As I understand it, the clock only starts counting down on the
40 day period when the data subject has provided the data
controller with all of the following:
1. Specific information that enables the data controller to
identify the personal data involved.
2. Any fee up to a max of £10 that the data controller has
published as being required.
3. Suitable evidence confirming the identity of the data subject
who is making the request.
It is this final criteria that causes me concern at present. To
what levels must a data controller go to confirm a data
subject's identity.
Is a name and address sufficient ?
Is a formally used registration number (staff number, student
number, national insurance number etc.) enough?
Remember that the onus and responsibility to safeguard personal
information and only to disclose it to authorised parties rests
with the data controller.
B Kelly
Data Protection Co-ordinator
Queen's University Belfast
On Wed, 31 Jan 2001 15:01:00 -0000 [log in to unmask]
wrote:
> Date: 31 January 2001
> To: internet EXTERNAL
> From: Stuart Roderick GBSAFE00 HR Systems
>
> Subject: 40 days or not 40 days that is the Q
>
> /internet
> to: [log in to unmask]
>
> Dear All,
>
> Under the DPA98 we have to comply within 40 days of receiving a request from
> an individual.
>
> My question is this- What happens if the individual does not supply
> sufficient
> data on their letter to enable us to search for them on our systems. If we
> respond to their request and ask for more details and they take 38 days to
> respond can we start the 40 days from the date of their response or is it
> from
> the initial date of the 1st letter??
>
> Many thanks for your help
>
> Stuart
>
>
>
>
>
>
>
>
> Stuart Roderick
> HR Systems Executive
>
>
>
> ****************************************************************************
> * Unencrypted electronic mail is not secure and may not be authentic. *
> * If you have any doubts as to the contents please telephone to confirm. *
> * The information contained in this message is confidential and is *
> * intended for the addressee(s) only. If you have received this message in *
> * error or there are any problems, please notify the originator *
> * immediately. The unauthorised use, disclosure, copying or alteration of *
> * this message is strictly forbidden. Opinions, conclusions and other *
> * information expressed in this message are not given or endorsed by *
> * Safeway unless otherwise indicated by an authorised representative *
> * independent of this message. *
> ****************************************************************************
----------------------
Barry Kelly
|