There is disagreement in my University as to whether we have to disclose references that we receive. The following email was sent by a colleague who believes that disclosure is not permitted without consent which is contrary, I believe, to the consensus. You will see that it relies upon advice from the Information Commissioner's office! I would be grateful for any comments about what he says.
"The talk which I gave to administrative colleagues this morning was based on our recent practice and on guidance issued by the Information Commissioner.The Commissioner has issued a useful note called "Subject Access Rights and Third Party Information" which gives advice on the issue of seeking consent from third parties before releasing data to Data Subjects.
I have recently been in correspondence with one of the Commissioner's Compliance Officers about an actual Subject Access Request, which depended on whether or not the author of a reference gave consent for its release.The Compliance Officer's letters suggest that the author's consent is required before a reference received by a data controller may be released.
Indeed, one of his letters informed me that I had "tried in a more than reasonable manner to obtain the consent of the third party to disclosure".
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
www.jiscmail.ac.uk/user-manual/summary-user-commands.htm
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|