Make a subject access request

What counts as personal information

Personal information can take several forms such as paper, electronic, CCTV footage, a picture or even an audio recording.

It can include facts and information about an individual and can also include views or opinions of others about the individual.

You are entitled to receive information on:

the description of the data
why the data is being held
who the data may be given to
a copy of the data with any technical terms explained
the source of the data
how (if any) automated decisions about you have been made.

Making a Subject Access Request on behalf of someone else

You can make a subject access request (SAR) on someone else's behalf if you have:

their written permission to do so, or
power of attorney for the person concerned, or
a court order authorising you to make the request.
a child and who is too young to make the request themselves.

In theory, children are entitled to make their own SAR. Where they are believed to be old and mature enough, we may contact the child to discuss the request and ensure they are happy to continue.

If none of these apply you are unlikely to be able to make a SAR on someone's behalf.

How to make a subject access request

Most of the time, you don’t need to submit a formal Subject Access Request. If you are already speaking to a council officer, you can ask them for your personal information directly (as long as we are sure of your identity). For example, by email or letter.

Proof of identity needed

It is important that the council is sure of your identity before releasing information.

If you are making a request for someone else, you will need their documentation.

You will need to provide at least one document from each category:

Category 1: Proof of address

Your full address needs to be visible

council tax bill dated within the last 3 months
drivers licence
bank statement dated within the last 3 months
utility bill dated within the last 3 months

Category 2: Proof of identification

passport
drivers licence
birth certificate

What happens after you submit your request

We will respond to your request within one month of receipt unless:

your request is unclear and we need to contact you for further clarification
we need to contact you for proof of identity
the information you request is exempt under the Data Protection Act
your request is too expensive or time consuming to respond to

If there's no response to a request after 1 calendar month

Please check your email and post to see if you received a letter from us asking for more information. For example, if you did not send the correct ID we will have contacted you to ask for this.

The response period does not start running until we have received the required proof of ID.

Please check and see if we have asked you for clarification, for example if what you are asking for was not clear.

If you have checked and we are not waiting for ID or clarification, please check if you have had an acknowledgement email from the council. You will need to reply asking for a progress update.

If you haven't heard back from the council at all, please contact data.protection@barnet.gov.uk. Please provide as much information as possible and we will look into it for you.

Information we cannot provide

We will always aim to provide the answer to your request. However, some information may be withheld or redacted (exempt) under the DPA.

Please note that information requests are considered on a case by case basis. If you are unsure, submit your request. If the information is exempt, our team will respond explaining why.

Common exemptions

We can refuse a request if:

the request is rude or made to waste time
it repeats a previous request from the same person

Third party information

If documents contain information about another individual (a third party) we may remove or withhold this information. There are cases where we may disclose information, for example if the third party has consented.

Documents written by a third party

Some documents written by another person or organisation may be exempt. Before deciding whether this information is exempt or not, the council will consider if:

the document contains information the requester already knows
the requester is already likely to have a copy
there is anything contentious in the document that is likely to cause concern if disclosed
the document has been marked to suggest disclosure isn't allowed, for example a 'confidential' watermark

Legally privileged information

We cannot disclose personal information if it could be maintained in legal proceedings. This makes it ‘legal professional privilege’ (LPP).

LPP can apply to documents created on instructing a lawyer or are advice for the use in a legal case or in anticipation of a legal case.

A document being legal or a communication with a lawyer, does not make it part of LLP.

Social work, education and serious harm

We cannot provide personal information if it could harm the physical or mental condition of the requestor. This also applies to any other person involved.

In the case of health data, this exemption only applies in the most serious of cases. We will always consult a medical professional first.

Management information

Personal data which is used to for council management or planning may be exempt if releasing this information would harm the conduct of the council.

Adoption records

Adoption records held by the council are exempt from the subject access provisions.

This means that individuals (including adopted people, birth relatives, adoptive parents and prospective adoptive parents) cannot request adoption information through a subject access request.

If you would like to gain access to your own adoption records, please contact Adopt London

If your information is held by outsourced service

Some services are outsourced or with partner organisations. The council remains the data controller for the personal information they hold. This is covered in the contracts we have with external organisations delivering any council services.

You can make the SAR to the outsourced or partner organisation and they will pass it to us to be logged and processed. It is better to make the SAR directly to us.

If you are unhappy with how your request was handled

To ask for a review of how your SAR was handled please email the Data Protection Officer at data.protection@barnet.gov.uk

Please explain clearly and concisely why you are unhappy.

We will review the SAR and your concerns and then write to you with our findings.

If you have already had a review and are still unhappy with the response, you can complain to the Information Commissioners Office:

Email: casework@ico.org.uk

Address:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Phone: 0303 123 1113 (local rate)