Subject Access Request. This means that, subject to certain exemptions, listed in the Act, all data that has been processed about you must be disclosed on request. This includes not only things like your Personnel and occupational health records, but also emails about you that have been flying backwards and forwards between staff, or your Head and the employer's HR department. It is amzing what irritated Heads will write in emails that they never expected you to see!
    First you need to find out whether your school is its own Data Controller, under the Act, or whether the employer does this on behalf of the school. The smaller thre school, the more likely it will be that the employer handles Data on its behalf. If in doubt, send a request to both school and employer: the school will send theirs back to you, or on to the employer, if it is not relevant. If you delay, however, it wastes time and gives the target an opportunity to become defensive.
    You can search on the employer's website and find out if they have a specific policy for making disclosures, under the Act. It may name the person to whom you should address your request. otherwise address it to the Data Control Officer at County Hall. It will get there.
    You need to send a copy of the letter drafted below. Copy and paste it and then fill in the apapropriate gaps to suit your own circumstances. The more precise you can be in the information you give, the easier you make the task for them. You are trying to avoid them having any excuse to delay.
    The advantage of making a request to both employer AND school is that you should get both ends, as it were, of correspondence and emails. The Data Control Officer, stuck out in County Hall, is unlikely to know that you are in dispute with your Head and will disclose the information. If your Head has anything to hide, however, she/he may prevaricate and attempt not to disclose everything. If you have one 'end' of an email, but not the other, then you can make a complaint to the Information Commissioner that they have not complied with the law!
    As well as sending the letter - and this is VERY important - you must enclose a cheque for £10, which is the maximum fee they are allowed to charge, under the Act and proof of your identity, in the form of a photocopy of your passport or driving licence and a utility bill. If you omit either of these, you give them an opportunity to delay their response. Not all public bodies charge, by any means. Often they will return your cheque to you and explain that they don't charge. However, send it in the first instance anyway, to avoid delay.
    The recipient of your request must then provide the information to you in 40 days. This is statutory. If you don't get the stuff within the time, complain to the Information Commissioner. The 40 days does not take into account things like school holidays. Far be it for me to suggest it but, if you wish to be particularly annoying, time your request to fall a couple of days into the summer holidays. (Did I really suggest that? Naughty!)
    Under the Act, there are certain things that public bodies are exempt from disclosing - information given under professional legal privilege is one, for example, which means you can't find out what their lawyers have advised them. There is more information about this on the Information Commissioner's website: http://www.ico.gov.uk/for_organisations/data_protection/the_guide/exemptions.aspx
    Some of the information your receive may have names etc redacted or be in the form of paragraphs extracted from documents where to send you the whole doucment would breach the rpivacy of others. My favourite exemption is 'Self-Incrimination': they do not have to disclose information which would implicate them in a criminal offence, but the covering letter states that data has been withheld for that reason!
    If relevant, you can make a request of other public bodies. I have had interesting evidence unearthed by writing to Ofsted and the GTC, for example.
    Hope this is helpful. Here, now, is the template of the letter you need to write:

    Sir/Madam, </font>

    <u>Data protection subject access request</u>

    I am writing to make a subject access request pursuant to
    section 7 of the Data Protection Act 1998. I would like to know whether
    <name of school/local authority> processes personal data of which I am
    the subject.

    Assuming such data is processed, please:

    &middot; Provide a description of the data.

    &middot; Explain the purposes for which the data is processed.

    &middot; Identify the source or sources of the data.

    &middot; Set out to whom the data has been disclosed or may be

    &middot; Provide a copy of the information constituting personal

    This request relates to any personal data processed by or
    on behalf of <name of school/local authority> (from [specify date] to
    date). I wish to provide such
    information as I can to help identify any such personal data. <u>Without
    limiting the request</u>, I believe it is likely that personal data may be held
    relating to the following matters:

    <ul style="margin-top:0cm;">
    <li style="margin:0cm 0cm 0pt;" class="MsoNormal"> Xxxxxxxxxxxxxxx
    <li style="margin:0cm 0cm 0pt;" class="MsoNormal">Xxxxxxxxxxxxxxxx
    <li style="margin:0cm 0cm 0pt;" class="MsoNormal">etc

    do not know how <name of organisation> organises its data but would
    envisage that there will be relevant data processed by a number of individuals
    and sections and departments, including:

    <ul style="margin-top:0cm;">
    <li style="margin:0cm 0cm 0pt;" class="MsoNormal">Mr X
    <li style="margin:0cm 0cm 0pt;" class="MsoNormal">Mrs Y
    <li style="margin:0cm 0cm 0pt;" class="MsoNormal">Miss Z, etc
    is probable that some personal data is held in the form of <e-mails,
    spreadsheets and word processed documents>. I am not familiar with your
    policies in relation to e-mails and electronically-held data but think it
    likely that some data may be held in back-up or archive form or may have been
    deleted but be recoverable. Presumably this can be identified through the use
    of search tools.

    In relation to <specifc matters, if relevant>, I
    anticipate that there will be e-mails, electronic and &lsquo;hard copy&rsquo; data passing
    between those people listed above and also between xxxxxx. These are unlikely
    to be dated before <if possible, be helpful and set parameters>.

