A subject access request (SAR) is a request under the Data Protection Act 2018 (DPA) from a person for a copy of the personal information that is held about them.
Personal information can take a number of forms eg paper, electronic, CCTV footage, a picture or even an audio recording. It can include facts and information about an individual and also include views or opinion of others about the individual.
The act entitles the individual to receive:
- a description of the data
- an explanation of why the data is being held
- an explanation of who the data may be given to
- a copy of the data with any technical terms explained
- an explanation as to the source of the data,
- an explanation as to how (if any) automated decisions taken about them have been made.
How to make a subject access request (SAR) for someone else
You can make a subject access request (SAR) on someone else's behalf only if:
- You have their written permission to do so, or
- They are your child and are too young to make the request themselves, (please bear in mind that a child is, in theory, entitled to a make their own subject access request. Where it is felt that the child is of a sufficient age and maturity to understand the nature of the request, we may need to contact the child to discuss the request and ensure they are happy for the request to proceed) or
- You have a power of attorney for the person concerned, or
- You have a court order authorising you to make the request
If none of the above apply you are unlikely to be able to make a SAR on their behalf.
How to make a subject access request (SAR)
You don't have to mention the Data Protection Act or a subject access request (SAR) for it to be a valid request.
Any request for personal information held by the council about that person is a SAR and we will deal with straightforward requests as business as usual as long as we are sure of your identity.
So if you're dealing with a council officer over an issue you can usually ask them for your personal information about that issue eg by email or letter.
If you're not currently dealing with the council or want to ask for wider information (eg all my council tax records, anything the planning team hold about me, the social work files about my youngest son) then we recommend that you apply formally using this form
You will need to
- provide proof of your identify. Acceptable types of identification are detailed in the Request Form
Proof of ID
It is important that the council is sure of your identity before releasing information. The ID that you will need to provide is set out in the SAR request form.
You will need a photocopy of one of these:
- driving licence
- birth certificate
And a copy of one of these:
- a recent bank statement (with full address) dated within the last 3 months or
- a recent utility statement (with full address) dated within the last 3 months or
- Barnet council tax number
If you're acting on behalf of the Data Subject you are still required to provide the above documentation on their behalf.
Requests are free of charge
There is no charge for making a request.
How you will get the information
We will send the information in the most appropriate way, depending on how much there is and how sensitive it is. If possible we will send by email (encrypted if necessary). Otherwise we will send by recorded or special delivery. You may be able to arrange to come to the council offices at Colindale to collect the information.
If there's no response to a request after 1 calendar month
Please check your email and post to see if you received a letter from us asking for more information. For example if you did not send the correct ID we will have contacted you to ask for this. The time to comply does not start running until we have received the required proof of ID fee. Please check and see if we have asked you for clarification, for example if what you are asking for was not clear.
If you have checked and we are not waiting to hear from you with ID or to clarify then:
- If you have had an acknowledgement email from the council contact the person who sent it to ask them for a progress update.
- If you haven't heard back from the council at all, please contact firstname.lastname@example.org with as much information as possible and we will look into it for you.
Exemptions that might apply to the information you can get
The council will send you information within the scope of your request. However the council is allowed under the Data Protection Act 2018 to withhold (redact) certain information in some circumstances. The council will only do this where an exemption applies. We have summarised the common exemptions below.
Documents containing information about another person (third party)
Where information relates to another individual (a third party) as well as the person making the request, the information about the person requesting will not be released if doing so will mean that information relating to the third party would be disclosed. The exceptions to this are where:
In deciding whether it may be reasonable to disclose the following will be considered:
a) any duty of confidentiality owed to the third party
b) whether the council feels it is necessary to seek consent of the third party
c) whether the third party is capable of giving consent
d) any express refusal of consent by the third party.
The council will also consider whether the information in question is already known to the individual, or whether it is possible to undertake a partial redaction allowing us to disclose the information without identifying the third party.
Documents written by another person (third party)
Where a document is written by another person or organisation these are not automatically exempt.
Whilst the council is allowed to seek a view from the author of the document, it is the Councils decision whether to disclose or not. Before applying this exemption the council will take the following into account:
Legally privileged information
Personal data is exempt if it consists of information for which legal professional privilege (LPP) could be maintained in legal proceedings. The LPP exemption is fairly narrow and cannot be applied to all legal documentation.
The actual content of the information is important when considering whether LPP applies as just the mere fact that it is a communication with a lawyer / solicitor does not make the document legally privileged.
LPP can be applied to documents created on instructing a lawyer or as a result of advice being given for the use in a legal case or in anticipation of a legal case.
Social work data is exempt where granting a subject access request would be likely to prejudice the carrying out of social work by virtue of resultant serious harm to the physical or mental condition of the data subject or any other person.
Serious harm to physical or mental health or condition
Health data is exempt where granting a subject access request would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person.
This exemption only applies in the most serious cases and can only be used in consultation with an appropriate medical professional.
Personal data processed for the purposes of management forecasting or planning is exempt where disclosure would be likely to prejudice the conduct of that business or other activity of the council.
Certain educational data is exempt where:
Adoption records held by the council are exempt from the subject access provisions.
This exemption means that individuals (including adopted people, birth relatives, adoptive parents and prospective adoptive parents) are not able to use the route of subject access to obtain information of this nature. It would be a breach of the DPA to allow such access under a SAR.
There are special procedures for individuals to gain access to their adoption records. Due to the nature of the information it will involve appropriate counselling of the individual and more considered approach to obtaining the data, ensuring the individual is helped through the process.
Make a SAR when your information is held by a service that the council has outsourced
Although some services are being delivered in other ways such as by a commercial partner eg council tax or in a joint venture eg planning and environmental health, or by a shared service (eg legal services) the council remains the 'data controller' for the personal information. The council has ensured that this is covered fully in the contracts we have with the delivery units.
You can make the SAR to the outsourced or partner organisation (eg council tax or planning) and they will pass it to the council to be logged and processed. However, it is better to make the SAR directly to the council.
If you're not happy with how your SAR was handled
If you'd like to ask for a review of how your SAR was handled please email the Data Protection Officer at email@example.com explaining clearly and concisely why you are unhappy. We will review the SAR and your concerns and then write to you with our findings.
If you have already had a review and are still dissatisfied, you can complain to the Information Commissioners Office:
Information Commissioner's Office
Water Lane Wilmslow Cheshire SK9 5AF
Tel: 0303 123 1113 (local rate)