This sounds like a legitimate subject access request, but the short answer
is 'no', you don't necessarily have to release all the data requested. But
it's not a matter of choice, it depends on whether the Act says you must.
Provided you are satisfied as to the identity of the Data Subject and the
authority of the law centre to act on their behalf (which you presumably
are, since you have a signed authority), then you have to:
1) tell them straight away if you require a fee of up to £10
2) identify all the personal data you hold about the individual
(which might or might not include all your paper records, depending on
whether they count as a relevant filing system in the light of the Durant
case)
3) decide whether you are entitled to withhold any information on
grounds of third party confidentiality, legal privilege, or other permitted
reasons
4) edit the material accordingly
5) supply a copy of the material that you must provide, within 40
days of receiving the original request (provided they cough up the fee by
then)
The main issue is probably (2) though (3) might cause problems depending on
what is in the records. You may also reduce your workload and cost by
discussing with them whether they want all the material they are entitled to
or just a specific sub-set.
Since this looks as though it is likely to end in litigation, I would
suggest getting a lawyer to help you at this stage, to minimise the
likelihood of problems later. But act soon, the 40 days is ticking away.
Paul Ticher
0116 273 8191
22 Stoughton Drive North, Leicester LE5 5UB
I hereby require any recipient of this message not to use my personal data
for direct marketing purposes.
----- Original Message -----
From: "PETER SELENIC" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Wednesday, April 20, 2005 4:47 PM
Subject: I am in receipt of a letter from a Law Centre
I am in receipt of a letter from a Law centre who are acting for a
client (a student of the college) relating to that students Education
Maintenance Allowance application (EMA) in September 2004.
It follows
"In accordance with instructions from my client and with reference to
Section 7 of the Data Protection Act 1998, this is a formal written
request that you release all of my clients education and personal
records, which you hold as Data controller, both manual and electronic.
I would be grateful if you provide these as soon as possible and in any
event within 40 days.
I enclose a copy of my client's signed Form of Authority.
http://www.hmso.gov.uk/acts/acts1998/80029--b.htm#8
<http://www.hmso.gov.uk/acts/acts1998/80029--b.htm#8> , is the relevant
section of the act.
The request follows a complaint received by the college from the student
regarding the same EMMA application. I would be interested in views, Is
it it obvious to release all the requested data as requested.
Regards
Peter
DP Officer
Epping Forest College
**********************EFC disclaimer *********************
This message is sent in confidence for the addressee only.It may contain
confidential or sensitive information.The contents are not to be disclosed
to anyone other than the addressee.Unauthorised recipients are requested to
preserve this confidentiality and to advise us of any errors in
transmission.Thank you.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
http://www.jiscmail.ac.uk/help/commandref.htm
Any queries about sending or receiving message please send to the list owner
[log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
http://www.jiscmail.ac.uk/help/commandref.htm
Any queries about sending or receiving message please send to the list owner
[log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|