    My full name is spelled xxxxxx, although I was always
    known as &lsquo;xxxxx&rsquo;. However, I have found
    people using a number of variant spellings including &lsquo;xxxxx&rsquo; and &lsquo;xxxxx&rsquo;. I may
    also be referred to as &lsquo;xxx&rsquo;. This may
    be helpful, particularly when searching e-mail records.

    I enclose a cheque for &pound;10 in respect of the maximum
    prescribed fee together with a photocopy of my driving licence and a utility
    bill to confirm my identity.

    I look forward to hearing from you in relation to the
    above within the statutory time limit of 40 days.

    Yours faithfully

  2. Gardening Leaves

    Gardening Leaves New commenter

    Quite so. I think I made it clear further down that the information may be redacted or come in the form of extracted paragraphs.
  3. baitranger

    baitranger Senior commenter

    Couldn't it be summarised or re-expressed in reported speech?
  4. rosievoice

    rosievoice Star commenter

    Why should they bother going that extra mile if they don't have to?
  5. Gardening Leaves

    Gardening Leaves New commenter

    That's a good question and not one I know the answer to. I'll try to clarify that. I know that whenever I have had one of those, they have picked out and quoted verbatim the sentences or paragraphs in which I am the subject.
  6. Gardening Leaves

    Gardening Leaves New commenter

  7. Gardening Leaves

    Gardening Leaves New commenter

  8. I obtain copies of emails and documents. Why should anyone trust the organisation to report the contents of emails accurately? The guidance that i have seen says nothing about having to receive
    paraphrased or reports of emails. I do not believe the point in previosu postings is correct. Also staff at the ICO's office are not necessarily a perfectly reliable
    source of information, which is why their judgements can be appealed
    The ICO guidance sets out the exemptions. The most important exemptions apply to:
    &bull; crime prevention and detection;
    &bull; negotiations with the requester;
    &bull; management forecasts;
    &bull; confidential references given by you (but not ones given to you);
    &bull; information used for research, historical or statistical purposes; and
    &bull; information covered by legal professional privilege.
    I have not seen any exemption relating to "incriminating criminal evidence" as suggested in an earlier posting . I do not accept that is
    accurate either since it would allow any public body to withhold information
    relating to harassment etc (a criminal offence) so would simply defeat the purpose of making a Subject Access Request.

  9. Gardening Leaves

    Gardening Leaves New commenter

    1998 Data Protection Act
    Schedule 7 paragraph 11
  10. Gardening Leaves

    Gardening Leaves New commenter

    Boing! There you go, person-who-asked-for-this!!
  11. Vampyria

    Vampyria New commenter

    GL - I've considered making a request, on an off. Given that my previous HOD frequently lied through her teeth/witheld relevant facts -anything to deflect blame from herself, I suspect there would be some very interesting reading!
    However, in view of my earlier comments ( other post ) about the SMT line manager I heavily suspect that a) it would make them suspicious of my motives-they were on tenterhooks when I left b) so I wouldn't be at all surprised to hear they've witheld some of the information. Is there anything to prevent them doing this? Of course I could always try the LA and see what turns up, though I'd suspect a lot of the potentially useful stuff is still in the school? I could be wrong, of course....
  12. Gardening Leaves

    Gardening Leaves New commenter

    The glib comment is that the law is there to stop them withholding information! Theory and practice can differ however. I know darned well that my bullies withheld incriminating emails between each other and the LEA. The LEA ones were easy to prove because I made an application to them as well and they disclosed their end of the emails! You can report them to the information commissioner if they unlawfully withhold.
  13. snowstorm

    snowstorm New commenter

    Using subject access, I uncovered more than 30 incriminating emails between HR and my HT, and submitted these to my tribunal, but they were no use whatsoever even though they blatantly evidenced the contempt that both held for me. No notice was taken of them.
    GL, I have started a thread on the GTC/ISA issue. Would value your input.
  14. Hello,
    This is interesting. i left my job last year following quite a difficult time but I took redundancy and received a CA.
    Would I be entitled to access this even after signing a CA, a complaint was made about me by a parent and the principle wouldn't disclose who had made the complaint. Would I be able to find out who it was?
    Also, how long is the data held?
    Thank you.
  15. Gardening Leaves

    Gardening Leaves New commenter

    Upped for specific poster.
  16. Hi,
    Hope you can still help with this issue. I have been told I must go into school to look at the info. then choose what i want copied. i have requested (twice) by e-mail (I am signed off) for copies of all the info to be sent to me. They are refusing. Can they do this?
  17. rosievoice

    rosievoice Star commenter

    I think they are being lazy. Write to the Information Commissioner and dob them in. They have to supply the data within forty days of your request. The ICO will light a rocket under them. Good luck.
  18. Thank you. I will pass this on to my Union.
  19. Thank you for your reply. Can they get away with it by saying they've offered me the chance to go in and 'select' which info I want copied? I've told them I want it all. Seems they won't budge. I really don't want to go in, especially as my Dr. is adamant I don't.
  20. rosievoice

    rosievoice Star commenter

    Consult a solicitor.

Share This Page