On Mon, 12 Jun 2000 16:37:37 +0000 Krissy Welsh <[log in to unmask]>
wrote:
>
"As I understand it, the 40 day response period under the Data Protection Act
1998 for subject access begins once the Data Controller has received
'reasonable' information ... In terms of Third Party data where consent may
need to be sought to disclose certain information, is this then included in the
40 day period? I'm sure I have read somewhere that the 40 days for this
particular data does not start until consent has been received."
----
I suspect any comment such as the final one was a bit of optimism. John
Hitches' reply points to the paragraph which indicates that one should give all
that is possible by the due date. The other point which I think is important
is that the Act refers specifically to the requirement to provide information
"promptly and in any event before the end of the prescribed period". I think it
is important to see it this way, and not to get fixated on 40 days - the latter
figure can be a fall-back, but not something to aim for. So, in "project"
terms, one could not justifiably hold up the whole project of subject access
simply because one task was not completed - the rest of the process would have
to go on.
----------------------
Dr Trevor Field
Senior Assistant Secretary
University of Aberdeen
++44 (0)1224 272077
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|