Would I be correct in thinking that if a reference is provided by one person in an institution to another person in the same institution the, Data Controller is the same, so that a subject access request to the Data Controller may be refused through the exemption in Schedule 7 Section 1? Roy Candy Northampton General Hospital %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%