# >As I understand it, the 40 day response period under the Data Protection Act 1998
# >for subject access begins once the Data Controller has received 'reasonable'
# >information to identify a person making the request and 'reasonable' information to
# >locate the information which that person seeks (section 7 (3)). I am also aware
# >that the Data Controller does not have to respond to a request unless it is in
# >writing and is accompanied by the appropriate fee,
I would agree totally with this view
# >In terms of Third Party data where consent may need to be sought to disclose
# >certain information, is this then included in the 40 day period? I'm sure I have
yes it is, it is up to the organization to have it's own internal
administration sorted to enable subject access within the 40 day
period
# >read somewhere that the 40 days for this particular data does not start until
# >consent has been received.
never read that? after all it's the data subject who has the access
rights not a 3rd party. probably why advice is to get permission up front
for release if asked ie as with references.
any other views?
Sally Justice
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|