It is essential that the data subject defines the search for you else it
would be trying to find a needle in a haystack! I would recommend
developing a form that helps them to identify areas within your
organisation.
The Information Commissioner does state that "A data controller is not
obliged to comply with a request under this section unless he is supplied
with such information as he may reasonably require in order to satisfy
himself as to the identity of the person making the request and to locate
the information which that person seeks".Part II S7(3)
I have previously done something similar and if needs be, we went back to
the Data Subject if there was not enough information to process the request.
Hope this gives you some direction
Yvonne Sears
DP Consultant
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
www.jiscmail.ac.uk/user-manual/summary-user-commands.htm
all commands go to [log in to unmask] not the list please!
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|