In a message dated 04/05/2000 13:51:10 GMT Daylight Time,
[log in to unmask] writes:
<< See the following email sent to the list on 27 April 2000. Surely the
advice
given to Nadine is correct?
I have recently had a response from the DPCO clarifying the position re
confidential references, where the data controller (in this case a
university) is not only the giver but also the receiver of the
reference. They advise that personal references are exempt from subject
access while they remain in the hands of the data controller. They
confirm that all information contained in confidential references given
by the University or by its staff acting on behalf of the University are
exempt from subject access.
Heads of Department will gain some comfort from this! >>
Compare this with advice from the same source given to Lucinda Bennett:
>I was speaking to the O of the DPC this morning and asked
>the Enquiries section what the position was where Dept A
>provides a confidential reference to Dept B, where both A
>and B are part of the same institution. I was advised that
>whilst a subject could not obtain a copy of the reference
>from Dept A, the subject could approach Dept B in
>order to obtain a copy of the reference.
It appears to conflict with the earlier advice, until you read between the
lines. A confidential reference (and it must bear an unambiguous indicator
to that effect) remains confidential before and after it is GIVEN by the data
controller. The data controller need not supply the reference when
approached by a data subject, assuming the data controller has a copy of it.
As the law says, "given or to be given by the data controller".
However, there is no such exemption from the subject access rules for
references RECEIVED by the data controller - even if the organisation is one
and the same.
Hope this helps to clear it up.
Ian Buckland
MD
Keep IT Legal Ltd
Please Note: The information contained in this document does not replace or
negate the need for proper legal advice and/or representation. It is
essential that you do not rely upon any advice given without contacting your
solicitor. If you need further explanation of any points raised please
contact Keep I.T. Legal Ltd at the address below:
55 Curbar Curve
Inkersall, Chesterfield
Derbyshire S43 3HP
(Reg 3822335)
Tel: 01246 473999
Fax: 01246 470742
E-mail: [log in to unmask]
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|