In a message dated 09/03/2001 09:42:13 GMT Standard Time,
[log in to unmask] writes:
<< Ian wrote - Unless of course the data subject already knows the identity
of these third parties in which case there is no reason to withhold nor even
to seek consent.........
Disagree - The subject may well know the identity of TP. It is the data that
is the key. If after reading the reference you feel that releasing would not
come back to haunt YOU (from TP) Release . (I & you know there shouldn't
be - but - heh this is the REAL world.) If however you feel there might be
something, and after asking the TP for consent which is not given - it would
be a very brave DPO who would release. Your call. >>
---------------------------
Yep. It IS your call. If you as the data controller feel that the release
of the data is likely to cause harm (not embarrassment) - to ANY person
including yourself - then you might decide (reasonably in my view) to
withhold. However, most of the information included in SARs is not of this
type.
In response to some other replies on this subject let me reiterate, apologies
for the repetition but some people seem to have missed the point about
releasing information that would identify the third party (sorry if it wasn't
clear but here is the actual text):
"Just because you have promised confidentiality (e.g. "any comments you make
will be held in confidence"), or the person writes "confidential" at the top
of the letter or reference, does not meen necessarily that a duty of
confidence exists.
You will need to seek the consent of these people before deciding whether to
release the information that would identify them (the rest of their
report/reference can be given anyway) and if they refuse consent you should
then consider whether in the circumstances it would be reasonable to disclose
their identities to the data subject.
Unless of course the data subject already knows the identity of these third
parties in which case there is no reason to withhold nor even to seek
consent."
If part of the content of the text is likely to identify the person, you will
need to seek consent for the release of that part of the text. For example,
"his ex-wife told us he was loud, obnoxious and opinionated." In order to
meet the 40 day deadline whilst seeking consent you might be able to alter
the text to read "we have been told that he is loud, obnoxious and
opinionated."
And I'll tell you something else - if that type of information was given to
me and I felt I wouldn't be prepared to release it, it would never appear on
the person's record in the first place. But I would remember it next time I
see him.
Ian B
MD
Keep IT Legal Ltd
Please Note: The information contained in this document does not replace or
negate the need for proper legal advice and/or representation. It is
essential that you do not rely upon any advice given without contacting your
solicitor. If you need further explanation of any points raised please
contact Keep I.T. Legal Ltd at the address below:
55 Curbar Curve
Inkersall, Chesterfield
Derbyshire S43 3HP
(Reg 3822335)
Tel: 01246 473999
Fax: 01246 470742
E-mail: [log in to unmask]
Website: www.keepitlegal.co.uk
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
www.jiscmail.ac.uk/user-manual/summary-user-commands.htm
all commands go to [log in to unmask] not the list please!
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|