My company works in the health sector, chiefly with NHS organisations. If
experience there is any guide then I believe you have no choice but to
comply, regardless of cost.

Subject Access Requests in the health field may require not only the
extraction of computerised data, but also the copying of often lengthy
medical records and other "data" such as x-ray images, videos, etc. The cost
is usually substantially greater than the fee chargeable, especially when
clerical effort is added into the equation. Currently a fee of up to £50 is
chargeable if the SAR includes non-computerised data but after October this
will drop to £10, imposing a severe financial burden on NHS organisations.

Stuart Cashmore
Management Information Projects Manager
McKessonHBOC (UK), No. 1 Nine Elms Lane, LONDON SW8 5RR

Tel.    020-7819 5083  (with Voicemail)
Mob.    07799-790019
Fax.    020-7819 5100
e-mail [log in to unmask]
<mailto:[log in to unmask]> 



        -----Original Message-----
        From:   Stephen Harrow [SMTP:[log in to unmask]]
        Sent:   02 May 2001 02:21
        To:     [log in to unmask]
        Subject:        The £10.00 Compliance Fee and 'Disproportionate
Effort'

         Colleagues in the HE/FE Sector,

        If an exam candidate submits a Data Subject Access request 
        in the proper way, requiring sight of her/his examination 
        script(s), and the institution believes that it is right to 
        accede for the sake of transparency and because the 
        institution has no saucy examiners' comments to hide and 
        does not wish to find clever ways to frustrate a genuine 
        seeker after knowledge; but it costs the institution, say, 
        £50.00 to comply, since extra staff have to be hired to 
        unearth the scripts from the depths of the warehouse where 
        these are stored, after marking, etc, each November, how 
        may the institution recoup the cost?

        A fee of £10.00 can be charged. Are any other incidental 
        expenses chargeable?  And, if so, how may these be 
        calculated?  Can the measure of 'disproportionate effort' 
        be in some way a function of the extra expense demanded by 
        compliance?  And at what point in totting up the likely 
        cost of compliance can an institution say: 'Enough is 
        enough. We cannot afford to comply, even though we actually 
        want to.'

        Is an institution in that position simply hoist with its 
        own highmindedness?  Presumably, if an institution knows 
        beyond a legal peraventure that it has no personal data in 
        the form of marks or comments on a given examination 
        script, it can charge what it likes to retrieve that script 
        (being exempt from the Data Protection Act under Schedule 
        7/9) if, after being assured that no personal data can be 
        'communicated' from that source, the candidate persists in 
        requesting 'access' (sight of the script) and refuses to 
        accept those assurances. 

        Stephen Harrow
        Data Protection Secretariat
        King's College London
        020 7848 3401
        1 May 2001

        ----------------------
        [log in to unmask]

        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
            If you wish to leave this list please send the command
               leave data-protection to [log in to unmask]
                    All user commands can be found at : -
            www.jiscmail.ac.uk/user-manual/summary-user-commands.htm
        all commands go to [log in to unmask] not the list please!
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^


----------------------------------------------------------------------------
The information contained in this e-mail is confidential and is intended
only for the named recipient(s). If you are not the intended recipient you
must not copy, distribute, or take any action or reliance on it.
If you have received this e-mail in error, please notify the sender.
Any unauthorised disclosure of the information contained in this e-mail
is strictly prohibited.
----------------------------------------------------------------------------

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    If you wish to leave this list please send the command
       leave data-protection to [log in to unmask]
            All user commands can be found at : -
    www.jiscmail.ac.uk/user-manual/summary-user-commands.htm
all commands go to [log in to unmask] not the list please!
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^